Skip to content

feat(nifi): SBOMs for NARs #1119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 19, 2025
Merged

feat(nifi): SBOMs for NARs #1119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9b972c1
feat: copy SBOMs of NARs
dervoeti May 15, 2025
7271e94
Merge branch 'main' of https://github.com/stackabletech/docker-images…
dervoeti May 18, 2025
dad7f89
chore: align sbom suffixes
dervoeti May 19, 2025
1d749a1
chore: changelog
dervoeti May 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ All notable changes to this project will be documented in this file.
- cyclonedx-bom: Bump airflow and superset to use `6.0.0` ([#1090]).
- vector: Bump to `0.46.1` ([#1098]).
- spark: update dependencies for 3.5.5 ([#1094])
- nifi: include NAR SBOMs ([#1119])

### Fixed

Expand Down Expand Up @@ -125,6 +126,7 @@ All notable changes to this project will be documented in this file.
[#1110]: https://github.com/stackabletech/docker-images/pull/1110
[#1114]: https://github.com/stackabletech/docker-images/pull/1114
[#1116]: https://github.com/stackabletech/docker-images/pull/1116
[#1119]: https://github.com/stackabletech/docker-images/pull/1119

## [25.3.0] - 2025-03-21

Expand Down
20 changes: 17 additions & 3 deletions nifi/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,20 @@ mv nifi-assembly/target/nifi-${PRODUCT}-bin/nifi-${PRODUCT} /stackable/nifi-${PR
# Copy the SBOM as well
mv nifi-assembly/target/bom.json /stackable/nifi-${PRODUCT}/nifi-${PRODUCT}.cdx.json

# Get a list of NARs
export NARS=$(ls /stackable/nifi-${PRODUCT}/lib/*.nar | awk -F '/' '{ print $5 }' | sed "s/\-${PRODUCT}.nar\$//g")
# Get a list of SBOMs
find . -name bom.json > bomlist.txt

for nar in $NARS; do
# Try to find the NAR in the list of SBOMs
match=$(grep "\/$nar\/target\/bom.json" bomlist.txt || true)
if [[ -n "$match" ]]; then
# Copy the SBOM of the NAR
cp "$match" "/stackable/nifi-${PRODUCT}/$nar.cdx.json"
fi
done

# Remove sources
(cd .. && rm -r ${PRODUCT})

Expand Down Expand Up @@ -100,15 +114,15 @@ if [[ "${PRODUCT}" != 1.* ]] ; then
cp ./nifi-iceberg-services-api-nar/target/nifi-iceberg-services-api-nar-${NIFI_ICEBERG_BUNDLE}.nar /stackable
cp ./nifi-iceberg-services-nar/target/nifi-iceberg-services-nar-${NIFI_ICEBERG_BUNDLE}.nar /stackable
cp ./nifi-iceberg-processors-nar/target/nifi-iceberg-processors-nar-${NIFI_ICEBERG_BUNDLE}.nar /stackable
cp ./target/bom.json /stackable/nifi-iceberg-bundle.sbom.json
cp ./target/bom.json /stackable/nifi-iceberg-bundle.cdx.json

cd ..
# Save disk space, even for intermediate images
rm -rf nifi-iceberg-bundle-${NIFI_ICEBERG_BUNDLE}

# Set correct groups
chmod g=u /stackable/*.nar
chmod g=u /stackable/*.sbom.json
chmod g=u /stackable/*.cdx.json
fi
EOF

Expand All @@ -129,7 +143,7 @@ LABEL name="Apache NiFi" \
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-builder /stackable/nifi-${PRODUCT} /stackable/nifi-${PRODUCT}/
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-builder /stackable/stackable-bcrypt.jar /stackable/stackable-bcrypt.jar
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-iceberg-bundle-builder /stackable/*.nar /stackable/nifi-${PRODUCT}/lib/
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-iceberg-bundle-builder /stackable/*.sbom.json /stackable/nifi-${PRODUCT}/lib/
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-iceberg-bundle-builder /stackable/*.cdx.json /stackable/nifi-${PRODUCT}/lib/
COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-builder /stackable/git-sync /stackable/git-sync

COPY --chown=${STACKABLE_USER_UID}:0 nifi/stackable/bin /stackable/bin
Expand Down