chore: replace Syft with Trivy for SBOM generation in build and release workflows

.gitea/workflows/kiwi-build.yaml

@@ -7,14 +7,12 @@ on:
       - 'README.md'
       - 'docs/**'
       - '.gitignore'
-      - '.gitea/workflows/kiwi-release.yaml'
   pull_request:
     branches: [ "main", "master" ]
     paths-ignore:
       - 'README.md'
       - 'docs/**'
       - '.gitignore'
-      - '.gitea/workflows/kiwi-release.yaml'
 
 jobs:
   kiwi-job:
@@ -36,7 +34,11 @@ jobs:
           zypper if python3-kiwi
           echo "========================"
 
-          zypper --non-interactive in nodejs libxml2-tools git
+          zypper --non-interactive in nodejs libxml2-tools git curl
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
       - name: Checkout Repository
         uses: actions/checkout@v7
@@ -64,6 +66,11 @@ jobs:
             --bundle-dir ./dist \
             --id gitea-build-${{ steps.vars.outputs.sha_short }}
 
+      - name: Generate SBOM
+        run: |
+          trivy fs --format spdx-json --output ./dist/openSUSE-Leap-16.0-Minimal-gitea-build-${{ steps.vars.outputs.sha_short }}.spdx.json /tmp/build/build/image-root
+          trivy fs --format cyclonedx --output ./dist/openSUSE-Leap-16.0-Minimal-gitea-build-${{ steps.vars.outputs.sha_short }}.cdx.json /tmp/build/build/image-root
+
       - name: Upload Disk Image
         uses: actions/upload-artifact@v7
         with:
@@ -79,4 +86,6 @@ jobs:
             ./dist/*.packages
             ./dist/*.changes
             ./dist/*.verified
+            ./dist/*.spdx.json
+            ./dist/*.cdx.json
           retention-days: 7

.gitea/workflows/kiwi-release.yaml

@@ -17,6 +17,10 @@ jobs:
         run: |
           zypper --non-interactive in nodejs libxml2-tools git curl jq
 
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
       - name: Checkout Repository
         uses: actions/checkout@v7
 
@@ -29,6 +33,11 @@ jobs:
           kiwi-ng --profile Cloud system build --description ./opensuse-leap-16-minimal --target-dir /tmp/build
           kiwi-ng result bundle --target-dir /tmp/build --bundle-dir ./dist --id ${{ github.ref_name }}
 
+      - name: Generate SBOM
+        run: |
+          trivy fs --format spdx-json --output ./dist/openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}.spdx.json /tmp/build/build/image-root
+          trivy fs --format cyclonedx --output ./dist/openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}.cdx.json /tmp/build/build/image-root
+
       # 1. Gitea Release erstellen und Image-Datei als Asset anhängen
       - name: Create Gitea Release
         uses: akkuman/gitea-release-action@v1
@@ -41,11 +50,13 @@ jobs:
           files: |-
             ./dist/*.qcow2
             ./dist/*.raw.xz
+            ./dist/*.spdx.json
+            ./dist/*.cdx.json
 
       # 2. Harvester triggern (zieht sich die Datei aus dem Release)
       - name: Trigger Harvester Download
         env:
-          HARVESTER_URL: "https://dein-harvester-cluster.domain.de"
+          HARVESTER_URL: ${{ secrets.HARVESTER_URL }}
           HARVESTER_TOKEN: ${{ secrets.HARVESTER_TOKEN }}
           NAMESPACE: "default"
         run: |
@@ -66,8 +77,8 @@ jobs:
                 "namespace": "'"${NAMESPACE}"'"
               },
               "spec": {
-                "displayName": "openSUSE Leap 16.0 Minimal ('"${github.ref_name}"')",
-                "description": "Gebaute KIWI-NG Vorlage aus Tag '"${github.ref_name}"'",
+                "displayName": "openSUSE-Leap-16.0-Minimal-${{ github.ref_name }}",
+                "description": "Gebaute KIWI-NG Vorlage aus Tag ${{ github.ref_name }}",
                 "sourceType": "download",
                 "url": "'"${DOWNLOAD_URL}"'"
               }

opensuse-leap-16-minimal/config.sh

@@ -64,19 +64,10 @@ baseSetRunlevel 3
 #--------------------------------------
 suseImportBuildKey
 
-# 1. Alle Locale-Variablen (inkl. LC_MESSAGES) vollständig setzen
-cat <<'EOF' > /etc/locale.conf
-LANG=en_US.UTF-8
-LC_MESSAGES=en_US.UTF-8
-LC_ALL=en_US.UTF-8
-EOF
-
-# 2. Keymap und Hostname vordefinieren
-echo "KEYMAP=us" > /etc/vconsole.conf
+# 1. Hostname vordefinieren
 echo "rke2-node" > /etc/hostname
-ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime
 
-# 3. Der entscheidende Trick für systemd: "Preset" als initialisiert markieren
+# 2. Der entscheidende Trick für systemd: "Preset" als initialisiert markieren
 # Eine leere /etc/machine-id ODER /etc/machine-info signalisiert systemd,
 # dass Firstboot bereits gelaufen ist.
 echo "uninitialized" > /etc/machine-id