-
Notifications
You must be signed in to change notification settings - Fork 123
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CycloneDX SBOM support #61
Merged
Merged
Changes from all commits
Commits
Show all changes
23 commits
Select commit
Hold shift + click to select a range
f06a950
build: add WantSBOM option for build contexts
kaniini e9bdb5e
pkg/build/sbom: add stub SBOM generator
kaniini b9e1b5d
pkg/build/image_builder: trigger SBOM generation if requested
kaniini 83d4bb4
deps: add github.com/dominodatalab/os-release and gitlab.alpinelinux.…
kaniini ce27930
pkg/build/sbom: implement CycloneDX SBOM building
kaniini 8f6e5df
pkg/build: write SBOMs to a configured path
kaniini 78c35ef
pkg/cli: add --sbom-path option for outputting CycloneDX SBOMs
kaniini 8879157
pkg/build/sbom: use new-style errors rather than errors pkg
kaniini 3e22106
pkg/build/sbom: close the installedDB to prevent leaks
kaniini 68b7dc2
pkg/build/image_builder: chase err style changes
kaniini c7a50fc
Split out cyclonedx types to own packages
puerco 37ae555
Add SBOM object and implementation
puerco a39a008
Add ReadReleaseData method
puerco 9e610bf
sbom: Add ReadPackageIndex method
puerco b4cb776
Add SBOM Generator interface
puerco 8427116
Spin options to own package
puerco 39a836f
Convert cyclonedx type into an sbom generator
puerco cc2c218
purl: PackageURL package
puerco 44573c4
Refactor SBOM to work with pluggable generators
puerco 2c55029
sbom: Generate function
puerco 1f92704
Generate sboms using new sbom object
puerco 62b37aa
Spin checkGenerators from the impl generate fn
puerco 99a9f08
Add integration and final unit tests
puerco File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| //go:build tools | ||
| // +build tools | ||
|
|
||
| // Copyright 2022 Chainguard, Inc. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| // This is used to import things required by build scripts, to force `go mod` to see them as dependencies | ||
|
|
||
| package internal | ||
|
|
||
| import ( | ||
| _ "github.com/maxbrunsfeld/counterfeiter/v6" | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| // Copyright 2022 Chainguard, Inc. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package build | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "log" | ||
|
|
||
| "chainguard.dev/apko/pkg/sbom" | ||
| ) | ||
|
|
||
| // GenerateSBOM runs the sbom generation | ||
| func (bc *Context) GenerateSBOM() error { | ||
| log.Printf("generating SBOM") | ||
|
|
||
| // TODO(puerco): Split GenerateSBOM into context implementation | ||
| s := sbom.NewWithWorkDir(bc.WorkDir) | ||
|
|
||
| // Generate the packages externally as we may | ||
| // move the package reader somewhere else | ||
| packages, err := s.ReadPackageIndex() | ||
| if err != nil { | ||
| return fmt.Errorf("getting installed packagesx from sbom: %w", err) | ||
| } | ||
| s.Options.OutputDir = bc.SBOMPath | ||
| s.Options.Packages = packages | ||
|
|
||
| if _, err := s.Generate(); err != nil { | ||
| return fmt.Errorf("generating SBOMs: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In case it is useful, @imjasonh rolled the
koCycloneDX stuff here if you want to compare or copy useful bits: https://github.com/google/ko/pull/587/files#diff-ad63c642b90be2eed057117c368556d45c8c89a4c7310c948b80166fed73667aR41There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Whether or not you roll your own, I think it was a good idea to have e2e validation of the SBOMs in CI: https://github.com/google/ko/blob/main/.github/workflows/sbom.yaml
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also: how do folks feel about generating both/all formats by default? That's something I'd like to do for ko, and apko being onboard would help motivate me. Seems weird to prefer one over the other(s)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would be alright with generating the JSON-LD version of SPDX, but not the Turtle version presently generated by
ko.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(I also think that shouldn't block this MR)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Absolutely, we should do both. I was holding on commenting on this one to talk on Monday (@kaniini happy to chat on the weekend too if you want). I think we need to align some things to work together, buts lets chat first!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It can wait until Monday, I have some reasons for being opinionated here on SBOMs that I can outline outside this MR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
After a discussion with @puerco, the plan is for him to take over this branch and add in the SPDX support and so on :)