Add initial support for generating SPDX SBOM documents (COMPOSER-2274)

.gitlab-ci.yml

@@ -399,19 +399,16 @@ koji.sh (cloud upload):
   parallel:
     matrix:
       - RUNNER:
-          - aws/rhel-8.10-ga-x86_64
           - aws/rhel-9.4-ga-x86_64
         INTERNAL_NETWORK: ["true"]
         CLOUD_TARGET: aws
         IMAGE_TYPE: aws-rhui
       - RUNNER:
-          - aws/rhel-8.10-ga-x86_64
           - aws/rhel-9.4-ga-x86_64
         INTERNAL_NETWORK: ["true"]
         CLOUD_TARGET: azure
         IMAGE_TYPE: azure-rhui
       - RUNNER:
-          - aws/rhel-8.10-ga-x86_64
           - aws/rhel-9.4-ga-x86_64
         INTERNAL_NETWORK: ["true"]
         CLOUD_TARGET: gcp
@@ -429,7 +426,6 @@ koji.sh (cloudapi):
     matrix:
       - *fedora_runners
       - RUNNER:
-          - aws/rhel-8.10-ga-x86_64
           - aws/rhel-9.4-ga-x86_64
         INTERNAL_NETWORK: ["true"]
 
@@ -707,7 +703,7 @@ aws_s3.sh:
   variables:
     SCRIPT: aws_s3.sh
 
-RHEL 9 on 8:
+RHEL 8 on 9 (Koji):
   stage: test
   extends: .terraform
   rules:
@@ -717,9 +713,23 @@ RHEL 9 on 8:
     - schutzbot/deploy.sh
     - /usr/libexec/tests/osbuild-composer/koji.sh
   variables:
-    RUNNER: aws/rhel-8.10-ga-x86_64
+    RUNNER: aws/rhel-9.4-ga-x86_64
+    INTERNAL_NETWORK: "true"
+    DISTRO_CODE: rhel-8.10
+
+RHEL 10 on 9 (Koji):
+  stage: test
+  extends: .terraform
+  rules:
+    - !reference [.upstream_and_ga_rules_all, rules]
+    - !reference [.ga_rules_all, rules]
+  script:
+    - schutzbot/deploy.sh
+    - /usr/libexec/tests/osbuild-composer/koji.sh
+  variables:
+    RUNNER: aws/rhel-9.4-ga-x86_64
     INTERNAL_NETWORK: "true"
-    DISTRO_CODE: rhel-91
+    DISTRO_CODE: rhel-10.0
 
 Multi-tenancy:
   stage: test

.golangci.yml

@@ -6,6 +6,8 @@ linters-settings:
 
   gomoddirectives:
     replace-local: false
+    replace-allow-list:
+      - "github.com/osbuild/images"
 
 linters:
   enable:

Schutzfile

@@ -2,7 +2,7 @@
   "fedora-39": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -45,7 +45,7 @@
   "fedora-40": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -88,56 +88,56 @@
   "rhel-8.4": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-8.8": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-8.9": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-8.10": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-9.2": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-9.3": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-9.4": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "rhel-9.5": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -183,7 +183,7 @@
   "rhel-10.0": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -193,34 +193,34 @@
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-BaseOS",
             "name": "baseos",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-baseos-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-baseos-n10.0-20240901"
           },
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-AppStream",
             "name": "appstream",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-appstream-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-appstream-n10.0-20240901"
           },
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-CRB",
             "name": "crb",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-crb-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-x86_64-crb-n10.0-20240901"
           }
         ],
         "aarch64": [
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-BaseOS",
             "name": "baseos",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-baseos-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-baseos-n10.0-20240901"
           },
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-AppStream",
             "name": "appstream",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-appstream-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-appstream-n10.0-20240901"
           },
           {
             "title": "RHEL-10-RPMREPO-NIGHTLY-CRB",
             "name": "crb",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-crb-n10.0-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/rhvpn/el10/el10-aarch64-crb-n10.0-20240901"
           }
         ]
       }
@@ -229,14 +229,14 @@
   "centos-9": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "centos-stream-9": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -282,14 +282,14 @@
   "centos-10": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     }
   },
   "centos-stream-10": {
     "dependencies": {
       "osbuild": {
-        "commit": "69625505cfdb569d46adf912128d22485ce3595b"
+        "commit": "3df75de65a5414866fa43133309c1fc67490a373"
       }
     },
     "repos": [
@@ -299,34 +299,34 @@
           {
             "title": "baseos",
             "name": "baseos",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-baseos-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-baseos-20240901"
           },
           {
             "title": "appstream",
             "name": "appstream",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-appstream-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-appstream-20240901"
           },
           {
             "title": "crb",
             "name": "crb",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-crb-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-x86_64-crb-20240901"
           }
         ],
         "aarch64": [
           {
             "title": "baseos",
             "name": "baseos",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-baseos-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-baseos-20240901"
           },
           {
             "title": "appstream",
             "name": "appstream",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-appstream-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-appstream-20240901"
           },
           {
             "title": "crb",
             "name": "crb",
-            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-crb-20240822"
+            "baseurl": "https://rpmrepo.osbuild.org/v2/mirror/public/el10/cs10-aarch64-crb-20240901"
           }
         ]
       }

