-
Notifications
You must be signed in to change notification settings - Fork 110
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1474 from luhring/spdx-rewiring
feat(sbom)!: overhaul SBOM generation logic
- Loading branch information
Showing
24 changed files
with
1,280 additions
and
784 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -59,43 +59,6 @@ jobs: | |
| docker run --rm -v $(pwd)/sbom.json:/sbom.json --entrypoint "sh" cgr.dev/chainguard/wolfi-base -c "apk add spdx-tools-java && tools-java Verify /sbom.json" | ||
| done | ||
| - name: Verify SBOM External Refs (git-checkout) | ||
| if: matrix.example == 'git-checkout.yaml' | ||
| run: | | ||
| set -euxo pipefail | ||
| tar -Oxf packages/x86_64/git-checkout*.apk var/lib/db/sbom > git-checkout.sbom.json | ||
| # Verify APK ref | ||
| grep '"pkg:apk/unknown/[email protected]?arch=x86_64"' git-checkout.sbom.json | ||
| # Verify github tag ref | ||
| grep '"pkg:github/puerco/[email protected]"' sbom.json git-checkout.sbom.json | ||
| # Verify github sha ref | ||
| grep '"pkg:github/puerco/hello.git@a73c4feb284dc6ed1e5758740f717f99dcd4c9d7"' git-checkout.sbom.json | ||
| # Verify generic git ref | ||
| grep '"pkg:generic/[email protected]?vcs_url=git%2Bhttps%3A%2F%2Fgitlab.com%2Fxnox%2Fhello.git%40a73c4feb284dc6ed1e5758740f717f99dcd4c9d7"' git-checkout.sbom.json | ||
| # Verify ConfigFile ref | ||
| grep '"pkg:github/chainguard-dev/melange@${{github.sha}}#examples/git-checkout.yaml"' git-checkout.sbom.json | ||
| - name: Verify SBOM External Refs (gnu-hello) | ||
| if: matrix.example == 'gnu-hello.yaml' | ||
| run: | | ||
| set -euxo pipefail | ||
| tar -Oxf packages/x86_64/hello-2*.apk var/lib/db/sbom > hello.sbom.json | ||
| # Verify generic fetch ref | ||
| grep '"pkg:generic/[email protected]?checksum=sha256%3Acf04af86dc085268c5f4470fbae49b18afbc221b78096aab842d934a76bad0ab\\u0026download_url=https%3A%2F%2Fftp.gnu.org%2Fgnu%2Fhello%2Fhello-2.12.tar.gz"' hello.sbom.json | ||
| - name: Check packages can be installed with apk | ||
| run: | | ||
| set -euxo pipefail | ||
| for f in packages/x86_64/*.apk; do | ||
| docker run --rm -v $(pwd):/work cgr.dev/chainguard/wolfi-base apk add --allow-untrusted /work/$f | ||
| done | ||
| bootstrap: | ||
| name: bootstrap package | ||
| runs-on: ubuntu-latest | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.