Skip to content

Commit 2dc5445

Browse files
oarbusioarbusi
committed
sbom and augmented sbom
1 parent 935f7b8 commit 2dc5445

File tree

10 files changed

+284
-0
lines changed

10 files changed

+284
-0
lines changed

‎.github/workflows/generate-augmented-sbom.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Augment SBOM
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release_version:
7+
description: "Release version (e.g. 3.12.1)"
8+
required: true
9+
type: string
10+
resource:
11+
description: "Resource name (e.g. organization, project, etc.)"
12+
required: true
13+
type: string
14+
15+
permissions:
16+
id-token: write
17+
contents: read
18+
19+
jobs:
20+
augment-sbom:
21+
runs-on: ubuntu-latest
22+
env:
23+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
24+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
25+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
26+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
27+
steps:
28+
- uses: actions/checkout@v4
29+
30+
- name: Get current date
31+
id: date
32+
run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
33+
34+
- name: Augment SBOM with Kondukto
35+
env:
36+
RELEASE_VERSION: ${{ inputs.release_version }}
37+
run: ./scripts/compliance/augment-sbom.sh
38+
- name: Generate SSDLC report
39+
env:
40+
AUTHOR: ${{ github.actor }}
41+
VERSION: ${{ inputs.release_version }}
42+
AUGMENTED_REPORT: "true"
43+
run: ./scripts/compliance/gen-ssdlc-report.sh
44+
45+
- name: Upload augmented SBOM as artifact
46+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
47+
with:
48+
name: augmented_sbom_and_ssdlc_report
49+
path: |
50+
compliance/augmented-sbom-v${{ inputs.release_version }}-${{ steps.date.outputs.date }}.json
51+
compliance/ssdlc-compliance-${{ inputs.release_version }}-${{ steps.date.outputs.date }}.md
52+
if-no-files-found: error

‎.github/workflows/release.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,48 @@ jobs:
6767
ARTIFACTORY_REGISTRY: ${{ secrets.ARTIFACTORY_REGISTRY }}
6868
ARTIFACTORY_SIGN_USER: ${{ secrets.ARTIFACTORY_SIGN_USER }}
6969
ARTIFACTORY_SIGN_PASSWORD: ${{ secrets.ARTIFACTORY_SIGN_PASSWORD }}
70+
compliance:
71+
needs: release
72+
runs-on: ubuntu-latest
73+
env:
74+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
75+
steps:
76+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
77+
with:
78+
ref: ${{ inputs.version_number }}
79+
- name: Generate PURLs and SBOM
80+
run: make gen-purls gen-sbom
81+
- name: Upload SBOM to Kondukto
82+
run: make upload-sbom
83+
env:
84+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
85+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
86+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
87+
- name: Upload SBOM as release artifact
88+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
89+
with:
90+
files: compliance/sbom.json
91+
tag_name: ${{ inputs.version_number }}
92+
env:
93+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
94+
95+
generate-ssdlc-report:
96+
needs: compliance
97+
runs-on: ubuntu-latest
98+
steps:
99+
- name: Checkout
100+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
101+
- uses: ./.github/templates/run-script-and-commit
102+
with:
103+
script_call: |
104+
TAG="${{ inputs.version_number }}"
105+
VERSION="${TAG#v}"
106+
AUTHOR="${{ github.actor }}"
107+
export AUTHOR VERSION
108+
./scripts/compliance/gen-ssdlc-report.sh
109+
file_to_commit: 'compliance/v*/ssdlc-compliance-*.md'
110+
commit_message: "chore: Update SSDLC report for ${{ inputs.version_number }}"
111+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
112+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
113+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
114+
passphrase: ${{ secrets.APIX_BOT_PASSPHRASE }}

