sbom: T9098: syft should run un squashfs instead of unpacked chroot

lb (live-build) binary runs binary_rootfs first, then binary_grub-efi.
binary_grub-efi temporarily installs EFI tooling and then runs:
  "apt remove --auto-remove --purge --allow-remove-essential"

That cleanup is safe for the already-generated squashfs, but it mutates
build/chroot and can remove vyos-1x, breaking subsequent work that expects
chroot to remain intact for SBOM generation.

But why unpacking the squashfs?

In an ideal world we could call syft on the compressed squashfs file which is
supported. In our world, we do use a BCJ pre-filter chained with LZMA2 for
compressing the squashfs, which will increase the compression ratio without a
decompression penalty.

  Difference: ~14.3 MB, ~2.7% smaller

This is unsupported by fyft which means we do need to unpack the squashfs first
before checking the files and generating the SBOM file.

Author: c-po

scripts/image-build/build-vyos-image

@@ -727,17 +727,26 @@ Pin-Priority: 600
         manifest['artifacts'].append(iso_file)
 
         # Now create SBOM
-        syft_target_dir = 'chroot'
+        syft_target_dir = 'unsquashfs_rootfs'
         syft_base_path = os.getcwd() + f'/{syft_target_dir}'
         base_filename = iso_file.rstrip('.iso')
-        syft_cmd = [['syft', syft_target_dir,
+        # lb config builds the amd64 squashfs as xz with -Xbcj x86 (a BCJ pre-filter
+        # chained with LZMA2. Real unsquashfs/mksquashfs fully support multi-filter
+        # xz streams; syft's own Go-based squashfs/xz decoder apparently only handles
+        # plain single-filter. Extract squashfs first
+        print("I: Unpack squashfs for SBOM generation")
+        syft_cmd = [['unsquashfs', '-quiet', '-no-progress', '-dest', syft_target_dir, '-file', 'binary/live/filesystem.squashfs']]
+        # run syft on extracted content
+        syft_cmd.append(['syft', syft_target_dir,
                      '--source-name', 'VyOS', '--source-version', version,
                      '-o', f'cyclonedx-json={base_filename}.cdx.json',
-                     '-o', f'spdx-json={base_filename}.spdx.json']]
+                     '-o', f'spdx-json={base_filename}.spdx.json'])
 
         # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328
         syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json'])
         syft_cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json'])
+        # remove temporary unpacked squashfs
+        syft_cmd.append(['rm', '-rf', syft_target_dir])
 
         for c in syft_cmd:
             with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,