sbom: include external refs for fetched sourcecode in SPDX

[xnox]

External References to sources

This aids with many aspects of compliance, and ability to self-locate all relevant source code.

This will be present in every package sbom, and by extension every image sbom accessible from console and container registry.

This is extensible to accommodate any other future inputs.

Current state:

Currently we generate external self-reference to the binary APK package

      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:apk/wolfi/acl@2.3.2-r2?arch=x86_64",
          "referenceType": "purl"
        }
      ]

This proposal extends this array with additional references to the source code.

For fetch:

Add Package-URL to the download URI with checksum argument.

2024/05/17 16:18:51 INFO adding external refs [pkg:generic/acl@2.3.2?checksum=sha256%3A5f2bdbad629707aa7d85c623f994aa8a1d2dec55a73de5205bac0bf6058a2f7c&download_url=https%3A%2F%2Fdownload.savannah.nongnu.org%2Freleases%2Facl%2Facl-2.3.2.tar.gz] for pipeline "fetch"

Resulting SBOM then has for the package this information:

        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:generic/acl@2.3.2?checksum=sha256%3A5f2bdbad629707aa7d85c623f994aa8a1d2dec55a73de5205bac0bf6058a2f7c&download_url=https%3A%2F%2Fdownload.savannah.nongnu.org%2Freleases%2Facl%2Facl-2.3.2.tar.gz",
          "referenceType": "purl"
        }

For github based git-checkouts

Add Package-URL to the github location with tag & commit-id versions.

2024/05/17 23:14:36 INFO adding external refs [pkg:github/sigstore/cosign@v2.2.4 pkg:github/sigstore/cosign@fb651b4ddd8176bd81756fca2d988dd8611f514d] for pipeline "git-checkout"

        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:github/sigstore/cosign@v2.2.4",
          "referenceType": "purl"
        },
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:github/sigstore/cosign@fb651b4ddd8176bd81756fca2d988dd8611f514d",
          "referenceType": "purl"
        }

For non-github based git-checkouts

Add Package-URL to vcs location with tag as version and commit encoded as @commit (approximately similar to how many tools pin to a commit, i.e. pip)

2024/05/20 14:34:53 INFO adding external refs [pkg:generic/hello@v0.0.1?vcs_url=git%2Bhttps%3A%2F%2Fgitlab.com%2Fxnox%2Fhello.git%40a73c4feb284dc6ed1e5758740f717f99dcd4c9d7] for pipeline "git-checkout"

        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:generic/hello@v0.0.1?vcs_url=git%2Bhttps%3A%2F%2Fgitlab.com%2Fxnox%2Fhello.git%40a73c4feb284dc6ed1e5758740f717f99dcd4c9d7",
          "referenceType": "purl"
        },

For melange config itself

Add Package-URL to github location with commit as version and subpath set to the melange configfile.

2024/05/20 14:34:53 INFO adding external ref pkg:github/chainguard-dev/melange@7b29d0fe879878add7a26d515e679bab25047bfd#examples/git-checkout.yaml for ConfigFile**

        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:github/chainguard-dev/melange@7b29d0fe879878add7a26d515e679bab25047bfd#examples/git-checkout.yaml",
          "referenceType": "purl"
        }

[imjasonh]

This looks GREAT. A couple minor style nits I noticed before I realized this was a Draft. With some tests, I'd merge this soooo fast.

[xnox]

Question: what i am not sure about is if these references should be added on the binary package, or if they should be added on each binary package, or on a separate source package.

I am not sure there is any value in splitting our "package" stanza into two, and adding relationships on how binary ones are generated from the source ones. Especially since these do not ship the source code itself, but are merely references. If and when we generate something that is downloadable and contains all the cached code, it might be worth documenting that as standalone spdx package with intent source.

[xnox]

We need to assess how scanners will react to such a change.

[xnox]

wolfictl scan passes with these changes to SPDX.

[xnox]

2024/05/22 12:44:59 INFO adding external ref for ConfigFile
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xf3f60d]

har har har

[xnox]

I have locally rebuilt a collection of packages to make glibc-dynamic and cert-exporter images with updated spdx. All existing tools and parsing mechanisms still work. And grype / syft all work correctly too without any averse effects.