cmd/gen-manifests/main.go

@@ -26,6 +26,7 @@ import (
 	"github.com/osbuild/images/pkg/ostree"
 	"github.com/osbuild/images/pkg/rhsm/facts"
 	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/sbom"
 
 	"github.com/osbuild/images/pkg/dnfjson"
 )
@@ -326,12 +327,12 @@ func depsolve(cacheDir string, packageSets map[string][]rpmmd.PackageSet, d dist
 	depsolvedSets := make(map[string][]rpmmd.PackageSpec)
 	repoConfigs := make(map[string][]rpmmd.RepoConfig)
 	for name, pkgSet := range packageSets {
-		res, repos, err := solver.Depsolve(pkgSet)
+		res, err := solver.Depsolve(pkgSet, sbom.StandardTypeNone)
 		if err != nil {
 			return nil, nil, err
 		}
-		depsolvedSets[name] = res
-		repoConfigs[name] = repos
+		depsolvedSets[name] = res.Packages
+		repoConfigs[name] = res.Repos
 	}
 	return depsolvedSets, repoConfigs, nil
 }

cmd/osbuild-dnf-json-tests/main_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/osbuild/images/pkg/ostree"
 	"github.com/osbuild/images/pkg/reporegistry"
 	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/sbom"
 )
 
 // This test loads all the repositories available in /repositories directory
@@ -67,7 +68,7 @@ func TestCrossArchDepsolve(t *testing.T) {
 					assert.NoError(t, err)
 
 					for _, set := range manifest.GetPackageSetChains() {
-						_, _, err = solver.Depsolve(set)
+						_, err = solver.Depsolve(set, sbom.StandardTypeNone)
 						assert.NoError(t, err)
 					}
 				})
@@ -109,12 +110,12 @@ func TestDepsolvePackageSets(t *testing.T) {
 	gotPackageSpecsSets := make(map[string][]rpmmd.PackageSpec, len(imagePkgSets))
 	gotRepoConfigs := make(map[string][]rpmmd.RepoConfig, len(imagePkgSets))
 	for name, pkgSet := range imagePkgSets {
-		res, repos, err := solver.Depsolve(pkgSet)
+		res, err := solver.Depsolve(pkgSet, sbom.StandardTypeNone)
 		if err != nil {
 			require.Nil(t, err)
 		}
-		gotPackageSpecsSets[name] = res
-		gotRepoConfigs[name] = repos
+		gotPackageSpecsSets[name] = res.Packages
+		gotRepoConfigs[name] = res.Repos
 	}
 	expectedPackageSpecsSetNames := []string{"build", "os"}
 	require.EqualValues(t, len(expectedPackageSpecsSetNames), len(gotPackageSpecsSets))

cmd/osbuild-store-dump/main.go

@@ -17,6 +17,7 @@ import (
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/reporegistry"
 	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/sbom"
 	"github.com/osbuild/osbuild-composer/internal/blueprint"
 	"github.com/osbuild/osbuild-composer/internal/store"
 	"github.com/osbuild/osbuild-composer/internal/target"
@@ -32,12 +33,12 @@ func getManifest(bp blueprint.Blueprint, t distro.ImageType, a distro.Arch, d di
 	repoConfigs := make(map[string][]rpmmd.RepoConfig)
 	solver := dnfjson.NewSolver(d.ModulePlatformID(), d.Releasever(), a.Name(), d.Name(), cacheDir)
 	for name, packages := range manifest.GetPackageSetChains() {
-		res, repos, err := solver.Depsolve(packages)
+		res, err := solver.Depsolve(packages, sbom.StandardTypeNone)
 		if err != nil {
 			panic(err)
 		}
-		pkgSpecSets[name] = res
-		repoConfigs[name] = repos
+		pkgSpecSets[name] = res.Packages
+		repoConfigs[name] = res.Repos
 	}
 
 	mf, err := manifest.Serialize(pkgSpecSets, nil, nil, repoConfigs)