Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Final fixes for initial 2-SBOM release #2156

Merged
merged 10 commits into from
Jul 8, 2021
Merged

Final fixes for initial 2-SBOM release #2156

merged 10 commits into from
Jul 8, 2021

Commits on Jul 8, 2021

  1. Define Apache-2.0 as license 

    This commit changes the stated license as Apache-2.0 in both SBOMs.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    eb533ba View commit details
    Browse the repository at this point in the history

  2. Add ExternalDocRef to SPDX package 

    This commit adds the capability to the spdx package to reference
external documents. This is achieved by a new type ExternalDocumentRef
which gets rendered in the document.

This commit also modifies the YAML configuration support to enable
the definition of external document references:

```yaml
external-docs:
  - id: kubernetes-source
    uri: http://gcr.io/k8s.spdx
    checksums: {sha256: 5167fec9c11112ee8ea3f2b21345df18d4a4aec5a5dcbeb03d0d2c8c438eada7}
```

A test for the correct rendering of the new type is included.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    935ad06 View commit details
    Browse the repository at this point in the history

  3. Artifacts listing funcs in workspace 

    This commit adds three functions to workspace.go to get the
artifacts produced for a given version:

ListBuildImages: Returns a list if the image archives
ListBuildTarballs: Returns the various tarballs before staging
ListBuildBinaries: Returns a struct of binaries, organized by arch and platform

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    2db9b07 View commit details
    Browse the repository at this point in the history

  4. Add binaries and tarballs to SBOM 

    This commit modifies GenerateVersionArtifactsBOM to add
binaries and workspace files independently to list the
bucket paths that will hold them after release.

Previously, the SBOM listed binaries in in their staging paths
and tarballs where missing.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    98cebde View commit details
    Browse the repository at this point in the history

  5. Staging fakes regeneration 

    Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    c206316 View commit details
    Browse the repository at this point in the history

  6. Regenrate layer SPDX ID to add imageref 

    When generating a conatiner image PSDX package, we now generate the SPDX IDs
for the layers incorporating the image ref. This avoids ID clashes when two
images containt the same layer (ie the same base image).

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    b817ce0 View commit details
    Browse the repository at this point in the history

  7. SBOM: Link source SBOM to artifacts SBOM 

    This commit links the artifacts sbom with the artifacts sbom
using a SPDX ExternalDocumentRef. To do this, we now add a new
function to the ExternalDocumentRef type to calculate the
sha1 checksum from a local file. A test is included for the
new function.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    afd7c07 View commit details
    Browse the repository at this point in the history

  8. Ensure SPDX relationship rednering 

    This commit improves the handling of the SPDX relationships rendering
by catching potential inconsistencies. A new test for the function is
included.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    1a21c45 View commit details
    Browse the repository at this point in the history

  9. SPDX: Support relationships with remote entities 

    This commit introduces a change to correctly handle relationships with remote
SPDX entities. Before this change, only local objects could be referenced in
the SBOM.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    208b1f8 View commit details
    Browse the repository at this point in the history

  10. Correct external link to kubernetes source SBOM 

    This PR corrects the external reference linking the kubernetes
source sbom and the release sbom now that the SPDX package supports
external references in relationships.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
    @puerco
    puerco committed Jul 8, 2021
    Configuration menu
    Copy the full SHA
    e6b4433 View commit details
    Browse the repository at this point in the history