Skip to content

build: generate SBOMs for minirootfs - #2227

Open
officialasishkumar wants to merge 1 commit into
chainguard-dev:mainfrom
officialasishkumar:minirootfs-sbom
Open

officialasishkumar wants to merge 1 commit into
chainguard-dev:mainfrom
officialasishkumar:minirootfs-sbom

Conversation

@officialasishkumar

Copy link
Copy Markdown

Summary

  • wire build-minirootfs --sbom-path to the default SPDX SBOM generator
  • add a layer-level SBOM generation helper for minirootfs tarball output
  • add coverage that verifies a minirootfs build writes an SPDX SBOM

Fixes #2084.

Validation

  • go test ./internal/cli ./pkg/build ./pkg/sbom/generator/spdx -run 'TestBuildMinirootFSWritesSBOM|TestBuild$|TestBuildWithBase|TestGenerateImageSBOM' -count=1\n- go test ./internal/cli -count=1\n- go test ./pkg/build ./pkg/sbom/generator/spdx -count=1\n

@coreydaley-cg

Copy link
Copy Markdown
Contributor

This makes --sbom-path actually do something, and the test proves it. Needs a signed commit. One non-blocking note: GenerateLayerSBOM copies most of GenerateImageSBOM; a shared helper for the release data, package list, and generator loop would be a good follow-up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SBOM does not get built for minirootfs

2 participants