Skip to content

Commit e45241d

Browse files
dssengdsseng
committed
feat: add SBOM support
With an `sbom` step you can now make bldr to generate an SPDX JSON format SBOM file when building the package. This SBOM contains the added metadata, as well as references to files the package downloads. Signed-off-by: Dmitrii Sharshakov <[email protected]>
1 parent d09e69c commit e45241d

File tree

13 files changed

+2607
-101
lines changed

13 files changed

+2607
-101
lines changed

‎cmd/bldr/cmd/sbom.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// This Source Code Form is subject to the terms of the Mozilla Public
2+
// License, v. 2.0. If a copy of the MPL was not distributed with this
3+
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
4+
5+
package cmd
6+
7+
import (
8+
"fmt"
9+
"log"
10+
"time"
11+
12+
"github.com/spf13/cobra"
13+
14+
"github.com/siderolabs/bldr/internal/pkg/sbom"
15+
"github.com/siderolabs/bldr/internal/pkg/solver"
16+
)
17+
18+
// sbomCmd represents the graph command.
19+
var sbomCmd = &cobra.Command{
20+
Use: "sbom",
21+
Short: "Generate an SBOM for a package",
22+
Long: `This command outputs evaluates the package build instructions
23+
and outputs a Software Bill of Materials (SBOM) for it in SPDX format.
24+
`,
25+
Args: cobra.NoArgs,
26+
Run: func(_ *cobra.Command, _ []string) {
27+
loader := solver.FilesystemPackageLoader{
28+
Root: pkgRoot,
29+
Context: options.GetVariables(),
30+
}
31+
32+
packages, err := solver.NewPackages(&loader)
33+
if err != nil {
34+
log.Fatal(err)
35+
}
36+
37+
graph, err := packages.Resolve(options.Target)
38+
if err != nil {
39+
log.Fatal(err)
40+
}
41+
42+
pkg := graph.Root.Pkg
43+
44+
sbomDoc, err := sbom.CreatePackageSBOM(pkg, options.TargetPlatform.Arch)
45+
if err != nil {
46+
log.Fatalf("failed to create SBOM for package %q: %v", pkg.Name, err)
47+
}
48+
49+
s, err := sbom.ToSpdxJSON(*sbomDoc, time.Unix(1, 0))
50+
if err != nil {
51+
log.Fatal(err)
52+
}
53+
fmt.Println(s)
54+
},
55+
}
56+
57+
func init() {
58+
sbomCmd.Flags().StringVarP(&options.Target, "target", "t", "", "Target image to describe")
59+
sbomCmd.MarkFlagRequired("target") //nolint:errcheck
60+
sbomCmd.Flags().Var(&options.TargetPlatform, "target-platform", "Target platform")
61+
rootCmd.AddCommand(sbomCmd)
62+
}

‎go.mod‎

Lines changed: 152 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,199 @@
11
module github.com/siderolabs/bldr
22

3-
go 1.24.0
3+
go 1.24.1
4+
5+
toolchain go1.24.4
6+
7+
replace github.com/anchore/syft => github.com/dsseng/syft v0.0.0-20250703101014-f39c35d156d9
48

59
require (
610
github.com/Masterminds/semver v1.5.0
711
github.com/Masterminds/sprig/v3 v3.3.0
12+
github.com/anchore/syft v1.27.1
813
github.com/containerd/platforms v1.0.0-rc.1
914
github.com/emicklei/dot v1.8.0
1015
github.com/google/go-github/v67 v67.0.0
1116
github.com/hashicorp/go-multierror v1.1.1
12-
github.com/moby/buildkit v0.20.1
17+
github.com/moby/buildkit v0.23.0
1318
github.com/moby/docker-image-spec v1.3.1
1419
github.com/opencontainers/go-digest v1.0.0
1520
github.com/opencontainers/image-spec v1.1.1
1621
github.com/otiai10/copy v1.14.1
17-
github.com/siderolabs/gen v0.8.0
22+
github.com/siderolabs/gen v0.8.4
1823
github.com/spf13/cobra v1.9.1
1924
github.com/stretchr/testify v1.10.0
20-
golang.org/x/oauth2 v0.28.0
21-
golang.org/x/sync v0.12.0
25+
golang.org/x/oauth2 v0.30.0
26+
golang.org/x/sync v0.15.0
2227
gopkg.in/yaml.v3 v3.0.1
2328
)
2429

