Skip to content

Commit c516e12

Browse files
chmeliikchmeliik
authored
oci-copy: rework SBOM generation, support SPDX (#1816)
* oci-copy: rework SBOM generation Use scripts from https://github.com/konflux-ci/build-tasks-dockerfiles instead of the previous bash script. Signed-off-by: Adam Cmiel <[email protected]> * oci-copy: support SPDX Add SBOM_TYPE param to allow choosing the SBOM format to generate. Defaults to cyclonedx for now. Signed-off-by: Adam Cmiel <[email protected]> --------- Signed-off-by: Adam Cmiel <[email protected]>
1 parent a1a573f commit c516e12

File tree

4 files changed

+50
-56
lines changed

4 files changed

+50
-56
lines changed

‎task/oci-copy-oci-ta/0.1/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Given a file in the user's source directory, copy content from arbitrary urls in
99
|BEARER_TOKEN_SECRET_NAME|Name of a secret which will be made available to the build as an Authorization header. Note, the token will be sent to all servers found in the oci-copy.yaml file. If you do not wish to send the token to all servers, different taskruns and therefore different oci artifacts must be used.|does-not-exist|false|
1010
|IMAGE|Reference of the image we will push||true|
1111
|OCI_COPY_FILE|Path to the oci copy file.|./oci-copy.yaml|false|
12+
|SBOM_TYPE|Select the SBOM format to generate. Valid values: spdx, cyclonedx.|cyclonedx|false|
1213
|SOURCE_ARTIFACT|The Trusted Artifact URI pointing to the artifact with the application source code.||true|
1314

1415
## Results

‎task/oci-copy-oci-ta/0.1/oci-copy-oci-ta.yaml

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ spec:
3737
description: Path to the oci copy file.
3838
type: string
3939
default: ./oci-copy.yaml
40+
- name: SBOM_TYPE
41+
description: 'Select the SBOM format to generate. Valid values: spdx,
42+
cyclonedx.'
43+
type: string
44+
default: cyclonedx
4045
- name: SOURCE_ARTIFACT
4146
description: The Trusted Artifact URI pointing to the artifact with
4247
the application source code.
@@ -61,6 +66,8 @@ spec:
6166
value: $(params.IMAGE)
6267
- name: OCI_COPY_FILE
6368
value: $(params.OCI_COPY_FILE)
69+
- name: SBOM_TYPE
70+
value: $(params.SBOM_TYPE)
6471
volumeMounts:
6572
- mountPath: /var/workdir
6673
name: workdir
@@ -294,50 +301,39 @@ spec:
294301
add:
295302
- SETFCAP
296303
- name: sbom-generate
297-
image: quay.io/konflux-ci/yq:latest@sha256:93bb15cff64b708263055a5814b24a0b450d8724b86a7e5206396f25d81fcc21
304+
image: quay.io/konflux-ci/sbom-utility-scripts@sha256:1939901046f2ec0afda6d48f32dc82f991d9a4e2b4b4513635b9c79e3d4c2872
298305
workingDir: /var/workdir
299306
script: |
300307
#!/bin/bash
301-
cat >sbom-cyclonedx.json <<EOL
302-
{
303-
"\$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
304-
"bomFormat": "CycloneDX",
305-
"specVersion": "1.5",
306-
"version": 1,
307-
"components": []
308-
"metadata": {
309-
"component": {
310-
"type": "file",
311-
"name": "${IMAGE%:*}@$(cat "$(results.IMAGE_DIGEST.path)")"
312-
}
313-
}
314-
}
315-
EOL
308+
set -euo pipefail
316309
317-
for varfile in "/var/workdir"/vars/*; do
318-
echo "Reading $varfile"
319-
# shellcheck source=/dev/null
320-
source $varfile
310+
IMAGE_URL=$(cat "$(results.IMAGE_URL.path)")
311+
IMAGE_DIGEST=$(cat "$(results.IMAGE_DIGEST.path)")
312+
oci_copy_file_path="$(pwd)/source/$OCI_COPY_FILE"
321313
322-
ENCODED_URL=$(echo "${OCI_SOURCE}" | python3 -c 'import sys; import urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=":/"))')
323-
ENCODED_FILENAME=$(echo "${OCI_FILENAME}" | python3 -c 'import sys; import urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=":/"))')
324-
purl="pkg:generic/${ENCODED_FILENAME}?download_url=${ENCODED_URL}&checksum=sha256:${OCI_ARTIFACT_DIGEST}"
314+
python3 /scripts/sbom_for_oci_copy_task.py "$oci_copy_file_path" \
315+
--sbom-type "$SBOM_TYPE" \
316+
-o sbom.json
325317
326-
echo "Recording purl $purl"
327-
yq -oj -i '.components += [ {"purl": "'$purl'", "type": "file", "name": "'$OCI_FILENAME'", "hashes": [{"alg": "SHA-256", "content": "'$OCI_ARTIFACT_DIGEST'"}], "externalReferences": [{"type": "distribution", "url": "'$OCI_SOURCE'"}]} ]' sbom-cyclonedx.json
328-
done
318+
python3 /scripts/add_image_reference.py \
319+
--image-url "$IMAGE_URL" \
320+
--image-digest "$IMAGE_DIGEST" \
321+
--input-file sbom.json \
322+
--output-file /tmp/sbom.tmp.json
323+
324+
mv /tmp/sbom.tmp.json sbom.json
329325
- name: upload-sbom
330326
image: quay.io/konflux-ci/appstudio-utils:48c311af02858e2422d6229600e9959e496ddef1@sha256:91ddd999271f65d8ec8487b10f3dd378f81aa894e11b9af4d10639fd52bba7e8
331327
workingDir: /var/workdir
332328
script: |
333-
cosign attach sbom --sbom sbom-cyclonedx.json --type cyclonedx "$(cat "$(results.IMAGE_REF.path)")"
329+
cosign attach sbom --sbom sbom.json --type "$SBOM_TYPE" "$(cat "$(results.IMAGE_REF.path)")"
334330
- name: report-sbom-url
335331
image: quay.io/konflux-ci/yq:latest@sha256:93bb15cff64b708263055a5814b24a0b450d8724b86a7e5206396f25d81fcc21
336332
workingDir: /var/workdir
337333
script: |
338334
#!/bin/bash
339335
REPO=${IMAGE%:*}
340336
echo "Found that ${REPO} is the repository for ${IMAGE}"
341-
SBOM_DIGEST=$(sha256sum sbom-cyclonedx.json | awk '{ print $1 }')
337+
SBOM_DIGEST=$(sha256sum sbom.json | awk '{ print $1 }')
342338
echo "Found that ${SBOM_DIGEST} is the SBOM digest"
343339
echo -n "${REPO}@sha256:${SBOM_DIGEST}" | tee $(results.SBOM_BLOB_URL.path)

