Update osbuild/images to v0.88.0

Adjust all paces that call `Solver.Depsolve()`, to cope with the changes
that enabled SBOM support.

Fix loading of testing repositories in the CloudAPI unit tests.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>

vendor/github.com/osbuild/images/pkg/dnfjson/dnfjson.go

@@ -29,6 +29,7 @@ import (
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/pkg/rhsm"
 	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/sbom"
 )
 
 // BaseSolver defines the basic solver configuration without platform
@@ -155,6 +156,13 @@ type Solver struct {
 	subscriptions *rhsm.Subscriptions
 }
 
+// DepsolveResult contains the results of a depsolve operation.
+type DepsolveResult struct {
+	Packages []rpmmd.PackageSpec
+	Repos    []rpmmd.RepoConfig
+	SBOM     *sbom.Document
+}
+
 // Create a new Solver with the given configuration. Initialising a Solver also loads system subscription information.
 func NewSolver(modulePlatformID, releaseVer, arch, distro, cacheDir string) *Solver {
 	s := NewBaseSolver(cacheDir)
@@ -193,10 +201,10 @@ func (s *Solver) SetProxy(proxy string) error {
 // their associated repositories.  Each package set is depsolved as a separate
 // transactions in a chain.  It returns a list of all packages (with solved
 // dependencies) that will be installed into the system.
-func (s *Solver) Depsolve(pkgSets []rpmmd.PackageSet) ([]rpmmd.PackageSpec, []rpmmd.RepoConfig, error) {
-	req, rhsmMap, err := s.makeDepsolveRequest(pkgSets)
+func (s *Solver) Depsolve(pkgSets []rpmmd.PackageSet, sbomType sbom.StandardType) (*DepsolveResult, error) {
+	req, rhsmMap, err := s.makeDepsolveRequest(pkgSets, sbomType)
 	if err != nil {
-		return nil, nil, fmt.Errorf("makeDepsolveRequest failed: %w", err)
+		return nil, fmt.Errorf("makeDepsolveRequest failed: %w", err)
 	}
 
 	// get non-exclusive read lock
@@ -205,7 +213,7 @@ func (s *Solver) Depsolve(pkgSets []rpmmd.PackageSet) ([]rpmmd.PackageSpec, []rp
 
 	output, err := run(s.dnfJsonCmd, req)
 	if err != nil {
-		return nil, nil, fmt.Errorf("running osbuild-depsolve-dnf failed:\n%w", err)
+		return nil, fmt.Errorf("running osbuild-depsolve-dnf failed:\n%w", err)
 	}
 	// touch repos to now
 	now := time.Now().Local()
@@ -219,11 +227,24 @@ func (s *Solver) Depsolve(pkgSets []rpmmd.PackageSet) ([]rpmmd.PackageSpec, []rp
 	dec := json.NewDecoder(bytes.NewReader(output))
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&result); err != nil {
-		return nil, nil, fmt.Errorf("decoding depsolve result failed: %w", err)
+		return nil, fmt.Errorf("decoding depsolve result failed: %w", err)
 	}
 
 	packages, repos := result.toRPMMD(rhsmMap)
-	return packages, repos, nil
+
+	var sbomDoc *sbom.Document
+	if sbomType != sbom.StandardTypeNone {
+		sbomDoc, err = sbom.NewDocument(sbomType, result.SBOM)
+		if err != nil {
+			return nil, fmt.Errorf("creating SBOM document failed: %w", err)
+		}
+	}
+
+	return &DepsolveResult{
+		Packages: packages,
+		Repos:    repos,
+		SBOM:     sbomDoc,
+	}, nil
 }
 
 // FetchMetadata returns the list of all the available packages in repos and
@@ -411,7 +432,7 @@ func (r *repoConfig) Hash() string {
 // NOTE: Due to implementation limitations of DNF and dnf-json, each package set
 // in the chain must use all of the repositories used by its predecessor.
 // An error is returned if this requirement is not met.
-func (s *Solver) makeDepsolveRequest(pkgSets []rpmmd.PackageSet) (*Request, map[string]bool, error) {
+func (s *Solver) makeDepsolveRequest(pkgSets []rpmmd.PackageSet, sbomType sbom.StandardType) (*Request, map[string]bool, error) {
 	// dedupe repository configurations but maintain order
 	// the order in which repositories are added to the request affects the
 	// order of the dependencies in the result
@@ -478,6 +499,10 @@ func (s *Solver) makeDepsolveRequest(pkgSets []rpmmd.PackageSet) (*Request, map[
 		Arguments:        args,
 	}
 
+	if sbomType != sbom.StandardTypeNone {
+		req.Arguments.Sbom = &sbomRequest{Type: sbomType.String()}
+	}
+
 	return &req, rhsmMap, nil
 }
 
@@ -642,6 +667,10 @@ func (r *Request) Hash() string {
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
 
+type sbomRequest struct {
+	Type string `json:"type"`
+}
+
 // arguments for a dnf-json request
 type arguments struct {
 	// Repositories to use for depsolving
@@ -659,6 +688,9 @@ type arguments struct {
 
 	// Optional metadata to download for the repositories
 	OptionalMetadata []string `json:"optional-metadata,omitempty"`
+
+	// Optionally request an SBOM from depsolving
+	Sbom *sbomRequest `json:"sbom,omitempty"`
 }
 
 type searchArgs struct {
@@ -692,7 +724,10 @@ type depsolveResult struct {
 	Repos    map[string]repoConfig `json:"repos"`
 
 	// (optional) contains the solver used, e.g. "dnf5"
-	Solver string `json:"solver"`
+	Solver string `json:"solver,omitempty"`
+
+	// (optional) contains the SBOM for the depsolved transaction
+	SBOM json.RawMessage `json:"sbom,omitempty"`
 }
 
 // Package specification