[Merge PR#83 -> kernel-riscv64-v6.1.38-generic] Generate SBOM using buildkit's builtin mechanism

Dockerfile.gcc

@@ -160,10 +160,6 @@ RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdept
          tar cf - -T - | (cd $dir; tar xf -) && \
     ( cd /tmp && tar cf /out/kernel-dev.tar usr/src )
 
-# copy SBOM files
-RUN cp /kernel-src/kernel-sbom-docker.spdx.json /out/ && \
-    cp /kernel-src/kernel-sbom-gh.spdx.json /out/
-
 FROM scratch
 ENTRYPOINT []
 CMD []

Makefile.eve

@@ -7,6 +7,15 @@ KERNEL_TAG=v6.1.38
 PLATFORM=linux/$(ARCHITECTURE)
 BUILD_USER:=$(shell id -un)
 
+IMAGE_REPOSITORY?=lfedge/eve-kernel
+
+LINUXKIT_VERSION=58c36c9eb0c32acf66ae7877d18a9ad24d59d73e
+GOBIN=/tmp/linuxkit-$(LINUXKIT_VERSION)
+LK=$(GOBIN)/linuxkit
+
+BUILD_KIT_VERSION=v0.12.5
+BUILD_KIT_BUILDER=eve-kernel-builder-$(BUILD_KIT_VERSION)
+
 SOURCE_DATE_EPOCH=$(shell git log -1 --format=%ct)
 BRANCH=eve-kernel-$(ARCHITECTURE)-$(KERNEL_TAG)-$(EVE_FLAVOR)
 # make sure we get a date in correct format, otherwise initramfs cpio mtime will be variable
@@ -41,38 +50,31 @@ help: Makefile
 	@echo "  clean: remove generated files"
 	@echo
 
-pull-eve-build-tools:
-	docker pull lfedge/eve-build-tools:main
-.PHONY: pull-eve-build-tools
+.PHONY: ensure-builder
+ensure-builder:
+	docker buildx inspect $(BUILD_KIT_BUILDER) 2>/dev/null || \
+	docker buildx create --name $(BUILD_KIT_BUILDER) \
+	--driver docker-container --bootstrap --driver-opt=image=moby/buildkit:$(BUILD_KIT_VERSION)
 
-# do not build sbom target directly, it depends on DOCKERFILE variable set by kernel-gcc or kernel-clang
-SBOM_TARGETS=kernel-sbom-gh.spdx.json kernel-sbom-docker.spdx.json
-sbom: $(SBOM_TARGETS)
+.PHONY: linuxkit
+linuxkit: $(LK)
+$(LK):
+	GOBIN=$(GOBIN) go install github.com/linuxkit/linuxkit/src/cmd/linuxkit@$(LINUXKIT_VERSION)
 
-kernel-sbom-gh.spdx.json: pull-eve-build-tools
-	docker run  -v $(PWD):/in lfedge/eve-build-tools:main github-sbom-generator \
-			generate --format spdx-json /in/ | jq . > ./kernel-sbom-gh.spdx.json
+KERNEL_OCI_FILE:=$(shell mktemp -u)-kernel.tar
 
-#if DOCKERFILE is not set, this target will fail
-kernel-sbom-docker.spdx.json: pull-eve-build-tools $(DOCKERFILE)
-	@if [ -z "$(DOCKERFILE)" ]; then \
-		echo "DOCKERFILE not set. Do not build 'sbom' target directly"; \
-		exit 1; \
-	fi
-	@echo "Generating SBOM for $(DOCKERFILE)"
-	docker run -v $(PWD):/in lfedge/eve-build-tools:main dockerfile-add-scanner scan /in/$(DOCKERFILE) \
-		--format spdx-json | jq . > ./kernel-sbom-docker.spdx.json
-
-kernel-gcc: DOCKERFILE:=Dockerfile.gcc
-kernel-clang: DOCKERFILE:=Dockerfile.clang
-
-kernel-build-%: sbom Makefile.eve
+kernel-build-%: Makefile.eve linuxkit | ensure-builder
 	@echo "Building kernel version $(BRANCH):$(VERSION)-$* with compiler $*"
 	docker buildx build \
+	--builder=$(BUILD_KIT_BUILDER) \
 	--build-arg="SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH)" \
 	--build-arg="KBUILD_BUILD_TIMESTAMP=$(KBUILD_BUILD_TIMESTAMP)" \
 	--build-arg="LOCALVERSION=$(VERSION)$(DIRTY)" \
-	--platform $(PLATFORM) -t lfedge/eve-kernel:$(BRANCH)-$(VERSION)$(DIRTY)-$* --load -f Dockerfile.$* .
+	--platform $(PLATFORM) -t $(IMAGE_REPOSITORY):$(BRANCH)-$(VERSION)$(DIRTY)-$* \
+	--sbom=true --output=type=oci,dest=$(KERNEL_OCI_FILE) -f Dockerfile.$* .
+	$(LK) cache import $(KERNEL_OCI_FILE)
+	rm -f $(KERNEL_OCI_FILE)
+
 
 # we need these intermediate targets to make .PHONY work for pattern rules
 kernel-gcc: kernel-build-gcc
@@ -85,12 +87,12 @@ push-clang: push-image-clang
 .PHONY: kernel-gcc kernel-clang docker-tag-gcc docker-tag-clang push-gcc push-clang
 
 docker-tag-generate-%:
-	@echo "docker.io/lfedge/eve-kernel:$(BRANCH)-$(VERSION)$(DIRTY)-$*"
+	@echo "docker.io/$(IMAGE_REPOSITORY):$(BRANCH)-$(VERSION)$(DIRTY)-$*"
 
 push-image-%:
 	$(if $(DIRTY), $(error "Not pushing since the repo is dirty"))
-	docker push lfedge/eve-kernel:$(BRANCH)-$(VERSION)-$*
+	$(LK) cache push $(IMAGE_REPOSITORY):$(BRANCH)-$(VERSION)-$*
 
 .PHONY: clean
 clean:
-	rm -f $(SBOM_TARGETS)
+	echo "Cleaning"