Skip to content

Commit d34a3dd

Browse files
oarbusioarbusi
authored
chore: Onboard to Silkbomb to generate SSDLC reports, SBOM and generate augmented SBOM on demand (#49)
* sbom and augmented sbom * clean up input * eof * correct secrets * pr comments * contributing * typo
1 parent 935f7b8 commit d34a3dd

File tree

11 files changed

+300
-1
lines changed

11 files changed

+300
-1
lines changed

‎.github/workflows/generate-augmented-sbom.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Augment SBOM
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release_version:
7+
description: "Release version (e.g. 3.12.1)"
8+
required: true
9+
type: string
10+
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
augment-sbom:
17+
runs-on: ubuntu-latest
18+
env:
19+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
20+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
21+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
22+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
23+
steps:
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
25+
26+
- name: Get current date
27+
id: date
28+
run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
29+
30+
- name: Augment SBOM with Kondukto
31+
env:
32+
RELEASE_VERSION: ${{ inputs.release_version }}
33+
run: ./scripts/compliance/augment-sbom.sh
34+
- name: Generate SSDLC report
35+
env:
36+
AUTHOR: ${{ github.actor }}
37+
VERSION: ${{ inputs.release_version }}
38+
AUGMENTED_REPORT: "true"
39+
run: ./scripts/compliance/gen-ssdlc-report.sh
40+
41+
- name: Upload augmented SBOM as artifact
42+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
43+
with:
44+
name: augmented_sbom_and_ssdlc_report
45+
path: |
46+
compliance/augmented-sbom-v${{ inputs.release_version }}-${{ steps.date.outputs.date }}.json
47+
compliance/ssdlc-compliance-${{ inputs.release_version }}-${{ steps.date.outputs.date }}.md
48+
if-no-files-found: error

‎.github/workflows/release.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,48 @@ jobs:
6767
ARTIFACTORY_REGISTRY: ${{ secrets.ARTIFACTORY_REGISTRY }}
6868
ARTIFACTORY_SIGN_USER: ${{ secrets.ARTIFACTORY_SIGN_USER }}
6969
ARTIFACTORY_SIGN_PASSWORD: ${{ secrets.ARTIFACTORY_SIGN_PASSWORD }}
70+
compliance:
71+
needs: release
72+
runs-on: ubuntu-latest
73+
env:
74+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
75+
steps:
76+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
77+
with:
78+
ref: ${{ inputs.version_number }}
79+
- name: Generate PURLs and SBOM
80+
run: make gen-purls gen-sbom
81+
- name: Upload SBOM to Kondukto
82+
run: make upload-sbom
83+
env:
84+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
85+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
86+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
87+
- name: Upload SBOM as release artifact
88+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
89+
with:
90+
files: compliance/sbom.json
91+
tag_name: ${{ inputs.version_number }}
92+
env:
93+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
94+
95+
generate-ssdlc-report:
96+
needs: compliance
97+
runs-on: ubuntu-latest
98+
steps:
99+
- name: Checkout
100+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
101+
- uses: ./.github/templates/run-script-and-commit
102+
with:
103+
script_call: |
104+
TAG="${{ inputs.version_number }}"
105+
VERSION="${TAG#v}"
106+
AUTHOR="${{ github.actor }}"
107+
export AUTHOR VERSION
108+
./scripts/compliance/gen-ssdlc-report.sh
109+
file_to_commit: 'compliance/v*/ssdlc-compliance-*.md'
110+
commit_message: "chore: Update SSDLC report for ${{ inputs.version_number }}"
111+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
112+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
113+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
114+
passphrase: ${{ secrets.PASSPHRASE }}

‎CONTRIBUTING.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Contributing to the Atlas CLI plugin for Terraform's MongoDB Atlas Provider
22

3-
WIP
3+
Thank you for your interest in contributing! This project welcomes contributions from the community. Please follow the guidelines below to get started, build, and contribute effectively. For compliance and release processes, see the sections below.
44

55
## Building
66

@@ -9,3 +9,23 @@ You can build the binary plugin by running `make build`. You'll need to have Go
99
## Using the plugin from the CLI
1010

