Merge pull request #1190 from zregvart/issue/EC-931

SBOM loading optimization

policy/lib/sbom/sbom.rego

@@ -39,18 +39,15 @@ _cyclonedx_sboms_from_oci := [sbom |
 	sbom.bomFormat == "CycloneDX"
 ]
 
-default spdx_sboms := []
-
 spdx_sboms := sboms if {
 	sboms := array.concat(_spdx_sboms_from_attestations, _spdx_sboms_from_oci)
 	count(sboms) > 0
 } else := _spdx_sboms_from_image
 
+default _spdx_sboms_from_image := []
+
 _spdx_sboms_from_image := [sbom] if {
 	sbom := input.image.files[_sbom_spdx_image_path]
-} else := [sbom] if {
-	input.image.config.Labels.vendor == "Red Hat, Inc."
-	sbom := ec.oci.image_files(input.image.ref, [_sbom_spdx_image_path])[_sbom_spdx_image_path]
 }
 
 _spdx_sboms_from_attestations := [statement.predicate |

policy/lib/sbom/sbom_test.rego

@@ -118,9 +118,9 @@ test_cyclonedx_sboms_fallback_live_fetch if {
 		with ec.oci.image_files as mock_ec_oci_image_files(sbom._sbom_cyclonedx_image_path)
 }
 
-test_spdx_sboms_fallback_live_fetch if {
+test_spdx_sboms_fallback__no_live_fetch if {
 	image := json.remove(_spdx_image, ["files"])
-	expected := [{"sbom": "from live image"}]
+	expected := []
 	lib.assert_equal(sbom.spdx_sboms, expected) with input.attestations as []
 		with input.image as image
 		with ec.oci.blob as mock_ec_oci_spdx_blob