-
Notifications
You must be signed in to change notification settings - Fork 69
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SBOM- Cosign spec #350
Comments
There is an ongoing issue related to that topic, but this issue is more likely related to the Docker BuildKit, but anyways it might help: |
I've made a small go program that takes the layers directory and image to attach SBOM according to Cosign spec. |
Also of interest is how |
@RealHarshThakur this is awesome to see! Summarizing for my own understanding (and to help others): the program takes an image reference and a directory, adding the individual json files within the directory (if they have the suffix Regarding the introduction of this logic to imgutil, my recommendation would be to keep the imgutil interface as logic-less as possible (something like @RealHarshThakur would you be up for opening an RFC about this? I would really love to see this move forward, so if there is any help that I could provide please let me know. |
Thanks Natalie.
I was thinking about this, we'll need to somehow map the sha hash of the layer to the sbom file/sbom sub-directory. Are SHA hashes stored somewhere in the layers directory/can they be computed on the fly by lifecycle? In general, my preference is not to delegate this to builder images but to have lifecycle do the heavy lifting unless there's no other way.
Yep, I'll draft it up |
Hey folks, it looks like there's an interoperability issue between Buildpacks and Cosign tooling. As an end user, I would like :
pack sbom download
andcosign download sbom
to work on any OCI artifact regardless of the build tool. Cosign has a spec for what this should look like: https://github.com/sigstore/cosign/blob/main/specs/SBOM_SPEC.mdHarbor is also looking to comply to cosign spec: goharbor/harbor#16397
Currently, Buildpacks doesn't seem to attach the SBOM in the OCI image manifest. If that was done, it should make both tools interoperable and also easy to use with other libraries in the ecosystem.
The text was updated successfully, but these errors were encountered: