Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve generation of base images SBOMs #1659

Merged
merged 2 commits into from
Dec 9, 2024
Merged

Improve generation of base images SBOMs #1659

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eee3c4f
Improve generation of base images SBOMs
mkosiarc Nov 28, 2024
14122d8
Merge branch 'main' into improve-image-parsin
mkosiarc Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion task/build-image-index/0.1/build-image-index.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ spec:
add:
- SETFCAP

- image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:f1c07f273536a00fa6539e2aa41b3fddab3bb282a157c9676572858bfd19d7e4
- image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:e1347023ef1e83d52813c26384f551e3a03e482539d17a647955603e7ea6b579
name: create-sbom
computeResources:
limits:
Expand Down
18 changes: 10 additions & 8 deletions task/buildah-oci-ta/0.2/buildah-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,9 +348,9 @@ spec:
BUILD_ARG_FLAGS+=("--build-arg=$build_arg")
done

dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" >/shared/parsed_dockerfile.json
BASE_IMAGES=$(
dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" |
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)'
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)' /shared/parsed_dockerfile.json
)

BUILDAH_ARGS=()
Expand Down Expand Up @@ -530,11 +530,13 @@ spec:

touch /shared/base_images_digests
for image in $BASE_IMAGES; do
buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image" >>/shared/base_images_digests
base_image_digest=$(buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image")
# In some cases, there might be BASE_IMAGES, but not any associated digest. This happens
# if buildah did not use that particular image during build because it was skipped
if [ -n "$base_image_digest" ]; then
echo "$image $base_image_digest" >>/shared/base_images_digests
fi
done

# Needed to generate base images SBOM
echo "$BASE_IMAGES" >/shared/base_images_from_dockerfile
computeResources:
limits:
cpu: "4"
Expand Down Expand Up @@ -651,7 +653,7 @@ spec:
securityContext:
runAsUser: 0
- name: prepare-sboms
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:f1c07f273536a00fa6539e2aa41b3fddab3bb282a157c9676572858bfd19d7e4
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:e1347023ef1e83d52813c26384f551e3a03e482539d17a647955603e7ea6b579
workingDir: /var/workdir
script: |
echo "Merging contents of sbom-source.json and sbom-image.json into sbom-cyclonedx.json"
Expand All @@ -666,7 +668,7 @@ spec:
echo "Adding base images data to sbom-cyclonedx.json"
python3 /scripts/base_images_sbom_script.py \
--sbom=sbom-cyclonedx.json \
--base-images-from-dockerfile=/shared/base_images_from_dockerfile \
--parsed-dockerfile=/shared/parsed_dockerfile.json \
--base-images-digests=/shared/base_images_digests

echo "Adding image reference to sbom"
Expand Down
18 changes: 10 additions & 8 deletions task/buildah-remote-oci-ta/0.2/buildah-remote-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,9 +382,9 @@ spec:
BUILD_ARG_FLAGS+=("--build-arg=$build_arg")
done

dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" >/shared/parsed_dockerfile.json
BASE_IMAGES=$(
dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" |
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)'
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)' /shared/parsed_dockerfile.json
)

BUILDAH_ARGS=()
Expand Down Expand Up @@ -564,12 +564,14 @@ spec:

touch /shared/base_images_digests
for image in $BASE_IMAGES; do
buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image" >>/shared/base_images_digests
base_image_digest=$(buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image")
# In some cases, there might be BASE_IMAGES, but not any associated digest. This happens
# if buildah did not use that particular image during build because it was skipped
if [ -n "$base_image_digest" ]; then
echo "$image $base_image_digest" >>/shared/base_images_digests
fi
done

# Needed to generate base images SBOM
echo "$BASE_IMAGES" >/shared/base_images_from_dockerfile

buildah push "$IMAGE" "oci:konflux-final-image:$IMAGE"
REMOTESSHEOF
chmod +x scripts/script-build.sh
Expand Down Expand Up @@ -769,7 +771,7 @@ spec:
requests:
cpu: 100m
memory: 256Mi
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:f1c07f273536a00fa6539e2aa41b3fddab3bb282a157c9676572858bfd19d7e4
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:e1347023ef1e83d52813c26384f551e3a03e482539d17a647955603e7ea6b579
name: prepare-sboms
script: |
#!/bin/bash
Expand All @@ -790,7 +792,7 @@ spec:
echo "Adding base images data to sbom-cyclonedx.json"
python3 /scripts/base_images_sbom_script.py \
--sbom=sbom-cyclonedx.json \
--base-images-from-dockerfile=/shared/base_images_from_dockerfile \
--parsed-dockerfile=/shared/parsed_dockerfile.json \
--base-images-digests=/shared/base_images_digests