2530
require (
26-
dario.cat/mergo v1.0.1 // indirect
27-
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
31+
cel.dev/expr v0.23.0 // indirect
32+
cloud.google.com/go v0.120.0 // indirect
33+
cloud.google.com/go/auth v0.16.0 // indirect
34+
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
35+
cloud.google.com/go/compute/metadata v0.7.0 // indirect
36+
cloud.google.com/go/iam v1.5.2 // indirect
37+
cloud.google.com/go/monitoring v1.24.2 // indirect
38+
cloud.google.com/go/storage v1.50.0 // indirect
39+
dario.cat/mergo v1.0.2 // indirect
40+
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa // indirect
41+
github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
42+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
43+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.50.0 // indirect
44+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.50.0 // indirect
2845
github.com/Masterminds/goutils v1.1.1 // indirect
29-
github.com/Masterminds/semver/v3 v3.3.0 // indirect
30-
github.com/containerd/containerd/v2 v2.0.4 // indirect
46+
github.com/Masterminds/semver/v3 v3.4.0 // indirect
47+
github.com/acobaugh/osrelease v0.1.0 // indirect
48+
github.com/adrg/xdg v0.5.3 // indirect
49+
github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51 // indirect
50+
github.com/anchore/clio v0.0.0-20250523175750-7f25834ffe5e // indirect
51+
github.com/anchore/fangs v0.0.0-20250616234211-1cd08d530bcd // indirect
52+
github.com/anchore/go-collections v0.0.0-20241211140901-567f400e9a46 // indirect
53+
github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d // indirect
54+
github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 // indirect
55+
github.com/anchore/go-struct-converter v0.0.0-20250211213226-cce56d595160 // indirect
56+
github.com/anchore/go-sync v0.0.0-20250606082549-57d4f2b6fdf3 // indirect
57+
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
58+
github.com/anchore/stereoscope v0.1.6 // indirect
59+
github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 // indirect
60+
github.com/aws/aws-sdk-go v1.44.122 // indirect
61+
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
62+
github.com/becheran/wildmatch-go v1.0.0 // indirect
63+
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
64+
github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
65+
github.com/cespare/xxhash/v2 v2.3.0 // indirect
66+
github.com/charmbracelet/colorprofile v0.3.1 // indirect
67+
github.com/charmbracelet/lipgloss v1.1.0 // indirect
68+
github.com/charmbracelet/x/ansi v0.9.3 // indirect
69+
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
70+
github.com/charmbracelet/x/term v0.2.1 // indirect
71+
github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f // indirect
72+
github.com/containerd/containerd/v2 v2.1.2 // indirect
3173
github.com/containerd/errdefs v1.0.0 // indirect
3274
github.com/containerd/log v0.1.0 // indirect
3375
github.com/containerd/ttrpc v1.2.7 // indirect
3476
github.com/containerd/typeurl/v2 v2.2.3 // indirect
35-
github.com/davecgh/go-spew v1.1.1 // indirect
77+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
78+
github.com/diskfs/go-diskfs v1.6.1-0.20250601133945-2af1c7ece24c // indirect
3679
github.com/distribution/reference v0.6.0 // indirect
80+
github.com/docker/cli v28.3.0+incompatible // indirect
81+
github.com/docker/docker-credential-helpers v0.9.3 // indirect
82+
github.com/docker/go-connections v0.5.0 // indirect
83+
github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 // indirect
84+
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
85+
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
86+
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
87+
github.com/facebookincubator/nvdtools v0.1.5 // indirect
88+
github.com/fatih/color v1.18.0 // indirect
89+
github.com/felixge/fgprof v0.9.5 // indirect
3790
github.com/felixge/httpsnoop v1.0.4 // indirect
38-
github.com/go-logr/logr v1.4.2 // indirect
91+
github.com/fsnotify/fsnotify v1.9.0 // indirect
92+
github.com/gabriel-vasile/mimetype v1.4.9 // indirect
93+
github.com/github/go-spdx/v2 v2.3.3 // indirect
94+
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
95+
github.com/go-logr/logr v1.4.3 // indirect
3996
github.com/go-logr/stdr v1.2.2 // indirect
97+
github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
4098
github.com/gogo/protobuf v1.3.2 // indirect
99+
github.com/gohugoio/hashstructure v0.5.0 // indirect
41100
github.com/golang/protobuf v1.5.4 // indirect
101+
github.com/golang/snappy v1.0.0 // indirect
102+
github.com/google/go-cmp v0.7.0 // indirect
103+
github.com/google/go-containerregistry v0.20.6 // indirect
42104
github.com/google/go-querystring v1.1.0 // indirect
105+
github.com/google/licensecheck v0.3.1 // indirect
106+
github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a // indirect
107+
github.com/google/s2a-go v0.1.9 // indirect
43108
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
44109
github.com/google/uuid v1.6.0 // indirect
110+
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
111+
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
112+
github.com/gookit/color v1.5.4 // indirect
45113
github.com/hashicorp/errwrap v1.1.0 // indirect
114+
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
115+
github.com/hashicorp/go-getter v1.7.8 // indirect
116+
github.com/hashicorp/go-safetemp v1.0.0 // indirect
117+
github.com/hashicorp/go-version v1.7.0 // indirect
46118
github.com/huandu/xstrings v1.5.0 // indirect
47-
github.com/in-toto/in-toto-golang v0.5.0 // indirect
119+
github.com/iancoleman/strcase v0.3.0 // indirect
