Generate SPDX SBOM at release time #538
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds a script in scripts/sbom.sh that generates the SBOM for the release adding three kinds of elements to it: 1. The source code with full dependencies 2. The tarball distrubutions written in _dist 3. The container image The SBOM is written into the _dist directory. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
This commit modifies the build pipeline to generate an SPDX SBOM describing the release. It uses the new bom-installer action to install the Kubernetes SBOM Tool into the runner and calls the scripts/sbom.sh script which handles the generation. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Josh Dolitsky <[email protected]>
|
Exactly!! I wanted to talk to you about it before doing any of that stuff, thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the Kubernetes SBOM tool to the release workflow to generate a Software Bill of Materials.
There are two parts to achieve this, each split into a commit in the PR:
bom-installeraction to install bom into the runner.scripts/sbom.shthat reads the artifacts and generates the SBOM including a) the source code and dependencies b) the container image c) the built tarballs./cc: @jdolitsky
Fixes #537
TODO:
The current change only writes the SBOM. It should then be stored in its final location
Structure
This is a sample visualization of the generated SBOM: