You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -15,229 +15,184 @@ One of the benefits of buildpacks is they can also populate the app image with m
15
15
16
16
You can find some of this information using `pack` via its `inspect-image` command. The bill-of-materials information will be available using `pack sbom download`.
17
17
18
-
<!-- test:exec -->
19
18
```bash
20
-
pack inspect-image test-ruby-app
19
+
pack inspect-image test-node-js-app
21
20
```
22
-
<!--+- "{{execute}}"+-->
23
21
You should see the following:
24
22
25
-
<!-- test:assert=contains;ignore-lines=... -->
26
23
```text
27
24
Run Images:
28
-
cnbs/sample-stack-run:jammy
25
+
cnbs/sample-base-run:jammy
29
26
...
30
27
31
28
Buildpacks:
32
29
ID VERSION HOMEPAGE
33
-
examples/ruby 0.0.1 -
30
+
examples/node-js 0.0.1 -
34
31
35
32
Processes:
36
33
TYPE SHELL COMMAND ARGS WORK DIR
37
-
web (default) bash bundle exec ruby app.rb /workspace
38
-
worker bash bundle exec ruby worker.rb /workspace
34
+
web (default) bash node-js app.js /workspace
39
35
```
40
36
41
-
Apart from the above standard metadata, buildpacks can also populate information about the dependencies they have provided in form of a `Bill-of-Materials`. Let's see how we can use this to populate information about the version of `ruby` that was installed in the output app image.
37
+
Apart from the above standard metadata, buildpacks can also populate information about the dependencies they have provided in form of a `Bill-of-Materials`. Let's see how we can use this to populate information about the version of `node-js` that was installed in the output app image.
42
38
43
-
To add the `ruby` version to the output of `pack download sbom`, we will have to provide a [Software `Bill-of-Materials`](https://en.wikipedia.org/wiki/Software_bill_of_materials) (`SBOM`) containing this information. There are three "standard" ways to report SBOM data. You'll need to choose to use one of [CycloneDX](https://cyclonedx.org/), [SPDX](https://spdx.dev/) or [Syft](https://github.com/anchore/syft) update the `ruby.sbom.<ext>` (where `<ext>` is the extension appropriate for your SBOM standard, one of `cdx.json`, `spdx.json` or `syft.json`) at the end of your `build` script. Discussion of which SBOM format to choose is outside the scope of this tutorial, but we will note that the SBOM format you choose to use is likely to be the output format of any SBOM scanner (eg: [`syft cli`](https://github.com/anchore/syft)) you might choose to use. In this example we will use the CycloneDX json format.
39
+
To add the `node-js` version to the output of `pack download sbom`, we will have to provide a [Software `Bill-of-Materials`](https://en.wikipedia.org/wiki/Software_bill_of_materials) (`SBOM`) containing this information. There are three "standard" ways to report SBOM data. You'll need to choose to use one of [CycloneDX](https://cyclonedx.org/), [SPDX](https://spdx.dev/) or [Syft](https://github.com/anchore/syft) update the `node-js.sbom.<ext>` (where `<ext>` is the extension appropriate for your SBOM standard, one of `cdx.json`, `spdx.json` or `syft.json`) at the end of your `build` script. Discussion of which SBOM format to choose is outside the scope of this tutorial, but we will note that the SBOM format you choose to use is likely to be the output format of any SBOM scanner (eg: [`syft cli`](https://github.com/anchore/syft)) you might choose to use. In this example we will use the CycloneDX json format.
44
40
45
41
First, annotate the `buildpack.toml` to specify that it emits CycloneDX:
# Stacks (deprecated) the buildpack will work with
59
59
[[stacks]]
60
-
id = "io.buildpacks.samples.stacks.jammy"
60
+
id = "*"
61
61
```
62
62
63
63
Then, in our buildpack implementation we will generate the necessary SBOM metadata:
64
64
65
65
```bash
66
66
# ...
67
67
68
-
# Append a Bill-of-Materials containing metadata about the provided ruby version
69
-
cat >>"$layersdir/ruby.sbom.cdx.json"<<EOL
68
+
# Append a Bill-of-Materials containing metadata about the provided node-js version
69
+
cat >>"${layersdir}/node-js.sbom.cdx.json"<<EOL
70
70
{
71
71
"bomFormat": "CycloneDX",
72
72
"specVersion": "1.4",
73
73
"version": 1,
74
74
"components": [
75
75
{
76
76
"type": "library",
77
-
"name": "ruby",
78
-
"version": "$ruby_version"
77
+
"name": "node-js",
78
+
"version": "${node_js_version}"
79
79
}
80
80
]
81
81
}
82
82
EOL
83
83
```
84
84
85
-
We can also add an SBOM entry for each dependency listed in `Gemfile.lock`. Here we use `jq` to add a new record to the `components` array in `bundler.sbom.cdx.json`:
85
+
We can also add an SBOM entry for each dependency listed in `package.json`. Here we use `jq` to add a new record to the `components` array in `bundler.sbom.cdx.json`:
86
86
87
87
```bash
88
-
crubybom="${layersdir}/ruby.sbom.cdx.json"
89
-
cat >>${rubybom}<<EOL
88
+
node-jsbom="${layersdir}/node-js.sbom.cdx.json"
89
+
cat >>${node-jsbom}<<EOL
90
90
{
91
91
"bomFormat": "CycloneDX",
92
92
"specVersion": "1.4",
93
93
"version": 1,
94
94
"components": [
95
95
{
96
96
"type": "library",
97
-
"name": "ruby",
98
-
"version": "$ruby_version"
97
+
"name": "node-js",
98
+
"version": "${node_js_version}"
99
99
}
100
100
]
101
101
}
102
102
EOL
103
-
if [[ -f Gemfile.lock ]] ;then
104
-
forgemin$(gem dep -q | grep ^Gem | sed 's/^Gem //')
105
-
do
106
-
version=${gem##*-}
107
-
name=${gem%-${version}}
108
-
DEP=$(jq --arg name "${name}" --arg version "${version}" \
Viewing your bill-of-materials requires extracting (or `download`ing) the bill-of-materials from your local image. This command can take some time to return.
224
180
225
181
<!-- test:exec -->
226
182
```bash
227
-
pack sbom download test-ruby-app
183
+
pack sbom download test-node-js-app
228
184
```
229
185
<!--+- "{{execute}}"+-->
230
186
231
187
The SBOM information is now downloaded to the local file system:
0 commit comments