-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Generate SBOMs during build #814
Conversation
…into feat/generate-sboms-during-build
…into feat/generate-sboms-during-build
…into feat/generate-sboms-during-build
…into feat/generate-sboms-during-build
I'd like to review this next week. If it has time I'd be grateful for that but this is no block or veto. I'll let you decide. |
Yeah fine with me, sounds like a good idea. Moved to "Track" for now. |
I think the builds for product versions where I did not create a patch file that generates the SBOM would fail right now. We can discuss next week if we want to create patch files for those versions as well or make the "move SBOM" steps in the Dockerfiles optional ("only move it if the file exists"). |
…into feat/generate-sboms-during-build
…into feat/generate-sboms-during-build
@lfrancke I fixed the issues mentioned in your comments and added patches for all product versions we currently build. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks good to me but I did not test it myself
Needed for stackabletech/issues#614
This enables SBOM generation at build time.
Products where SBOM generation did not work yet:
We can look into fixing that at a later point in time. The main value of build time SBOM generation is currently that it helps detecting how a dependency is brought into an image. Since Kafka and the Go-based products are not heavily affected and the fixes for both did not seem to be trivial, I figured that we could skip them for now since SBOM generation for these products won't provide too much value anyway at the moment. We can improve this later, we'll have to adapt SBOM generation continuously for all upcoming product versions anyway.
Another PR related to this one will follow, since this one only places an SBOM as a file inside the image. The other one will enable using this SBOM file to extend our actual published SBOMs with the dependency information (those who are attached to images and shown e.g. in our SBOM browser).
I tested all builds for LTS versions successfully on my local machine and verified that the SBOMs are present.