‎task/oci-copy/0.1/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Note: the bearer token secret, if specified, will be sent to **all servers liste
1515
|OCI_COPY_FILE|Path to the oci copy file.|./oci-copy.yaml|false|
1616
|BEARER_TOKEN_SECRET_NAME|Name of a secret which will be made available to the build as an Authorization header. Note, the token will be sent to all servers found in the oci-copy.yaml file. If you do not wish to send the token to all servers, different taskruns and therefore different oci artifacts must be used.|does-not-exist|false|
1717
|AWS_SECRET_NAME|Name of a secret which will be made available to the build to construct Authorization headers for requests to Amazon S3 using v2 auth https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html. If specified, this will take precedence over BEARER_TOKEN_SECRET_NAME. The secret must contain two keys: `aws_access_key_id` and `aws_secret_access_key`. In the future, this will be reimplemented to use v4 auth: https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html.|does-not-exist|false|
18+
|SBOM_TYPE|Select the SBOM format to generate. Valid values: spdx, cyclonedx.|cyclonedx|false|
1819

1920
## Results
2021
|name|description|

‎task/oci-copy/0.1/oci-copy.yaml

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ spec:
3434
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html.
3535
type: string
3636
default: "does-not-exist"
37+
- name: SBOM_TYPE
38+
description: "Select the SBOM format to generate. Valid values: spdx, cyclonedx."
39+
type: string
40+
default: cyclonedx
41+
3742
results:
3843
- description: Digest of the artifact just pushed
3944
name: IMAGE_DIGEST
@@ -49,6 +54,8 @@ spec:
4954
value: $(params.OCI_COPY_FILE)
5055
- name: IMAGE
5156
value: $(params.IMAGE)
57+
- name: SBOM_TYPE
58+
value: $(params.SBOM_TYPE)
5259
steps:
5360
- name: prepare
5461
image: quay.io/konflux-ci/yq:latest@sha256:93bb15cff64b708263055a5814b24a0b450d8724b86a7e5206396f25d81fcc21
@@ -274,50 +281,39 @@ spec:
274281
name: varlibcontainers
275282
workingDir: $(workspaces.source.path)
276283
- name: sbom-generate
277-
image: quay.io/konflux-ci/yq:latest@sha256:93bb15cff64b708263055a5814b24a0b450d8724b86a7e5206396f25d81fcc21
284+
image: quay.io/konflux-ci/sbom-utility-scripts@sha256:1939901046f2ec0afda6d48f32dc82f991d9a4e2b4b4513635b9c79e3d4c2872
278285
script: |
279286
#!/bin/bash
280-
cat >sbom-cyclonedx.json <<EOL
281-
{
282-
"\$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
283-
"bomFormat": "CycloneDX",
284-
"specVersion": "1.5",
285-
"version": 1,
286-
"components": []
287-
"metadata": {
288-
"component": {
289-
"type": "file",
290-
"name": "${IMAGE%:*}@$(cat "$(results.IMAGE_DIGEST.path)")"
291-
}
292-
}
293-
}
294-
EOL
287+
set -euo pipefail
295288
296-
for varfile in "$(workspaces.source.path)"/vars/*; do
297-
echo "Reading $varfile"
298-
# shellcheck source=/dev/null
299-
source $varfile
289+
IMAGE_URL=$(cat "$(results.IMAGE_URL.path)")
290+
IMAGE_DIGEST=$(cat "$(results.IMAGE_DIGEST.path)")
291+
oci_copy_file_path="$(pwd)/source/$OCI_COPY_FILE"
300292
301-
ENCODED_URL=$(echo "${OCI_SOURCE}" | python3 -c 'import sys; import urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=":/"))')
302-
ENCODED_FILENAME=$(echo "${OCI_FILENAME}" | python3 -c 'import sys; import urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=":/"))')
303-
purl="pkg:generic/${ENCODED_FILENAME}?download_url=${ENCODED_URL}&checksum=sha256:${OCI_ARTIFACT_DIGEST}"
293+
python3 /scripts/sbom_for_oci_copy_task.py "$oci_copy_file_path" \
294+
--sbom-type "$SBOM_TYPE" \
295+
-o sbom.json
304296
305-
echo "Recording purl $purl"
306-
yq -oj -i '.components += [ {"purl": "'$purl'", "type": "file", "name": "'$OCI_FILENAME'", "hashes": [{"alg": "SHA-256", "content": "'$OCI_ARTIFACT_DIGEST'"}], "externalReferences": [{"type": "distribution", "url": "'$OCI_SOURCE'"}]} ]' sbom-cyclonedx.json
307-
done
297+
python3 /scripts/add_image_reference.py \
298+
--image-url "$IMAGE_URL" \
299+
--image-digest "$IMAGE_DIGEST" \
300+
--input-file sbom.json \
301+
--output-file /tmp/sbom.tmp.json
302+
303+
mv /tmp/sbom.tmp.json sbom.json
308304
workingDir: $(workspaces.source.path)
309305
- name: upload-sbom
310306
image: quay.io/konflux-ci/appstudio-utils:48c311af02858e2422d6229600e9959e496ddef1@sha256:91ddd999271f65d8ec8487b10f3dd378f81aa894e11b9af4d10639fd52bba7e8
311307
workingDir: $(workspaces.source.path)
312308
script: |
313-
cosign attach sbom --sbom sbom-cyclonedx.json --type cyclonedx "$(cat "$(results.IMAGE_REF.path)")"
309+
cosign attach sbom --sbom sbom.json --type "$SBOM_TYPE" "$(cat "$(results.IMAGE_REF.path)")"
314310
- name: report-sbom-url
315311
image: quay.io/konflux-ci/yq:latest@sha256:93bb15cff64b708263055a5814b24a0b450d8724b86a7e5206396f25d81fcc21
316312
script: |
317313
#!/bin/bash
318314
REPO=${IMAGE%:*}
319315
echo "Found that ${REPO} is the repository for ${IMAGE}"
320-
SBOM_DIGEST=$(sha256sum sbom-cyclonedx.json | awk '{ print $1 }')
316+
SBOM_DIGEST=$(sha256sum sbom.json | awk '{ print $1 }')
321317
echo "Found that ${SBOM_DIGEST} is the SBOM digest"
322318
echo -n "${REPO}@sha256:${SBOM_DIGEST}" | tee $(results.SBOM_BLOB_URL.path)
323319
workingDir: $(workspaces.source.path)

0 commit comments

Comments
 (0)