Attach SBOMs to built images. #149
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mattmoor
commented
Mar 27, 2022
| if len(sbomFormats) > 0 { | ||
| var mt ggcrtypes.MediaType | ||
| var path string | ||
| switch sbomFormats[0] { |
There was a problem hiding this comment.
Currently cosign's method for associating SBOMs supports a single type of SBOM, so I simply pick the first when multiple are emitted. This can be controlled by restricting or reordering the sbom formats.
There was a problem hiding this comment.
Is there an issue we can reference here (and in ko-build/ko#661) so we can switch to publishing both/all when the API supports it?
| switch sbomFormats[0] { | ||
| case "spdx": | ||
| mt = ctypes.SPDXMediaType | ||
| path = filepath.Join(sbomPath, fmt.Sprintf("sbom-%s.spdx.json", arch.ToAPK())) |
There was a problem hiding this comment.
I wish the SBOM metadata were surfaced in a way we could plumb through to here, but the file list is effectively discarded today. We should consider ways to improve the way this is plumbed through.
mattmoor
force-pushed
the
attach-sboms
branch
2 times, most recently
from
87b15ba
to
2feee5f
Compare
This change attaches SBOMs to the `oci.SignedImage`s we build up, and these are published thanks to the previous commit in this series. I have added validation that for each of the examples we have that we scan download its SBOM with cosign. Fixes: chainguard-dev#145
mattmoor
changed the title
This was referenced Mar 28, 2022
vaikas
approved these changes
Mar 28, 2022
|
Looks fine to me, given that we can't just fix cosign immediately. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change attaches SBOMs to the
oci.SignedImages we build up, and these are published thanks to the previous commit in this series.I have added validation that for each of the examples we have that we scan download its SBOM with cosign.
Fixes: #145
Based on #147