‎Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,20 @@ generate-manifest-windows: ## Generate the manifest file for windows OSes
6464
.DEFAULT_GOAL := help
6565
help:
6666
@grep -h -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' | sort
67+
68+
.PHONY: gen-purls
69+
gen-purls:
70+
./scripts/compliance/gen-purls.sh
71+
72+
.PHONY: gen-sbom
73+
gen-sbom:
74+
./scripts/compliance/gen-sbom.sh
75+
76+
.PHONY: gen-ssdlc-report
77+
gen-ssdlc-report:
78+
./scripts/compliance/gen-ssdlc-report.sh
79+
80+
.PHONY: upload-sbom
81+
upload-sbom:
82+
./scripts/compliance/upload-sbom.sh
6783

‎scripts/compliance/augment-sbom.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
: "${RELEASE_VERSION:?RELEASE_VERSION environment variable not set}"
5+
DATE=$(date +'%Y-%m-%d')
6+
7+
echo "Augmenting SBOM..."
8+
docker run \
9+
--pull=always \
10+
--platform="linux/amd64" \
11+
--rm \
12+
-v "${PWD}:/pwd" \
13+
-e KONDUKTO_TOKEN \
14+
"$SILKBOMB_IMG" \
15+
augment \
16+
--sbom-in "/pwd/compliance/sbom.json" \
17+
--repo "$KONDUKTO_REPO" \
18+
--branch "$KONDUKTO_BRANCH_PREFIX-linux-arm64" \
19+
--sbom-out "/pwd/compliance/augmented-sbom-v${RELEASE_VERSION}-${DATE}.json"

‎scripts/compliance/extract-purls.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if [ "$#" -ne 2 ]; then
5+
echo "Usage: $0 <binary_path> <output_file>"
6+
exit 1
7+
fi
8+
9+
BINARY_PATH="$1"
10+
OUTPUT_FILE="$2"
11+
12+
go version -m "$BINARY_PATH" | \
13+
awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | \
14+
LC_ALL=C sort > "$OUTPUT_FILE"

‎scripts/compliance/gen-purls.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
: "${LINKER_FLAGS:=}"
4+
5+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
6+
EXTRACT_PURL_SCRIPT="${SCRIPT_DIR}/extract-purls.sh"
7+
8+
if [ ! -x "$EXTRACT_PURL_SCRIPT" ]; then
9+
echo "extract-purls.sh not found or not executable"
10+
exit 1
11+
fi
12+
13+
echo "==> Generating purls"
14+
15+
# Define output and temp files
16+
OUT_DIR="compliance"
17+
LINUX_BIN="${OUT_DIR}/bin-linux"
18+
DARWIN_BIN="${OUT_DIR}/bin-darwin"
19+
WIN_BIN="${OUT_DIR}/bin-win.exe"
20+
PURL_LINUX="${OUT_DIR}/purls-linux.txt"
21+
PURL_DARWIN="${OUT_DIR}/purls-darwin.txt"
22+
PURL_WIN="${OUT_DIR}/purls-win.txt"
23+
PURL_ALL="${OUT_DIR}/purls.txt"
24+
25+
# Build and extract for Linux
26+
GOOS=linux GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${LINUX_BIN}" ./cmd/plugin
27+
"$EXTRACT_PURL_SCRIPT" "${LINUX_BIN}" "${PURL_LINUX}"
28+
29+
# Build and extract for Darwin
30+
GOOS=darwin GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${DARWIN_BIN}" ./cmd/plugin
31+
"$EXTRACT_PURL_SCRIPT" "${DARWIN_BIN}" "${PURL_DARWIN}"
32+
33+
# Build and extract for Windows
34+
GOOS=windows GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${WIN_BIN}" ./cmd/plugin
35+
"$EXTRACT_PURL_SCRIPT" "${WIN_BIN}" "${PURL_WIN}"
36+
37+
# Combine, sort, and deduplicate
38+
cat "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}" | LC_ALL=C sort | uniq > "${PURL_ALL}"
39+
40+
# Clean up temp files
41+
rm -f "${LINUX_BIN}" "${DARWIN_BIN}" "${WIN_BIN}" "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}"

