RFC for Bill of Materials work #57

sophiewigmore · 2021-05-10T19:37:58Z

Signed-off-by: Sophie Wigmore swigmore@vmware.com

Summary

Readable

Resolves #56

Checklist

I have viewed, signed, and submitted the Contributor License Agreement.
I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
I have added an integration test, if necessary.
I have reviewed the styleguide for guidance on my code quality.
I'm happy with the commit history on this PR (I have rebased/squashed as needed).

text/0028-bill-of-materials.md

ekcasey · 2021-05-11T17:36:29Z

text/0028-bill-of-materials.md

+
+### Stacks
+Stacks (such as those found in the [Paketo Stacks repository](https://github.com/paketo-buildpacks/stacks))
+should have BOM metadata that includes in-depth information on all of the OS


Can we document the label key and value format we would like to use here?

Could this be provided in a format that is standardized across the buildpack ecosystem?

@ekcasey @matthewmcnew check out the section we added below and let us know your thoughts

@matthewmcnew yes I agree that we should. However, I think it is okay for Paketo to essentially incubate this feature while CNB works on improving the BOM. With the understanding that we may need to make adjustments if/when CNB makes this a standard.

ekcasey · 2021-05-11T17:38:32Z

text/0028-bill-of-materials.md

+
+### Runtime and Compilation Dependencies
+Dependencies that provide runtimes and/or are used for compilation should have
+BOM metadata surfaced about them. This includes both the dependencies in the


Currently, build-only dependencies should be added to the build BOM in build.toml. It is probably worth calling out that distinction explicitly.

https://github.com/buildpacks/spec/blob/main/buildpack.md#bills-of-materials

We do call out that we will not only capture the dependencies that are in the final image but ones used during build. Do we need hammer this point harder? Would you like use to call out that they are logged in 2 different BOMs by the lifecycle?

text/0028-bill-of-materials.md

linux-foundation-easycla · 2021-05-11T20:59:38Z

The committers are authorized under a signed CLA.

✅ Forest Eckhardt (7f03362)
✅ Sophie Wigmore (bdf13d8, 0e3d9ef, 9e27390)

text/0028-bill-of-materials.md

dmikusa · 2021-06-01T18:41:52Z

@ekcasey @matthewmcnew @fg-j - We reviewed this in the working group meeting. Just a quick reminder to submit feedback or resolve any ongoing conversations. Thanks!

ekcasey · 2021-06-15T15:46:11Z

text/0028-bill-of-materials.md

+    "version" : "<package source version>",
+    "upstreamVersion" : "<package source upstream version>"
+  },
+  "summary" : "<package summary>"


We should probably include a licenses key.

The reason we left this out is because we were investigating tools to collect licenses for the stacks, and the best option we founddpkg-licenses which only guarantees up to 90% of all license information, due to the lack of standardization in licenses. The tradeoff between the work involved getting that last 10% of license metadata, and user need wasn't worth it at the time we investigated this, so we left it out as something in the minimal set of fields.

Issue where we mentioned this: paketo-buildpacks/stacks#70

I do think it would be good to include license information in the future, but I would be okay leaving it out of this RFC for now.

ekcasey · 2021-06-15T15:47:01Z

text/0028-bill-of-materials.md

+{
+  "name" : "<package name>",
+  "version" : "<package version>",
+  "arch" : "<compatible architecture>",


What is the utility of arch?

The processor architecture that the package is compatible with, such as amd64.
While it's perhaps not the most valuable BoM field, it's information that we already currently surface for the stacks in the io.paketo.stack.packages label, so we thought we might as well surface more information than less.

text/0028-bill-of-materials.md

ryanmoran

I can see that each of the types of BOM entries seem to be conforming to a standardized schema. Could we show that complete schema at some point in the RFC?

text/0028-bill-of-materials.md

ekcasey · 2021-07-22T22:33:11Z

text/0028-bill-of-materials.md

+  version = "<dependency source version>",
+  upstream-version = "<dependency source upstream version>"
+```
+The optional set of keys may include:


Is there any reason to call out optional keys? I was assuming anything in the schema that wasn't required was optional.

Good call. Addressed in 7575872

Sorry for nitpicking on this but I am still confused after the above linked changes. In my mind there are only two things we need to specify. The complete schema (any field in which could optionally be filled out, for any type of entry) and any required fields for specific entry types. I don't understand why we re repeating subsets of the schema if to indicate required fields.

Are these the suggested fields (in which case maybe we could teak the wording to make that clear)? Or does this imply that other fields in the schema are disallowed for these dependency types (I don't think we should do this)?

Following this comment/our discussion around this at the 7-27 Working Group meeting, we have gone ahead and streamlined the RFC to solely include the top-level schema to show possible fields, and removed the dependency-type schemas. They are recommended fields, the only required fields are "name" and "version".

text/0028-bill-of-materials.md

Signed-off-by: Sophie Wigmore <swigmore@vmware.com>

Co-authored-by: Kashyap Vedurmudi <37810054+kvedurmu@users.noreply.github.com>

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

Signed-off-by: Sophie Wigmore <swigmore@vmware.com>

Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>

Co-authored-by: Emily Casey <emilykimballcasey@gmail.com>

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

sophiewigmore requested a review from a team as a code owner May 10, 2021 19:37

kvedurmu reviewed May 10, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

ekcasey reviewed May 11, 2021

View reviewed changes

sophiewigmore force-pushed the sophie/bom branch from b350f56 to 9e27390 Compare May 11, 2021 21:03

matthewmcnew reviewed May 13, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

dmikusa reviewed May 25, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

fg-j reviewed May 28, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

ekcasey reviewed Jun 15, 2021

View reviewed changes

sophiewigmore requested a review from ekcasey June 16, 2021 20:23

sophiewigmore force-pushed the sophie/bom branch from 077a268 to 818c121 Compare June 21, 2021 14:19

ryanmoran requested changes Jun 22, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

ekcasey reviewed Jul 22, 2021

View reviewed changes

sophiewigmore requested a review from ekcasey July 27, 2021 14:39

ryanmoran requested changes Jul 27, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

sophiewigmore requested a review from ryanmoran July 27, 2021 20:33

ryanmoran reviewed Jul 28, 2021

View reviewed changes

text/0028-bill-of-materials.md Outdated Show resolved Hide resolved

sophiewigmore requested a review from ryanmoran July 28, 2021 18:07

This was referenced Jul 28, 2021

Implement BOM on installation buildpacks paketo-buildpacks/nodejs#424

Closed

Implement BOM paketo-buildpacks/npm-install#261

Closed

Implement BOM paketo-buildpacks/yarn-install#238

Closed

ryanmoran approved these changes Jul 29, 2021

View reviewed changes

ekcasey approved these changes Aug 10, 2021

View reviewed changes

ForestEckhardt and others added 6 commits August 10, 2021 19:53

RFC for Bill of Materials work

9648c07

Signed-off-by: Sophie Wigmore <swigmore@vmware.com>

Update text/0028-bill-of-materials.md

af963da

Co-authored-by: Kashyap Vedurmudi <37810054+kvedurmu@users.noreply.github.com>

add standardized BOM fields

40bc458

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

Make dependency types more generic and add explicit key requirements

60aad55

remove stack from optional dependency metadata

294857d

Signed-off-by: Sophie Wigmore <swigmore@vmware.com>

standardize bom schemas

9d21e0d

sophiewigmore and others added 11 commits August 10, 2021 19:53

Update text/0028-bill-of-materials.md

1b4c9e1

Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>

Add overall schema

7d59eca

Adds information about license information confidence

9ed07c4

Add package URL to RFC

4500686

Apply suggestions from code review

7b62ecc

Co-authored-by: Emily Casey <emilykimballcasey@gmail.com>

remove optional key call out

522194b

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

Adds deprecation_date field

9dc569b

Apply suggestions from code review

dd7b705

Co-authored-by: Ryan Moran <155736+ryanmoran@users.noreply.github.com>

remove individual schemas

64d60e4

Signed-off-by: Forest Eckhardt <feckhardt@pivotal.io>

make field descriptions more specific

ba362e0

update README

9fc9c0a

ForestEckhardt force-pushed the sophie/bom branch from 88a0090 to 9fc9c0a Compare August 10, 2021 19:56

sophiewigmore merged commit 022f8e7 into paketo-buildpacks:main Aug 10, 2021

sophiewigmore deleted the sophie/bom branch August 10, 2021 20:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RFC for Bill of Materials work #57

RFC for Bill of Materials work #57

sophiewigmore commented May 10, 2021 •

edited

Loading

ekcasey May 11, 2021

matthewmcnew May 11, 2021

sophiewigmore May 12, 2021

ekcasey Jun 15, 2021

ekcasey May 11, 2021

ForestEckhardt May 11, 2021

linux-foundation-easycla bot commented May 11, 2021 •

edited

Loading

dmikusa commented Jun 1, 2021

ekcasey Jun 15, 2021

sophiewigmore Jun 16, 2021 •

edited

Loading

ekcasey Jun 15, 2021

sophiewigmore Jun 16, 2021 •

edited

Loading

ryanmoran left a comment

ekcasey Jul 22, 2021

sophiewigmore Jul 27, 2021

ekcasey Jul 27, 2021

sophiewigmore Jul 28, 2021 •

edited

Loading

RFC for Bill of Materials work #57

RFC for Bill of Materials work #57

Conversation

sophiewigmore commented May 10, 2021 • edited Loading

Summary

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

linux-foundation-easycla bot commented May 11, 2021 • edited Loading

dmikusa commented Jun 1, 2021

Choose a reason for hiding this comment

sophiewigmore Jun 16, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sophiewigmore Jun 16, 2021 • edited Loading

Choose a reason for hiding this comment

ryanmoran left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sophiewigmore Jul 28, 2021 • edited Loading

Choose a reason for hiding this comment

sophiewigmore commented May 10, 2021 •

edited

Loading

linux-foundation-easycla bot commented May 11, 2021 •

edited

Loading

sophiewigmore Jun 16, 2021 •

edited

Loading

sophiewigmore Jun 16, 2021 •

edited

Loading

sophiewigmore Jul 28, 2021 •

edited

Loading