Generate SBOMs using Syft instead of bom #32307
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
ferozsalam
added
the
release-note/misc
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
ferozsalam
force-pushed
the
pr/feroz/syft-sbom-generation
branch
8 times, most recently
from
47767be
to
db2488a
Compare
|
@joestringer @aanm @nbusseneau – marked this as draft for now, if the changes so far look OK to you, I will extend this to the other image build steps and update our current SBOM documentation. |
joestringer
added
release-note/minor
|
The approach looks pretty straightforward to me 👍 Given that users may be leveraging SBOM and the format would change, I bumped this to At a glance we may need to update some other docs files to account for the format change: |
aanm
approved these changes
May 3, 2024
ferozsalam
force-pushed
the
pr/feroz/syft-sbom-generation
branch
from
db2488a
to
9a3abe3
Compare
Syft appears to offer higher quality results, including being able to identify the versions of individual libraries in golang binaries, which is not something that we were able to do efficiently with `bom`. Syft can also generate the SBOMs in spdx-json format, which was a pending TODO from our initial implementation of SBOM generation. Signed-off-by: Feroz Salam <feroz.salam@isovalent.com>
ferozsalam
force-pushed
the
pr/feroz/syft-sbom-generation
branch
from
9a3abe3
to
42dee36
Compare
joestringer
approved these changes
May 14, 2024
|
/test |
ferozsalam
added
backport/1.13
15 tasks
YutaroHayakawa
added
backport-pending/1.15
This was referenced May 24, 2024
github-actions
bot
added
backport-done/1.15
ferozsalam
removed
needs-backport/1.13
This was referenced May 28, 2024
julianwiedmann
added
the
backport-done/1.14
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Syft (https://github.com/anchore/syft) appears to offer higher quality results, including being able to identify the versions of individual libraries in golang binaries, which is not something that we were able to do efficiently with
bom.Syft can also generate the SBOMs in spdx-json format, which was a pending TODO from our initial implementation of SBOM generation.
I have successfully run the proposed workflow (with some tweaks to ensure the correct code triggers) here: https://github.com/cilium/cilium/actions/runs/8930115426/job/24529471140?pr=32307.