‎scripts/compliance/gen-sbom.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Generating SBOM..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
"$SILKBOMB_IMG" \
8+
update \
9+
--purls /pwd/compliance/purls.txt \
10+
--sbom-out /pwd/compliance/sbom.json

‎scripts/compliance/gen-ssdlc-report.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
release_date=${DATE:-$(date -u '+%Y-%m-%d')}
5+
6+
export DATE="${release_date}"
7+
8+
if [ -z "${AUTHOR:-}" ]; then
9+
AUTHOR=$(git config user.name)
10+
fi
11+
12+
if [ -z "${VERSION:-}" ]; then
13+
VERSION=$(git tag --list 'v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
14+
fi
15+
16+
if [ "${AUGMENTED_REPORT:-false}" = "true" ]; then
17+
target_dir="."
18+
file_name="ssdlc-compliance-${VERSION}-${DATE}.md"
19+
SBOM_TEXT=" - See Augmented SBOM manifests (CycloneDX in JSON format):
20+
- This file has been provided along with this report under the name 'linux_amd64_augmented_sbom_v${VERSION}.json'
21+
- Please note that this file was generated on ${DATE} and may not reflect the latest security information of all third party dependencies."
22+
23+
else # If not augmented, generate the standard report
24+
target_dir="compliance/v${VERSION}"
25+
file_name="ssdlc-compliance-${VERSION}.md"
26+
SBOM_TEXT=" - See SBOM Lite manifests (CycloneDX in JSON format):
27+
- https://github.com/mongodb/atlas-cli-plugin-terraform/releases/download/v${VERSION}/sbom.json"
28+
# Ensure atlas-cli-plugin-terraform version directory exists
29+
mkdir -p "${target_dir}"
30+
fi
31+
32+
export AUTHOR
33+
export VERSION
34+
export SBOM_TEXT
35+
36+
echo "Generating SSDLC report for Atlas CLI plugin for Terraform's MongoDB Atlas Provider version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
37+
38+
envsubst < templates/ssdlc-compliance.template.md \
39+
> "${target_dir}/${file_name}"
40+
41+
echo "SSDLC compliance report ready. Files in ${target_dir}/:"
42+
ls -l "${target_dir}/"
43+
44+
echo "Printing the generated report:"
45+
cat "${target_dir}/${file_name}"

‎scripts/compliance/upload-sbom.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Uploading SBOMs..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
-e KONDUKTO_TOKEN \
8+
"$SILKBOMB_IMG" \
9+
upload \
10+
--sbom-in /pwd/compliance/sbom.json \
11+
--repo "$KONDUKTO_REPO" \
12+
--branch "$KONDUKTO_BRANCH_PREFIX"
13+

‎templates/ssdlc-compliance.template.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
SSDLC Compliance Report: MongoDB Atlas CLI Plugin Terraform ${VERSION}
2+
=================================================================
3+
4+
- Release Creator: ${AUTHOR}
5+
- Created On: ${DATE}
6+
7+
Overview:
8+
9+
- **Product and Release Name**
10+
- MongoDB Atlas CLI Plugin Terraform ${VERSION}, ${DATE}.
11+
12+
- **Process Document**
13+
- https://www.mongodb.com/blog/post/how-mongodb-protects-against-supply-chain-vulnerabilities
14+
15+
- **Tool used to track third party vulnerabilities**
16+
- [Kondukto](https://arcticglow.kondukto.io/)
17+
18+
- **Dependency Information**
19+
${SBOM_TEXT}
20+
21+
- **Security Testing Report**
22+
- Available as needed from Cloud Security.
23+
24+
- **Security Assessment Report**
25+
- Available as needed from Cloud Security.
26+
27+
Assumptions and attestations:
28+
29+
- Internal processes are used to ensure CVEs are identified and mitigated within SLAs.

0 commit comments

Comments
 (0)