1111
You can also use the plugin with your changes from the CLI by running: `make local` and following the instructions displayed.
12+
13+
## Third Party Dependencies and Vulnerability Scanning
14+
15+
We scan our dependencies for vulnerabilities and incompatible licenses using [Snyk](https://snyk.io/).
16+
To run Snyk locally please follow their [CLI reference](https://support.snyk.io/hc/en-us/articles/360003812458-Getting-started-with-the-CLI).
17+
18+
We also use Kondukto to scan for third-party dependency vulnerabilities. Kondukto creates tickets in MongoDB's issue tracking system for any vulnerabilities found.
19+
20+
### SBOM and Compliance
21+
We generate Software Bill of Materials (SBOM) files for each release as part of MongoDB's SSDLC initiative. SBOM Lite files are automatically generated and included as release artifacts. Compliance reports are generated after each release and stored in the compliance/<release-version> directory.
22+
23+
Augmented SBOMs can be generated on customer request for any released version. This can only be done by MongoDB employees as it requires access to our GitHub workflow.
24+
25+
### Papertrail Integration
26+
All releases are recorded using a MongoDB-internal application called Papertrail. This records various pieces of information about releases, including the date and time of the release, who triggered the release (by pushing to Evergreen), and a checksum of each release file.
27+
28+
This is done automatically as part of the release.
29+
30+
### Release Artifact Signing
31+
All releases are signed automatically as part of the release process.

‎Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,20 @@ generate-manifest-windows: ## Generate the manifest file for windows OSes
6464
.DEFAULT_GOAL := help
6565
help:
6666
@grep -h -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' | sort
67+
68+
.PHONY: gen-purls
69+
gen-purls:
70+
./scripts/compliance/gen-purls.sh
71+
72+
.PHONY: gen-sbom
73+
gen-sbom:
74+
./scripts/compliance/gen-sbom.sh
75+
76+
.PHONY: gen-ssdlc-report
77+
gen-ssdlc-report:
78+
./scripts/compliance/gen-ssdlc-report.sh
79+
80+
.PHONY: upload-sbom
81+
upload-sbom:
82+
./scripts/compliance/upload-sbom.sh
6783

‎scripts/compliance/augment-sbom.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
: "${RELEASE_VERSION:?RELEASE_VERSION environment variable not set}"
5+
DATE=$(date +'%Y-%m-%d')
6+
7+
echo "Augmenting SBOM..."
8+
docker run \
9+
--pull=always \
10+
--platform="linux/amd64" \
11+
--rm \
12+
-v "${PWD}:/pwd" \
13+
-e KONDUKTO_TOKEN \
14+
"$SILKBOMB_IMG" \
15+
augment \
16+
--sbom-in "/pwd/compliance/sbom.json" \
17+
--repo "$KONDUKTO_REPO" \
18+
--branch "$KONDUKTO_BRANCH_PREFIX-linux-arm64" \
19+
--sbom-out "/pwd/compliance/augmented-sbom-v${RELEASE_VERSION}-${DATE}.json"

‎scripts/compliance/extract-purls.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if [ "$#" -ne 2 ]; then
5+
echo "Usage: $0 <binary_path> <output_file>"
6+
exit 1
7+
fi
8+
9+
BINARY_PATH="$1"
10+
OUTPUT_FILE="$2"
11+
12+
go version -m "$BINARY_PATH" | \
13+
awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | \
14+
LC_ALL=C sort > "$OUTPUT_FILE"

