feat(redhat): also parse /usr/share/buildinfo for "content manifests"

[knqyf263]

The original discussion describes the request well.

Discussed in #8209

^{Originally posted by cgwalters January 7, 2025}

Description

See quay/claircore@7250a05 and openshift/os#670 (comment)

TL;DR basically for bootc systems we want /var to be as empty as possible - /usr should hold immutable read-only state like this.

This file is an ill-defined mess and general consensus seems to be that tooling should be scanning SBOMs instead, but basically for now please just make the same change Clair did and parse that location too.

Target

None

Scanner

None

[DmitriyLewen]

it's quite hard to find rhcos image.
But I ran rhcos-4.17.0-x86_64 in VM and I can confirm that this image uses usr/share/buildinfo/