Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Makes CycloneDX SBOM Reproducible #369

Merged
merged 4 commits into from
Aug 3, 2022
Merged

Makes CycloneDX SBOM Reproducible #369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
91dcd98
Makes CycloneDX SBOM Reproducible
ForestEckhardt Aug 2, 2022
c7aace6
Adds format verification check
ForestEckhardt Aug 3, 2022
d8528d4
Update sbom/formatted_reader.go
ForestEckhardt Aug 3, 2022
f090b84
Merge branch 'v2' into cyclonedx-reproducible
ForestEckhardt Aug 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions sbom/formatted_reader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package sbom

import (
"bytes"
"encoding/json"
"fmt"
"io"
"sync"
Expand Down Expand Up @@ -53,6 +54,30 @@ func (f *FormattedReader) Read(b []byte) (int, error) {
return 0, fmt.Errorf("failed to format sbom: %w", err)
}

// Makes CycloneDX SBOM more reproducible, see
// https://github.com/paketo-buildpacks/packit/issues/367 for more details.
if f.format.ID() == "cyclonedx-1.3-json" || f.format.ID() == "cyclonedx-1-json" {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is the generic ID term for cycloneDX 1.4

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry deleted my other question and posted a new one

fg-j marked this conversation as resolved.
Show resolved Hide resolved
var cycloneDXOutput map[string]interface{}
err = json.Unmarshal(output, &cycloneDXOutput)
if err != nil {
return 0, fmt.Errorf("failed to modify CycloneDX SBOM for reproducibility: %w", err)
}
for k := range cycloneDXOutput {
if k == "metadata" {
metadata := cycloneDXOutput[k].(map[string]interface{})
delete(metadata, "timestamp")
cycloneDXOutput[k] = metadata
}
if k == "serialNumber" {
delete(cycloneDXOutput, k)
}
}
output, err = json.Marshal(cycloneDXOutput)
if err != nil {
return 0, fmt.Errorf("failed to modify CycloneDX SBOM for reproducibility: %w", err)
}
}

f.reader = bytes.NewBuffer(output)
}

Expand Down
11 changes: 11 additions & 0 deletions sbom/formatted_reader_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,20 @@ func testFormattedReader(t *testing.T, context spec.G, it spec.S) {
_, err := io.Copy(buffer, sbom.NewFormattedReader(bom, sbom.CycloneDXFormat))
Expect(err).NotTo(HaveOccurred())

format := syft.IdentifyFormat(buffer.Bytes())
Expect(format.ID()).To(Equal(syft.CycloneDxJSONFormatID))

var cdxOutput cdxOutput

err = json.Unmarshal(buffer.Bytes(), &cdxOutput)
Expect(err).NotTo(HaveOccurred(), buffer.String())

Expect(cdxOutput.BOMFormat).To(Equal("CycloneDX"), buffer.String())
Expect(cdxOutput.SpecVersion).To(Equal("1.3"), buffer.String())
Expect(cdxOutput.SerialNumber).To(Equal(""), buffer.String())

Expect(cdxOutput.Metadata.Timestamp).To(Equal(""), buffer.String())
Expect(cdxOutput.Metadata.Component.Type).To(Equal("file"), buffer.String())
Expect(cdxOutput.Metadata.Component.Type).To(Equal("file"), buffer.String())
Expect(cdxOutput.Metadata.Component.Name).To(Equal("testdata/"), buffer.String())
Expect(cdxOutput.Components[0].Name).To(Equal("collapse-white-space"), buffer.String())
Expand All @@ -55,14 +61,19 @@ func testFormattedReader(t *testing.T, context spec.G, it spec.S) {
_, err := io.Copy(buffer, sbom.NewFormattedReader(bom, sbom.Format(syft.CycloneDxJSONFormatID)))
Expect(err).NotTo(HaveOccurred())

format := syft.IdentifyFormat(buffer.Bytes())
Expect(format.ID()).To(Equal(syft.CycloneDxJSONFormatID))

var cdxOutput cdxOutput

err = json.Unmarshal(buffer.Bytes(), &cdxOutput)
Expect(err).NotTo(HaveOccurred(), buffer.String())

Expect(cdxOutput.BOMFormat).To(Equal("CycloneDX"), buffer.String())
Expect(cdxOutput.SpecVersion).To(Equal("1.4"), buffer.String())
Expect(cdxOutput.SerialNumber).To(Equal(""), buffer.String())

Expect(cdxOutput.Metadata.Timestamp).To(Equal(""), buffer.String())
Expect(cdxOutput.Metadata.Component.Type).To(Equal("file"), buffer.String())
Expect(cdxOutput.Metadata.Component.Name).To(Equal("testdata/"), buffer.String())
Expect(cdxOutput.Components[0].Name).To(Equal("collapse-white-space"), buffer.String())
Expand Down
8 changes: 5 additions & 3 deletions sbom/sbom_outputs_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,11 @@ type component struct {
}

type cdxOutput struct {
BOMFormat string `json:"bomFormat"`
SpecVersion string `json:"specVersion"`
Metadata struct {
BOMFormat string `json:"bomFormat"`
SpecVersion string `json:"specVersion"`
SerialNumber string `json:"serialNumber"`
Metadata struct {
Timestamp string `json:"timestamp"`
Comment on lines +20 to +24
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think it would be clearer if the serial number and timestamp fields were omitted if empty so they don't show up at all?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know I would test for their absence if they were omitted

Copy link
Member

@sophiewigmore sophiewigmore Aug 3, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's alright - tested this out in a build and the fields are omitted from the final JSON anyway.

Component struct {
Type string `json:"type"`
Name string `json:"name"`
Expand Down