‎scripts/compliance/gen-purls.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
: "${LINKER_FLAGS:=}"
4+
5+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
6+
EXTRACT_PURL_SCRIPT="${SCRIPT_DIR}/extract-purls.sh"
7+
8+
if [ ! -x "$EXTRACT_PURL_SCRIPT" ]; then
9+
echo "extract-purls.sh not found or not executable"
10+
exit 1
11+
fi
12+
13+
echo "==> Generating purls"
14+
15+
# Define output and temp files
16+
OUT_DIR="compliance"
17+
LINUX_BIN="${OUT_DIR}/bin-linux"
18+
DARWIN_BIN="${OUT_DIR}/bin-darwin"
19+
WIN_BIN="${OUT_DIR}/bin-win.exe"
20+
PURL_LINUX="${OUT_DIR}/purls-linux.txt"
21+
PURL_DARWIN="${OUT_DIR}/purls-darwin.txt"
22+
PURL_WIN="${OUT_DIR}/purls-win.txt"
23+
PURL_ALL="${OUT_DIR}/purls.txt"
24+
25+
# Build and extract for Linux
26+
GOOS=linux GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${LINUX_BIN}" ./cmd/plugin
27+
"$EXTRACT_PURL_SCRIPT" "${LINUX_BIN}" "${PURL_LINUX}"
28+
29+
# Build and extract for Darwin
30+
GOOS=darwin GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${DARWIN_BIN}" ./cmd/plugin
31+
"$EXTRACT_PURL_SCRIPT" "${DARWIN_BIN}" "${PURL_DARWIN}"
32+
33+
# Build and extract for Windows
34+
GOOS=windows GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${WIN_BIN}" ./cmd/plugin
35+
"$EXTRACT_PURL_SCRIPT" "${WIN_BIN}" "${PURL_WIN}"
36+
37+
# Combine, sort, and deduplicate
38+
cat "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}" | LC_ALL=C sort | uniq > "${PURL_ALL}"
39+
40+
# Clean up temp files
41+
rm -f "${LINUX_BIN}" "${DARWIN_BIN}" "${WIN_BIN}" "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}"

‎scripts/compliance/gen-sbom.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Generating SBOM..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
"$SILKBOMB_IMG" \
8+
update \
9+
--purls /pwd/compliance/purls.txt \
10+
--sbom-out /pwd/compliance/sbom.json

‎scripts/compliance/gen-ssdlc-report.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
release_date=${DATE:-$(date -u '+%Y-%m-%d')}
5+
6+
export DATE="${release_date}"
7+
8+
if [ -z "${AUTHOR:-}" ]; then
9+
AUTHOR=$(git config user.name)
10+
fi
11+
12+
if [ -z "${VERSION:-}" ]; then
13+
VERSION=$(git tag --list 'v*' --sort=-taggerdate | head -1 | cut -d 'v' -f 2)
14+
fi
15+
16+
if [ "${AUGMENTED_REPORT:-false}" = "true" ]; then
17+
target_dir="."
18+
file_name="ssdlc-compliance-${VERSION}-${DATE}.md"
19+
SBOM_TEXT=" - See Augmented SBOM manifests (CycloneDX in JSON format):
20+
- This file has been provided along with this report under the name 'linux_amd64_augmented_sbom_v${VERSION}.json'
21+
- Please note that this file was generated on ${DATE} and may not reflect the latest security information of all third party dependencies."
22+
23+
else # If not augmented, generate the standard report
24+
target_dir="compliance/v${VERSION}"
25+
file_name="ssdlc-compliance-${VERSION}.md"
26+
SBOM_TEXT=" - See SBOM Lite manifests (CycloneDX in JSON format):
27+
- https://github.com/mongodb/atlas-cli-plugin-terraform/releases/download/v${VERSION}/sbom.json"
28+
# Ensure atlas-cli-plugin-terraform version directory exists
29+
mkdir -p "${target_dir}"
30+
fi
31+
32+
export AUTHOR
33+
export VERSION
34+
export SBOM_TEXT
35+
36+
echo "Generating SSDLC report for Atlas CLI plugin for Terraform's MongoDB Atlas Provider version ${VERSION}, author ${AUTHOR} and release date ${DATE}..."
37+
38+
envsubst < templates/ssdlc-compliance.template.md \
39+
> "${target_dir}/${file_name}"
40+
41+
echo "SSDLC compliance report ready. Files in ${target_dir}/:"
42+
ls -l "${target_dir}/"
43+
44+
echo "Printing the generated report:"
45+
cat "${target_dir}/${file_name}"

‎scripts/compliance/upload-sbom.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Uploading SBOMs..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
-e KONDUKTO_TOKEN \
8+
"$SILKBOMB_IMG" \
9+
upload \
10+
--sbom-in /pwd/compliance/sbom.json \
11+
--repo "$KONDUKTO_REPO" \
12+
--branch "$KONDUKTO_BRANCH_PREFIX"

0 commit comments

Comments
 (0)