Skip to content

fix: make PURLs use oci type / fixed SBOM component name #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Oct 22, 2024
Merged

fix: make PURLs use oci type / fixed SBOM component name #11

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9f8c03d
fix: make PURLs use oci type
dervoeti Oct 17, 2024
17f506e
fix: use product name as source name in syft / SBOMs
dervoeti Oct 18, 2024
ea90853
fix: addressed review comments
dervoeti Oct 21, 2024
e3c41b6
fix: addressed comments from @NickLarsenNZ
dervoeti Oct 21, 2024
0347d7d
chore: removed unnecessary curly braces
dervoeti Oct 22, 2024
d96caa8
fix: curly braces syntax
dervoeti Oct 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions publish-image/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,22 +109,33 @@ runs:
# Extract the digest from the image repo digest (right side of '@')
DIGEST=${IMAGE_REPO_DIGEST#*@}

# URL encode the digest and image repository, needed for the purl
URLENCODED_DIGEST=$(jq -rn --arg input "$DIGEST" '$input | @uri')
URLENCODED_IMAGE_REPOSITORY=$(jq -rn --arg input "$IMAGE_REPOSITORY" '$input | @uri')
# Last item, split by /
# Example: sdp/kafka -> kafka
SOURCE_NAME=$(echo "$IMAGE_REPOSITORY" | awk -F'/' '{print $NF}')
# Extract architecture from image tag
ARCH=$(echo "$IMAGE_MANIFEST_TAG" | awk -F'-' '{print $NF}')
if [ "$ARCH" != "amd64" ] && [ "$ARCH" != "arm64" ]; then
echo "Invalid architecture obtained from image tag. IMAGE_MANIFEST_TAG: $IMAGE_MANIFEST_TAG, ARCH: $ARCH"
exit 1
fi
# Construct the package url (purl)
# TODO (@Techassi): Can we use 'oci' instead of 'docker' as the type?
PURL="pkg:docker/$IMAGE_REPOSITORY@$DIGEST?repository_url=$REGISTRY_URI"
PURL="pkg:oci/${SOURCE_NAME}@${URLENCODED_DIGEST}?arch=${ARCH}&repository_url=${REGISTRY_URI}%2F${URLENCODED_IMAGE_REPOSITORY}"

# Get metadata from the image
# NOTE (@Techassi): Maybe we should run this command only once
IMAGE_METADATA_DESCRIPTION=$(docker inspect --format='{{.Config.Labels.description}}' "${IMAGE_REPO_DIGEST}")
IMAGE_METADATA_NAME=$(docker inspect --format='{{.Config.Labels.name}}' "${IMAGE_REPO_DIGEST}")
IMAGE_METADATA_DESCRIPTION=$(docker inspect --format='{{.Config.Labels.description}}' "$IMAGE_REPO_DIGEST")
IMAGE_METADATA_NAME=$(docker inspect --format='{{.Config.Labels.name}}' "$IMAGE_REPO_DIGEST")

# Generate the SBOM
syft scan \
--output [email protected]=sbom_raw.json \
--select-catalogers "-cargo-auditable-binary-cataloger,+sbom-cataloger" \
--scope all-layers \
--source-name "$IMAGE_REPOSITORY" \
--source-version "$IMAGE_MANIFEST_TAG" "${IMAGE_REPO_DIGEST}"
--source-name "$SOURCE_NAME" \
--source-version "$IMAGE_MANIFEST_TAG" "$IMAGE_REPO_DIGEST"

# Merge SBOM components using https://github.com/stackabletech/mergebom
curl --fail -L -o mergebom https://repo.stackable.tech/repository/packages/mergebom/stable-$(uname -m)
Expand Down
Loading