Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create sbom-utility-scripts image #154

Merged
merged 1 commit into from
Aug 14, 2024
Merged

Conversation

mkosiarc
Copy link
Contributor

This image contains multiple python scripts that are used in the buildah tasks. This is done so that multiple steps in buildah tasks can be merged. The image contains scripts from the following stages:

merge-syft-sboms
merge-cachi2-sbom
create-purl-sbom
create-base-images-sbom

NOTE: the "merge_syft_sbom" from the "merge-cachi2-sbom" stage was taken from
https://github.com/containerbuildsystem/cachi2/blob/main/utils/merge_syft_sbom.py and renamed to "merge_cachi2_sboms.py". It will be removed from the cachi2 repo and image.

STONEBLD-2608

@mkosiarc mkosiarc force-pushed the sbom-merge branch 2 times, most recently from a6fd431 to 88d8a2c Compare August 13, 2024 10:44
@mkosiarc mkosiarc marked this pull request as draft August 13, 2024 11:19
@mkosiarc mkosiarc marked this pull request as ready for review August 13, 2024 11:37
@mkosiarc mkosiarc force-pushed the sbom-merge branch 2 times, most recently from efc4d0b to 1ab5f8f Compare August 13, 2024 11:44
This image contains multiple python scripts that are used in the buildah
tasks. This is done so that multiple steps in buildah tasks can be
merged. The image contains scripts from the following stages:

merge-syft-sboms
merge-cachi2-sbom
create-purl-sbom
create-base-images-sbom

NOTE: the "merge_syft_sbom" from the "merge-cachi2-sbom" stage was taken
from
https://github.com/containerbuildsystem/cachi2/blob/main/utils/merge_syft_sbom.py
and renamed to "merge_cachi2_sboms.py". It will be removed from the
cachi2 repo and image.

STONEBLD-2608

Signed-off-by: mkosiarc <[email protected]>
@mkosiarc
Copy link
Contributor Author

Associated PR konflux-ci/build-definitions#1291

mkosiarc added a commit to mkosiarc/cachi2 that referenced this pull request Aug 13, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
mkosiarc added a commit to mkosiarc/cachi2 that referenced this pull request Aug 13, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
mkosiarc added a commit to mkosiarc/cachi2 that referenced this pull request Aug 13, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
mkosiarc added a commit to mkosiarc/cachi2 that referenced this pull request Aug 13, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
Copy link
Contributor

@tkdchen tkdchen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM overall. A suggestion is to make the input and output files, these scripts operates on, as command line arguments. Then, the SBOM merge flow will be clearer for easier understanding by specifying data exchange files explicitly.

mkosiarc added a commit to mkosiarc/cachi2 that referenced this pull request Aug 14, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
@mkosiarc
Copy link
Contributor Author

LGTM overall. A suggestion is to make the input and output files, these scripts operates on, as command line arguments. Then, the SBOM merge flow will be clearer for easier understanding by specifying data exchange files explicitly.

Adam raised the same issue in konflux-ci/build-definitions#1291 (comment)
I agree with that, but I would like to do in next iteration.

@mkosiarc mkosiarc merged commit 4bc7a20 into konflux-ci:main Aug 14, 2024
1 check passed
github-merge-queue bot pushed a commit to containerbuildsystem/cachi2 that referenced this pull request Aug 15, 2024
Removing the script from this repo and migrating it to
build-tasks-dockerfiles, to a separate image for sbom utility scripts.

See konflux-ci/build-tasks-dockerfiles#154

Signed-off-by: mkosiarc <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants