Merge release/0.13.5 into main (#833)

* Specify windows-2019 since windows-2022 is the default runner now (#816)

Signed-off-by: Natalie Arellano <narellano@vmware.com>

* Bump containerd to v1.5.10 (#822)

- Removes CVEs (CVE-2022-23648 & CVE-2021-43816) reported in containerd 1.5.8 & 1.5.9

Signed-off-by: matthewmcnew <mmcnew@pivotal.io>

* When restoring sbom files, silently ignore if the bp layers directory does not exist (#832)

This can happen when there are sbom files for launch but the cache is empty

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Co-authored-by: Matthew McNew <mmcnew@pivotal.io>

internal/layer/sbom_restorer.go

@@ -125,14 +125,20 @@ func (r *DefaultSBOMRestorer) restoreSBOMFunc(detectedBps []buildpack.GroupBuild
 			bpID      = matches[1]
 			layerName = matches[2]
 			fileName  = matches[3]
-			dest      = filepath.Join(r.layersDir, bpID, fmt.Sprintf("%s.%s", layerName, fileName))
+			destDir   = filepath.Join(r.layersDir, bpID)
 		)
 
+		// don't try to restore sbom files when the bp layers directory doesn't exist
+		// this can happen when there are sbom files for launch but the cache is empty
+		if _, err := os.Stat(destDir); os.IsNotExist(err) {
+			return nil
+		}
+
 		if !r.contains(detectedBps, bpID) {
 			return nil
 		}
 
-		return io2.Copy(path, dest)
+		return io2.Copy(path, filepath.Join(destDir, fmt.Sprintf("%s.%s", layerName, fileName)))
 	}
 }
 

internal/layer/sbom_restorer_test.go

@@ -234,5 +234,16 @@ func testSBOMRestorer(t *testing.T, when spec.G, it spec.S) {
 			h.AssertNil(t, sbomRestorer.RestoreToBuildpackLayers(detectedBps))
 			h.AssertPathDoesNotExist(t, filepath.Join(layersDir, "buildpack.id", "launch.sbom.cdx.json"))
 		})
+
+		when("the bp layers directory doesn't exist", func() {
+			it.Before(func() {
+				os.RemoveAll(filepath.Join(layersDir, "buildpack.id"))
+				os.RemoveAll(filepath.Join(layersDir, "escaped_buildpack_id"))
+			})
+
+			it("does not error", func() {
+				h.AssertNil(t, sbomRestorer.RestoreToBuildpackLayers(detectedBps))
+			})
+		})
 	})
 }