Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: generate sboms for provided packeges in a release #247

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
+46 −0
Open

ci: generate sboms for provided packeges in a release #247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
26dce0b
ci: generate sboms for provided packeges in a release
y-eight Jan 3, 2025
7a7257e
ci: goreleaser cfg version set to v2
y-eight Jan 3, 2025
4b03d83
ci: install syft bin & add source sbom gen
y-eight Jan 3, 2025
ee24a55
ci: finally add syft install to all ci actions where it is needed
y-eight Jan 3, 2025
339b31e
ci: typo
y-eight Jan 3, 2025
3a8550d
docs: use syft to generate a sbom manually
y-eight Jan 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ jobs:
uses: actions/setup-go@v5
with:
go-version-file: go.mod

- name: Install syft for sbom generation
uses: anchore/sbom-action/[email protected]

- name: Build snapshot artifacts
uses: goreleaser/goreleaser-action@v6
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/e2e_checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ jobs:
"network_plugin": "kathara/katharanp_vde"
}' > ~/.config/kathara.conf

- name: Install syft for sbom generation
uses: anchore/sbom-action/[email protected]

- name: Build binary for e2e
uses: goreleaser/goreleaser-action@v6
with:
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ jobs:
registry: mtr.devops.telekom.de
username: ${{ secrets.MTR_USERNAME }}
password: ${{ secrets.MTR_PASSWORD }}

- name: Install syft for sbom generation
uses: anchore/sbom-action/[email protected]

- name: Build, push & release
uses: goreleaser/goreleaser-action@v6
Expand Down
3 changes: 3 additions & 0 deletions .goreleaser-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
version: 2
project_name: sparrow
snapshot:
name_template: "commit-{{ .ShortCommit }}"
Expand Down Expand Up @@ -25,3 +26,5 @@ dockers:
- --label=org.opencontainers.image.created={{ .Timestamp }}
- --label=org.opencontainers.image.revision={{ .FullCommit }}
- --label=org.opencontainers.image.licenses="Apache 2.0"
sboms:
- artifacts: archive
6 changes: 6 additions & 0 deletions .goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
version: 2
project_name: sparrow
builds:
- env: [CGO_ENABLED=0]
Expand Down Expand Up @@ -39,3 +40,8 @@ nfpms:
- deb
- rpm
- apk
sboms:
- id: archive
artifacts: archive
- id: source
artifacts: source
23 changes: 23 additions & 0 deletions scripts/sbom/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Generate SBOM with Syft

This doc can be used to generate a SBOM manually with [Syft](https://github.com/anchore/syft).

## Usage

Install the Syft binary.

Use the following command to generate a simple SBOM file form the repository:

```SH
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that SH is a supported github markdown info string. Just use shell or bash or just sh?

syft .
```

Alternative output variants can be found [here](https://github.com/anchore/syft/wiki/Output-Formats).

Use the following command to generate a SBOM markdown file using the `example.sbom.tmpl` goTemplate template file:

```SH
SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t syft.sbom.tmpl
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the template file path is wrong :)

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl

```

Setting the env variable `SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true` will ensure to lookup licenses remotely. In this example the sparrow image in version `v0.5.0` is scanned.
5 changes: 5 additions & 0 deletions scripts/sbom/example.sbom.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
{{- range .artifacts}}
| {{.name}} | {{.type}} | {{.version}} | {{range .licenses}}{{.value}}, {{end}} |
Copy link
Collaborator

@puffitos puffitos Jan 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe leave out the , at the end? This creates a weird looking table:

❯ SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl
 ✔ Parsed image                                                                                                    sha256:930220dd636d6eb9c4fb64fb6a3da870d47fda214c2421e5480b25b79ad87659
 ✔ Cataloged contents                                                                                                     a3c35079ee159927516b3059d49f1b0e6c34fc1c62a545d6da1985490e971f42
   ├── ✔ Packages                        [53 packages]
   ├── ✔ File digests                    [1 files]
   ├── ✔ File metadata                   [1 locations]
   └── ✔ Executables                     [1 executables]
| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
| github.com/beorn7/perks | go-module | v1.0.1 | MIT,  |
| github.com/caas-team/sparrow | go-module | v0.5.0 |  |
| github.com/cenkalti/backoff/v4 | go-module | v4.3.0 | MIT,  |
| github.com/cespare/xxhash/v2 | go-module | v2.3.0 | MIT,  |
| github.com/fsnotify/fsnotify | go-module | v1.7.0 | BSD-3-Clause,  |
...

EDIT: I'll take a look on how to make this look proper, this can be done with go templating, if that's what they're using in syft.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, how about this:

| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
{{- range .artifacts}}
| {{.name}} | {{.type}} | {{.version}} | {{range $index, $licence := .licenses}}{{- if $index}}, {{end}}{{$licence.value}}{{end}} |
{{- end}}

This produces the following output:

❯ SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl
 ✔ Parsed image                                                                                                    sha256:930220dd636d6eb9c4fb64fb6a3da870d47fda214c2421e5480b25b79ad87659
 ✔ Cataloged contents                                                                                                     a3c35079ee159927516b3059d49f1b0e6c34fc1c62a545d6da1985490e971f42
   ├── ✔ Packages                        [53 packages]
   ├── ✔ File digests                    [1 files]
   ├── ✔ File metadata                   [1 locations]
   └── ✔ Executables                     [1 executables]
| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
| github.com/beorn7/perks | go-module | v1.0.1 | MIT |
| github.com/caas-team/sparrow | go-module | v0.5.0 |  |
| github.com/cenkalti/backoff/v4 | go-module | v4.3.0 | MIT |
| github.com/cespare/xxhash/v2 | go-module | v2.3.0 | MIT |
| github.com/fsnotify/fsnotify | go-module | v1.7.0 | BSD-3-Clause |
| github.com/getkin/kin-openapi | go-module | v0.128.0 | MIT |
| github.com/go-chi/chi/v5 | go-module | v5.1.0 | MIT |
| github.com/go-logr/logr | go-module | v1.4.2 | Apache-2.0 |
| github.com/go-logr/stdr | go-module | v1.2.2 | Apache-2.0 |
| github.com/go-openapi/jsonpointer | go-module | v0.21.0 | Apache-2.0 |
| github.com/go-openapi/swag | go-module | v0.23.0 | Apache-2.0 |
| github.com/go-viper/mapstructure/v2 | go-module | v2.1.0 | MIT |
| github.com/google/uuid | go-module | v1.6.0 | BSD-3-Clause |
| github.com/grpc-ecosystem/grpc-gateway/v2 | go-module | v2.24.0 | BSD-3-Clause |
| github.com/invopop/yaml | go-module | v0.3.1 | BSD-3-Clause, MIT |
| github.com/josharian/intern | go-module | v1.0.0 | MIT |
| github.com/klauspost/compress | go-module | v1.17.9 | Apache-2.0, BSD-3-Clause, MIT |
...

{{- end}}
Loading