Security Self-Assessment: [STRIDE-TAMPER-1] Produce a SBoM

[randomvariable]

User Story

As a cluster operator, i want to know the list of dependencies Cluster API brings for assurance within our organisation's software supply chain.

Detailed Description

• Create SBoM of all the Cluster API components and verify checksum as a post build action

cc @PushkarJ for adding more details.

/kind feature
/area security

[PushkarJ]

Thanks for creating this Naadir. Automated SBoM generation as part of container image building with ko just came out: https://blog.chainguard.dev/auto-sboms-with-ko/ .

We could explore if its a good option for generating SBoMs for cluster-api container images.

[sbueringer]

/milestone v1.2

[sbueringer]

Similar CAPA issue: kubernetes-sigs/cluster-api-provider-aws#3325

[PushkarJ]

/retitle Security Self-Assessment: [STRIDE-TAMPER-1] Produce a SBoM
/sig security