-
Notifications
You must be signed in to change notification settings - Fork 33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Stack BOM RFC #125
Stack BOM RFC #125
Conversation
1b1e67b
to
3734207
Compare
3734207
to
20fc563
Compare
Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>
Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>
Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me
Same. +1 looks good. |
This looks great! We should block on the upstream RFC getting merged though so that we can track any changes between now and then. |
- Implements paketo-buildpacks/rfcs#125 - Uses layer addition code from github.com/sclevine/cnb-sbom - Includes basic BOM generation and attachment logic
- Implements paketo-buildpacks/rfcs#125 - Uses layer addition code from github.com/sclevine/cnb-sbom - Includes basic BOM generation and attachment logic
- Although not consistent with github.com/paketo-buildpacks/rfcs/pull/125, it is consistent with comments in the upstream CNB, and can be easily removed.
- Although not consistent with github.com/paketo-buildpacks/rfcs/pull/125, it is consistent with comments in the upstream CNB, and can be easily removed.
* Add run image BOM - Implements paketo-buildpacks/rfcs#125 - Uses layer addition code from github.com/sclevine/cnb-sbom - Includes basic BOM generation and attachment logic * use specific alpine tag in bom generation test * Change bom file name to include original image digest - Although not consistent with github.com/paketo-buildpacks/rfcs/pull/125, it is consistent with comments in the upstream CNB, and can be easily removed. * generate Squashed Syft output * Attach SBOM using feature flag * Assert SBOM doesn't appear when not flagged * Adds experimental SBOM support in create-stack action Co-authored-by: Ryan Moran <rmoran@vmware.com> Co-authored-by: Sophie Wigmore <swigmore@vmware.com>
Closing out for now due to inactivity. Will re-open or create a new RFC when the direction upstream is definitive. |
Summary
Readable
Use Cases
Checklist