fix(build): restore syft using curl instead of go install

Author: Kirari04

Dockerfile

@@ -26,6 +26,9 @@ FROM golang:latest AS builder
 
 WORKDIR /build
 
+# Install Syft for SBOM generation
+RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /go/bin
+
 # Copy source code
 COPY . .
 
@@ -35,6 +38,10 @@ RUN go mod tidy
 # Build the Go binary
 RUN CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -ldflags "-linkmode external -extldflags -static" -a -installsuffix cgo -o main_linux_amd64.bin main.go
 
+# Generate SBOM for the application
+# This scans the built binary and vendor dependencies
+RUN /go/bin/syft packages . -o spdx-json=sbom.spdx.json
+
 # Generate a checksum for the binary
 RUN sha256sum main_linux_amd64.bin > main_linux_amd64.bin.sha256sum
 
@@ -55,6 +62,9 @@ RUN apk add --no-cache ffmpeg bash
 # Copy the application binary from the builder stage
 COPY --from=builder /build/main_linux_amd64.bin ./main.bin
 
+# Copy the SBOM from the builder stage
+COPY --from=builder /build/sbom.spdx.json /app/sbom.spdx.json
+
 # Copy other necessary application files
 COPY ./views ./views/
 COPY ./public ./public/