Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add sbom to releases and attach to containers #160

Merged
merged 5 commits into from
Sep 12, 2022
+56 −2
Merged

Add sbom to releases and attach to containers #160

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
714050b
Add sbom to releases and attach to containers
Sep 2, 2022
cce1d4b
Merge branch 'main' into sbom
Sep 5, 2022
844dbc5
Merge branch 'main' into sbom
Sep 7, 2022
0a4ee7c
Merge branch 'main' into sbom
Sep 7, 2022
d20b7ac
Merge branch 'main' into sbom
Sep 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/docker-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,11 +82,26 @@ jobs:
TAG=${{ steps.export_tag.outputs.operator_tag }}
COMMITDATE=${{ steps.export_tag.outputs.commit_date }}
COMMIT=${{ github.sha }}
- name: Install the bom command
shell: bash
run: go install sigs.k8s.io/bom/cmd/bom@v0.2.2
- name: Create SBOM file
shell: bash
run: |
bom generate -o elemental-operator.spdx .
- name: Attach SBOM file in the container image
shell: bash
run: |
set -e
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}"
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:latest"
- name: Sign images
env:
COSIGN_EXPERIMENTAL: 1
run: |
cosign sign ${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}
cosign sign ${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}.sbom
cosign sign ${{ env.OPERATOR_REPO }}:latest
cosign sign ${{ env.OPERATOR_REPO }}:latest.sbom
cosign sign ${{ env.REGISTER_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}
cosign sign ${{ env.REGISTER_REPO }}:latest
17 changes: 16 additions & 1 deletion .github/workflows/docker-tag.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,11 +80,26 @@ jobs:
TAG=${{ steps.export_tag.outputs.operator_tag }}
COMMITDATE=${{ steps.export_tag.outputs.commit_date }}
COMMIT=${{ github.sha }}
- name: Sign image
- name: Install the bom command
shell: bash
run: go install sigs.k8s.io/bom/cmd/bom@v0.2.2
- name: Create SBOM file
shell: bash
run: |
bom generate -o elemental-operator.spdx .
- name: Attach SBOM file in the container image
shell: bash
run: |
set -e
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}"
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:latest"
- name: Sign images and sbom
env:
COSIGN_EXPERIMENTAL: 1
run: |
cosign sign ${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}
cosign sign ${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}.sbom
cosign sign ${{ env.OPERATOR_REPO }}:latest
cosign sign ${{ env.OPERATOR_REPO }}:latest.sbom
cosign sign ${{ env.REGISTER_REPO }}:${{ steps.export_tag.outputs.operator_tag }}
cosign sign ${{ env.REGISTER_REPO }}:latest
26 changes: 25 additions & 1 deletion .github/workflows/gorelease.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
jobs:
goreleaser:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: write
steps:
- name: Checkout
uses: actions/checkout@v2
Expand All @@ -31,4 +34,25 @@ jobs:
version: latest
args: release --rm-dist
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install the bom command
shell: bash
run: go install sigs.k8s.io/bom/cmd/bom@v0.2.2
- name: Create SBOM file
shell: bash
run: |
mkdir signatures
bom generate -o /signatures/elemental-operator.spdx .
- name: Sign BOM file
env:
COSIGN_EXPERIMENTAL: 1
run: |
cosign sign-blob --output-certificate signatures/elemental-operator.spdx.cert \
--output-signature signatures/elemental-operator.spdx.sig \
signatures/elemental-operator.spdx
- name: Release sbom
uses: fnkr/github-action-ghr@v1
if: startsWith(github.ref, 'refs/tags/')
env:
GHR_PATH: signatures/
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}