docs: made buildprobe less central to documentation, add metadata format

Author: bclindner

docs/sboms/oci_image.md

@@ -9,9 +9,29 @@ generated by Hermeto (previously known as Cachi2), with the requirement that
 at least one SBOM is provided in total. It combines these SBOMs
 and takes them as a context of the built image.
 
-The script uses buildprobe (see [capo](https://github.com/konflux-ci/capo) for
-details) to determine container content and which base images were used to
-build the image.
+The script takes a simple YAML file to determine container content and what
+other images were used to build the image:
+
+```yaml
+# the image being built:
+image:
+  pullspec: example.com/foo:1.2.3
+  digest: sha256:bf07a7fbb825fc0aae7bf4a1177b2b31fcf8a3feeaf7092761e18c859ee52a9c
+
+# for images used directly to build the OCI image:
+base_images:
+- pullspec: example.com/bar:4.5.6
+  digest: sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
+
+# for other images used in the OCI image (i.e. for copying files):
+extra_images:
+- pullspec: example.com/baz:7.8.9
+  digest: sha256:7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
+```
+
+
+You can easily generate this metadata using buildprobe (see
+[capo](https://github.com/konflux-ci/capo) for details).
 
 All provided SBOMs must be in the same specification! This script does not
 support combining SPDX and CycloneDX SBOMs.
@@ -31,7 +51,7 @@ mobster --verbose  generate oci-image \
 - `--from-hermeto` -- points to an SBOM file (in a JSON format) created by Hermeto
 - `--image-pullspec` -- the pullspec of the image processed in the format `<registry>/<repository>:<tag>`
 - `--image-digest` -- the digest of the image processed in the format `sha256:<digest value>`
-- `--metadata-path` -- points to Dockerfile/Containerfile metadata processed by `buildprobe`
+- `--metadata-path` -- points to a Dockerfile/Containerfile metadata YAML file
 - `--contextualize` -- Allows SBOM contextualization (see [Contextual SBOM](#contextual-sbom))
 - `--output` -- where to save the SBOM. prints it to STDOUT if this is not specified
 - `--skip-validation` -- skips validation of the SBOM