echo "Adding image reference to sbom"
Expand Down
19 changes: 11 additions & 8 deletions task/buildah-remote/0.2/buildah-remote.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,9 +358,10 @@ spec:
BUILD_ARG_FLAGS+=("--build-arg=$build_arg")
done


dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" > /shared/parsed_dockerfile.json
BASE_IMAGES=$(
dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" |
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)'
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)' /shared/parsed_dockerfile.json
)

BUILDAH_ARGS=()
Expand Down Expand Up @@ -542,12 +543,14 @@ spec:

touch /shared/base_images_digests
for image in $BASE_IMAGES; do
buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image" >> /shared/base_images_digests
base_image_digest=$(buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image")
# In some cases, there might be BASE_IMAGES, but not any associated digest. This happens
# if buildah did not use that particular image during build because it was skipped
if [ -n "$base_image_digest" ]; then
echo "$image $base_image_digest" >> /shared/base_images_digests
fi
done

# Needed to generate base images SBOM
echo "$BASE_IMAGES" > /shared/base_images_from_dockerfile

buildah push "$IMAGE" "oci:konflux-final-image:$IMAGE"
REMOTESSHEOF
chmod +x scripts/script-build.sh
Expand Down Expand Up @@ -749,7 +752,7 @@ spec:
requests:
cpu: 100m
memory: 256Mi
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:f1c07f273536a00fa6539e2aa41b3fddab3bb282a157c9676572858bfd19d7e4
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:e1347023ef1e83d52813c26384f551e3a03e482539d17a647955603e7ea6b579
name: prepare-sboms
script: |
#!/bin/bash
Expand All @@ -770,7 +773,7 @@ spec:
echo "Adding base images data to sbom-cyclonedx.json"
python3 /scripts/base_images_sbom_script.py \
--sbom=sbom-cyclonedx.json \
--base-images-from-dockerfile=/shared/base_images_from_dockerfile \
--parsed-dockerfile=/shared/parsed_dockerfile.json \
--base-images-digests=/shared/base_images_digests

echo "Adding image reference to sbom"
Expand Down
19 changes: 11 additions & 8 deletions task/buildah/0.2/buildah.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,9 +279,10 @@ spec:
BUILD_ARG_FLAGS+=("--build-arg=$build_arg")
done


dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" > /shared/parsed_dockerfile.json
BASE_IMAGES=$(
dockerfile-json "${BUILD_ARG_FLAGS[@]}" "$dockerfile_copy" |
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)'
jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test("^oci-archive:") | not)' /shared/parsed_dockerfile.json
)

BUILDAH_ARGS=()
Expand Down Expand Up @@ -463,12 +464,14 @@ spec:

touch /shared/base_images_digests
for image in $BASE_IMAGES; do
buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image" >> /shared/base_images_digests
base_image_digest=$(buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image")
# In some cases, there might be BASE_IMAGES, but not any associated digest. This happens
# if buildah did not use that particular image during build because it was skipped
if [ -n "$base_image_digest" ]; then
echo "$image $base_image_digest" >> /shared/base_images_digests
fi
done

# Needed to generate base images SBOM
echo "$BASE_IMAGES" > /shared/base_images_from_dockerfile

securityContext:
capabilities:
add:
Expand Down Expand Up @@ -599,7 +602,7 @@ spec:
runAsUser: 0

- name: prepare-sboms
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:f1c07f273536a00fa6539e2aa41b3fddab3bb282a157c9676572858bfd19d7e4
image: quay.io/redhat-appstudio/sbom-utility-scripts-image@sha256:e1347023ef1e83d52813c26384f551e3a03e482539d17a647955603e7ea6b579
computeResources:
limits:
memory: 512Mi
Expand All @@ -620,7 +623,7 @@ spec:
echo "Adding base images data to sbom-cyclonedx.json"
python3 /scripts/base_images_sbom_script.py \
--sbom=sbom-cyclonedx.json \
--base-images-from-dockerfile=/shared/base_images_from_dockerfile \
--parsed-dockerfile=/shared/parsed_dockerfile.json \
--base-images-digests=/shared/base_images_digests

echo "Adding image reference to sbom"
Expand Down
Loading