Add purls to SPDX sbom #677
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
This commit modifies the top level purl in the SPDX sbom to use an oci purl, indicating it describes an image. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
Codecov Report
@@ Coverage Diff @@
## main #677 +/- ##
==========================================
- Coverage 51.62% 51.52% -0.10%
==========================================
Files 44 44
Lines 3268 3276 +8
==========================================
+ Hits 1687 1688 +1
- Misses 1371 1377 +6
- Partials 210 211 +1
Continue to review full report at Codecov.
|
|
This generally LGTM, but can you include an example of what these lines look like in the resulting SBOM? |
|
Sure thing, this snippet shows the package representing the image and the first dependency (taken from the CI artifacts): |
|
Very helpful thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR modifies the SPDX sbom output to include purls that add context for external tools to better infer the types of packages described in the document.
Note:
As each sbom is describing the dependencies of the image it is attached to, the purl type is set to
:oci.This introduces a divergence with the way the CycloneDX sbom expresses its components as the top component is a reference to golang source and not to the image. I think we should change this to express the sboms describe the images, not a go package.
/cc @imjasonh @mattmoor