fix(ci): adopt augmented SBOM integration with Silk COMPASS-7910 (#5911)

Author: addaleax

.evergreen/buildvariants-and-tasks.in.yml

@@ -32,26 +32,31 @@ const PACKAGE_BUILD_VARIANTS = [
     // # when compiling/re-building addons. This ensures compatibility with other
     // # debian platforms that have glibc 2.23 or newer.
     run_on: 'ubuntu1604-large',
+    silk_asset_group: 'compass-ubuntu',
   },
   {
     name: 'package-windows',
     display_name: 'Package Windows',
     run_on: 'windows-vsCurrent-large',
+    silk_asset_group: 'compass-windows',
   },
   {
     name: 'package-rhel',
     display_name: 'Package RHEL',
     run_on: 'rhel80-large',
+    silk_asset_group: 'compass-rhel',
   },
   {
     name: 'package-macos-x64',
     display_name: 'Package MacOS Intel',
-    run_on: 'macos-1100'
+    run_on: 'macos-1100',
+    silk_asset_group: 'compass-macos',
   },
   {
     name: 'package-macos-arm',
     display_name: 'Package MacOS Arm64',
-    run_on: 'macos-1100-arm64'
+    run_on: 'macos-1100-arm64',
+    silk_asset_group: 'compass-macos-arm',
   }
 ];
 
@@ -152,7 +157,8 @@ buildvariants:
   # package
 <% for (const buildVariant of PACKAGE_BUILD_VARIANTS) { %>
   - name: <%= buildVariant.name %>
-
+    expansions:
+      silk_asset_group: <%= buildVariant.silk_asset_group %>
     display_name: <%= buildVariant.display_name %>
     run_on: <%= buildVariant.run_on %>
     tasks:

.evergreen/buildvariants-and-tasks.yml

@@ -32,34 +32,44 @@ buildvariants:
       - name: test-electron
         run_on: macos-14-arm64-gui
   - name: package-ubuntu
+    expansions:
+      silk_asset_group: compass-ubuntu
     display_name: Package Ubuntu
     run_on: ubuntu1604-large
     tasks:
       - name: package-compass
       - name: package-compass-isolated
       - name: package-compass-readonly
   - name: package-windows
+    expansions:
+      silk_asset_group: compass-windows
     display_name: Package Windows
     run_on: windows-vsCurrent-large
     tasks:
       - name: package-compass
       - name: package-compass-isolated
       - name: package-compass-readonly
   - name: package-rhel
+    expansions:
+      silk_asset_group: compass-rhel
     display_name: Package RHEL
     run_on: rhel80-large
     tasks:
       - name: package-compass
       - name: package-compass-isolated
       - name: package-compass-readonly
   - name: package-macos-x64
+    expansions:
+      silk_asset_group: compass-macos
     display_name: Package MacOS Intel
     run_on: macos-1100
     tasks:
       - name: package-compass
       - name: package-compass-isolated
       - name: package-compass-readonly
   - name: package-macos-arm
+    expansions:
+      silk_asset_group: compass-macos-arm
     display_name: Package MacOS Arm64
     run_on: macos-1100-arm64
     tasks:

.evergreen/create-sbom.sh

@@ -7,19 +7,27 @@ CRYPT_SHARED_VERSION=$(cat packages/compass/src/deps/csfle/version)
 
 set +x
 echo "${ARTIFACTORY_PASSWORD}" > /tmp/artifactory_password
+cat << EOF > /tmp/silkbomb.env
+SILK_CLIENT_ID=${SILK_CLIENT_ID}
+SILK_CLIENT_SECRET=${SILK_CLIENT_SECRET}
+EOF
 set -x
 
 trap_handler() {
-  rm -f /tmp/artifactory_password
+  rm -vf /tmp/artifactory_password /tmp/silkbomb.env
 }
 trap trap_handler ERR EXIT
 
-scp -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" .sbom/dependencies.json /tmp/artifactory_password "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/
+scp -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" .sbom/dependencies.json /tmp/silkbomb.env /tmp/artifactory_password "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/
 ssh -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -p "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME" \
   "(cat /tmp/dependencies.json | jq -r '.[] | "'"pkg:npm/" + .name + "@" + .version'"' > /tmp/purls.txt) && \
   echo "pkg:generic/mongo_crypt_shared@${CRYPT_SHARED_VERSION}" >> /tmp/purls.txt && \
   (cat /tmp/artifactory_password | docker login artifactory.corp.mongodb.com --username '${ARTIFACTORY_USERNAME}' --password-stdin ; rm -f /tmp/artifactor_password ) && \
   docker pull artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 && \
   docker run --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 update \
-    --purls /tmp/purls.txt --sbom_out /tmp/sbom.json"
-scp -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/{sbom.json,purls.txt} .sbom/
+    --purls /tmp/purls.txt --sbom-out /tmp/sbom-lite.json && \
+  docker run --env-file /tmp/silkbomb.env --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 upload \
+    --silk-asset-group "${SILK_ASSET_GROUP}" --sbom-in /tmp/sbom-lite.json && \
+  docker run --env-file /tmp/silkbomb.env --rm -v /tmp:/tmp artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 download \
+    --silk-asset-group "${SILK_ASSET_GROUP}" --sbom-out /tmp/sbom.json"
+scp -i "$SIGNING_SERVER_PRIVATE_KEY_CYGPATH" -P "$SIGNING_SERVER_PORT" "$SIGNING_SERVER_USERNAME"@"$SIGNING_SERVER_HOSTNAME":/tmp/{sbom-lite.json,sbom.json,purls.txt} .sbom/

.evergreen/functions.yml

@@ -435,6 +435,10 @@ functions:
           SIGNING_SERVER_PRIVATE_KEY_CYGPATH: ${SIGNING_SERVER_PRIVATE_KEY_CYGPATH}
           SIGNING_SERVER_USERNAME: ${SIGNING_SERVER_USERNAME}
           SIGNING_SERVER_PORT: ${SIGNING_SERVER_PORT}
+          # for Silk SBOM integration
+          SILK_ASSET_GROUP: ${silk_asset_group}
+          SILK_CLIENT_ID: ${silk_client_id}
+          SILK_CLIENT_SECRET: ${silk_client_secret}
         script: |
           set -e
 
@@ -821,6 +825,13 @@ functions:
         remote_file: ${project}/${revision}_${revision_order_id}/${task_id}/purls.txt
         content_type: text/plain
         optional: true
+    - command: s3.put
+      params:
+        <<: *save-artifact-params-public
+        local_file: src/.sbom/sbom-lite.json
+        remote_file: ${project}/${revision}_${revision_order_id}/${task_id}/sbom-lite.json
+        content_type: application/json
+        optional: true
     - command: s3.put
       params:
         <<: *save-artifact-params-public