120+
github.com/in-toto/in-toto-golang v0.9.0 // indirect
48121
github.com/inconshreveable/mousetrap v1.1.0 // indirect
49-
github.com/klauspost/compress v1.17.11 // indirect
122+
github.com/jinzhu/copier v0.4.0 // indirect
123+
github.com/jmespath/go-jmespath v0.4.0 // indirect
124+
github.com/klauspost/compress v1.18.0 // indirect
125+
github.com/klauspost/pgzip v1.2.6 // indirect
126+
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
127+
github.com/mattn/go-colorable v0.1.14 // indirect
128+
github.com/mattn/go-isatty v0.0.20 // indirect
129+
github.com/mattn/go-runewidth v0.0.16 // indirect
130+
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
50131
github.com/mitchellh/copystructure v1.2.0 // indirect
132+
github.com/mitchellh/go-homedir v1.1.0 // indirect
133+
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
51134
github.com/mitchellh/reflectwalk v1.0.2 // indirect
52135
github.com/moby/locker v1.0.1 // indirect
53136
github.com/moby/sys/signal v0.7.1 // indirect
137+
github.com/muesli/termenv v0.16.0 // indirect
138+
github.com/nwaples/rardecode v1.1.3 // indirect
139+
github.com/olekukonko/errors v0.0.0-20250405072817-4e6d85265da6 // indirect
140+
github.com/olekukonko/ll v0.0.8 // indirect
141+
github.com/olekukonko/tablewriter v1.0.7 // indirect
54142
github.com/otiai10/mint v1.6.3 // indirect
143+
github.com/pborman/indent v1.2.1 // indirect
144+
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
145+
github.com/pierrec/lz4/v4 v4.1.22 // indirect
55146
github.com/pkg/errors v0.9.1 // indirect
147+
github.com/pkg/profile v1.7.0 // indirect
56148
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
57-
github.com/pmezard/go-difflib v1.0.0 // indirect
58-
github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
149+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
150+
github.com/rivo/uniseg v0.4.7 // indirect
151+
github.com/sagikazarmark/locafero v0.9.0 // indirect
152+
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e // indirect
153+
github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
59154
github.com/shibumi/go-pathspec v1.3.0 // indirect
60155
github.com/shopspring/decimal v1.4.0 // indirect
61-
github.com/sirupsen/logrus v1.9.3 // indirect
62-
github.com/spf13/cast v1.7.0 // indirect
156+
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
157+
github.com/sourcegraph/conc v0.3.0 // indirect
158+
github.com/spdx/gordf v0.0.0-20250128162952-000978ccd6fb // indirect
159+
github.com/spdx/tools-golang v0.5.5 // indirect
160+
github.com/spf13/afero v1.14.0 // indirect
161+
github.com/spf13/cast v1.9.2 // indirect
63162
github.com/spf13/pflag v1.0.6 // indirect
64-
github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a // indirect
65-
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 // indirect
66-
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 // indirect
67-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
68-
go.opentelemetry.io/otel v1.31.0 // indirect
69-
go.opentelemetry.io/otel/metric v1.31.0 // indirect
70-
go.opentelemetry.io/otel/sdk v1.31.0 // indirect
71-
go.opentelemetry.io/otel/trace v1.31.0 // indirect
72-
golang.org/x/crypto v0.31.0 // indirect
73-
golang.org/x/net v0.33.0 // indirect
74-
golang.org/x/sys v0.29.0 // indirect
75-
golang.org/x/text v0.21.0 // indirect
76-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
77-
google.golang.org/grpc v1.69.4 // indirect
78-
google.golang.org/protobuf v1.35.2 // indirect
79-
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
163+
github.com/spf13/viper v1.20.1 // indirect
164+
github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
165+
github.com/subosito/gotenv v1.6.0 // indirect
166+
github.com/sylabs/squashfs v1.0.6 // indirect
167+
github.com/therootcompany/xz v1.0.1 // indirect
168+
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
169+
github.com/ulikunitz/xz v0.5.12 // indirect
170+
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 // indirect
171+
github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0 // indirect
172+
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
173+
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
174+
github.com/zeebo/errs v1.4.0 // indirect
175+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
176+
go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
177+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
178+
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.61.0 // indirect
179+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
180+
go.opentelemetry.io/otel v1.36.0 // indirect
181+
go.opentelemetry.io/otel/metric v1.36.0 // indirect
182+
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
183+
go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
184+
go.opentelemetry.io/otel/trace v1.36.0 // indirect
185+
go.uber.org/multierr v1.11.0 // indirect
186+
golang.org/x/crypto v0.39.0 // indirect
187+
golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476 // indirect
188+
golang.org/x/net v0.41.0 // indirect
189+
golang.org/x/sys v0.33.0 // indirect
190+
golang.org/x/term v0.32.0 // indirect
191+
golang.org/x/text v0.26.0 // indirect
192+
golang.org/x/time v0.11.0 // indirect
193+
google.golang.org/api v0.229.0 // indirect
194+
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
195+
google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
196+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
197+
google.golang.org/grpc v1.73.0 // indirect
198+
google.golang.org/protobuf v1.36.6 // indirect
80199
)

0 commit comments

Comments
 (0)