Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Generate SBOM for Parsec #4770

Closed
FirelightFlagboy opened this issue Jun 27, 2023 · 0 comments · Fixed by #4771 or #4774
Closed

Generate SBOM for Parsec #4770

FirelightFlagboy opened this issue Jun 27, 2023 · 0 comments · Fixed by #4771 or #4774
Assignees
@FirelightFlagboy
Labels
A-Docs Area: Documentation I-Dependency Impact: related to an dependency

Comments

@FirelightFlagboy
Copy link
Contributor

FirelightFlagboy commented Jun 27, 2023 •
edited
Loading

Generate a SBOM1 for each generated artifact.

To generate the SBOM, I suggest the tool syft because it's the simplest tool I've tested.

The SBOM generate should likely be done on the CI in the workflows package-*.yml.

Doing it for each package allow to take into account the transitive dependencies and aditional tools used by those (syft would have more entries if it index the node_modules folders, for example).

Each SBOM should have a unique and meaningfull name (e.g.: For the server, it could be parsec-server.[...]) and uploaded as an artifact alongside the generate package.
This allow the workflow release.py to include them in a release 😄

Why not using the SBOM provided by Github ?

Currently the SBOM provided by Github only reflect the dependency graph for the main branch.
A release will have a different dependency graph, so this document isn't adapted for a release.

Footnotes

  1. Software Bills Of Materials ↩
@FirelightFlagboy FirelightFlagboy added A-Docs Area: Documentation I-Dependency Impact: related to an dependency labels Jun 27, 2023
@FirelightFlagboy FirelightFlagboy self-assigned this Jun 27, 2023
FirelightFlagboy added a commit that referenced this issue Jun 27, 2023
@FirelightFlagboy
Generate SBOM for generated Package
8560dda 
Closes #4770
@FirelightFlagboy FirelightFlagboy mentioned this issue Jun 27, 2023
Merged
FirelightFlagboy added a commit that referenced this issue Jun 27, 2023
@FirelightFlagboy
Generate SBOM for generated Package
3b1792d 
Generate SBOM file for python wheels, electron apps and web app.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 27, 2023
@FirelightFlagboy
Generate SBOM for generated Package
31b9b0e 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 28, 2023
@FirelightFlagboy
Generate SBOM for generated Package
44dd0f5 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 28, 2023
@FirelightFlagboy
Generate SBOM for generated Package
b257db5 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 29, 2023
@FirelightFlagboy
Generate SBOM for generated Package
37de2da 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 29, 2023
@FirelightFlagboy
Generate SBOM for generated Package
ca4f1fb 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
FirelightFlagboy added a commit that referenced this issue Jun 29, 2023
@FirelightFlagboy
Generate SBOM for generated Package
19ed5a8 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Change download path for artifacts

Rework artifact path to be flatten

Copy sbom files
FirelightFlagboy added a commit that referenced this issue Jun 29, 2023
@FirelightFlagboy
Generate SBOM for generated Package
7a038f1 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770
@FirelightFlagboy FirelightFlagboy linked a pull request Jul 3, 2023 that will close this issue
Generate SBOM for generated Package [2.16] #4774
Merged
FirelightFlagboy added a commit that referenced this issue Jul 6, 2023
@FirelightFlagboy @mmmarcos
Generate SBOM for generated Package
f2b9cf7 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Co-authored-by: Marcos Medrano <786907+mmmarcos@users.noreply.github.com>
FirelightFlagboy added a commit that referenced this issue Jul 6, 2023
@FirelightFlagboy @mmmarcos
Generate SBOM for generated Package
67b5422 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Co-authored-by: Marcos Medrano <786907+mmmarcos@users.noreply.github.com>
Signed-off-by: firelight flagboy <firelight.flagboy@gmail.com>
FirelightFlagboy added a commit that referenced this issue Jul 6, 2023
@FirelightFlagboy
Generate SBOM for generated Package
e38b597 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Signed-off-by: firelight flagboy <firelight.flagboy@gmail.com>
FirelightFlagboy added a commit that referenced this issue Jul 6, 2023
@FirelightFlagboy
Generate SBOM for generated Package (#4774)
02eed28 
Generate SBOM file for python wheels, python apps, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Signed-off-by: firelight flagboy <firelight.flagboy@gmail.com>
github-merge-queue bot pushed a commit that referenced this issue Jul 6, 2023
@FirelightFlagboy @mmmarcos
Generate SBOM for generated Package
56c5a1f 
Generate SBOM file for python wheels, electron apps and web app.

Other Changes
-------------

- Add `concurrency` to `package-webapp` workflow.

Closes #4770

Co-authored-by: Marcos Medrano <786907+mmmarcos@users.noreply.github.com>
Signed-off-by: firelight flagboy <firelight.flagboy@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@FirelightFlagboy FirelightFlagboy

Labels
A-Docs Area: Documentation I-Dependency Impact: related to an dependency
Projects
None yet
Milestone
No milestone
1 participant
@FirelightFlagboy