test: fix test failures (#48)

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

Makefile

@@ -15,6 +15,9 @@ ORAS := $(TOOLSDIR)/bin/oras
 ORAS_VERSION := 1.0.0-rc.1
 REGCTL := $(TOOLSDIR)/bin/regctl
 REGCTL_VERSION := 0.5.0
+# BOM tools
+K8S_BOM := $(TOOLSDIR)/bin/bom
+K8S_BOM_VERSION := 0.5.1
 BATS := $(TOOLSDIR)/bin/bats
 
 BINARY := stacker-bom
@@ -59,14 +62,19 @@ $(REGCTL):
 	curl -Lo $(REGCTL) https://github.com/regclient/regclient/releases/download/v$(REGCTL_VERSION)/regctl-linux-amd64
 	chmod +x $(REGCTL)
 
+$(K8S_BOM):
+	mkdir -p $(TOOLSDIR)/bin
+	curl -Lo $(K8S_BOM) https://github.com/kubernetes-sigs/bom/releases/download/v$(K8S_BOM_VERSION)/bom-amd64-linux
+	chmod +x $(K8S_BOM)
+
 $(BATS):
 	rm -rf bats-core; \
 		git clone https://github.com/bats-core/bats-core.git; \
 		cd bats-core; ./install.sh $(TOOLSDIR); cd ..; \
 		rm -rf bats-core
 
 .PHONY: test
-test: $(BATS) $(ZOT) $(ORAS) $(REGCTL)
+test: $(BATS) $(ZOT) $(ORAS) $(REGCTL) $(K8S_BOM)
 	go test -v -race -cover -coverpkg=./...
 	$(BATS) --trace --verbose-run --print-output-on-failure --show-output-of-passing-tests test/*.bats
 

test/bom.bats

@@ -12,7 +12,7 @@ function teardown() {
 
 @test "bom workflow" {
   # inventory
-  docker run -v ${TOPDIR}/bin:/opt/bin -v ${BOMD}:/stacker-artifacts -i ubuntu:latest /opt/bin/stacker-bom-linux-amd64 inventory -x /proc,/sys,/dev,/tmp,/opt,/var/lib/dpkg/info,/var/log,/var/cache,/var/lib/systemd,/var/lib/dpkg,/var/lib/apt,/var/lib/pam,/var/lib/shells.state,/stacker-artifacts -o /stacker-artifacts/inventory.json
+  docker run -v ${TOPDIR}/bin:/opt/bin -v ${BOMD}:/stacker-artifacts -i ubuntu:latest /opt/bin/stacker-bom-linux-amd64 inventory -x /proc,/sys,/dev,/tmp,/opt,/var/lib/dpkg/info,/var/log,/var/cache,/var/lib/systemd,/var/lib/dpkg,/var/lib/apt,/var/lib/pam,/var/lib/shells.state,/.dockerenv,/usr/share/info,/usr/sbin/policy-rc.d,/etc,/run,/root,/usr/bin/man,/usr/local/sbin/unminimize,/usr/sbin/initctl,/stacker-artifacts -o /stacker-artifacts/inventory.json
   [ -f ${BOMD}/inventory.json ]
   # discover installed packages
   docker run -v ${TOPDIR}/bin:/opt/bin -v ${BOMD}:/stacker-artifacts -i ubuntu:latest /opt/bin/stacker-bom-linux-amd64 discover -o /stacker-artifacts/discover.json
@@ -22,6 +22,8 @@ function teardown() {
   [ ! -f ${BOMD}/missing.json ]
   # push the image
   skopeo copy --format=oci --dest-tls-verify=false docker://ubuntu:latest docker://${ZOT_HOST}:${ZOT_PORT}/ubuntu:latest
+  # validate the sbom
+  bom document outline ${BOMD}/discover.json
   # attach bom artifacts as references
   regctl artifact put --artifact-type application/vnd.stacker-bom.inventory -f ${BOMD}/inventory.json --subject ${ZOT_HOST}:${ZOT_PORT}/ubuntu:latest
   regctl artifact put --artifact-type application/org.spdx+json -f ${BOMD}/discover.json --subject ${ZOT_HOST}:${ZOT_PORT}/ubuntu:latest