Description

Add support for reading SPDX 2.3 attestations in DSSE envelope format (in-toto attestation).

Motivation

Currently, Trivy supports CycloneDX attestations but lacks support for SPDX attestations. This feature would enable Trivy to scan SPDX-based SBOMs wrapped in in-toto attestation format.

Proposed Implementation

• Add FormatAttestSPDXJSON format constant
• Implement detection logic for DSSE-wrapped SPDX attestations
• Support https://spdx.dev/Document predicate type
• Reuse existing SPDX unmarshaling logic

Scope

• Reading SPDX attestations (generation is out of scope)
• SPDX 2.3 version support
• DSSE envelope format following in-toto spec

References

• https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md
• https://github.com/secure-systems-lab/dsse