konflux: generate real SPDX SBOM for dm-verity image - #254
Conversation
|
/retest |
Replace the empty placeholder SBOM with a real SPDX 2.3 SBOM that lists all RPM packages installed in the QCOW2 guest and references the osc-podvm-payload container by digest. The build now captures the RPM inventory via rpm -qa inside the guest, extracts it with virt-copy-out, and transfers it back to the Tekton pod. The sbom-generate step constructs valid SPDX JSON with package entries and PURL references for each RPM and the payload container. The SBOM format was aligned against real SBOMs from osc-caa (syft) and osc-podvm-payload (mobster) to match field structure, PURL conventions, license fields, and checksums. Ref: KATA-5098 Signed-off-by: Daniel Kreling <dkreling@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
293b094 to
2d12281
Compare
|
We had the Enterprise Contract test failing due to a Konflux-managed data source (lists which task bundles are "acceptable" for EC validation). It's referenced from inside the quay.io/conforma/release-policy:konflux policy bundle, which is maintained by the Konflux/Conforma team — not something configured in our konflux-release-data EC policy. This doesn't block our SBOM work. The per-component EC check (osc-dm-verity-image-on-pull-request) already assed with SUCCESS. Retesting to see if there's already a fix applied. |
|
/retest |
| IMAGE_PULLSPEC="${IMAGE_URL}@${IMAGE_DIGEST}" | ||
| CREATED=$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "1970-01-01T00:00:00Z") | ||
|
|
||
| { |
There was a problem hiding this comment.
Rather than writing the file manually, and be responsible for changing it if the format is modified somehow, I would like to rely on mobster, and let it deal with the SBOM format.
The "buildah" task we use everywhere else is doing it:
https://github.com/konflux-ci/build-definitions/blob/39abbc73206c645eb7ee94fa9cd806b00b174ec6/task/buildah-remote-oci-ta/0.10/buildah-remote-oci-ta.yaml#L1058
Can we try to do something similar?
There was a problem hiding this comment.
Thanks Julien. Yes, I agree — I've reimplemented this using syft + mobster in a new branch, following the same pattern as the buildah-remote task. The custom printf SBOM is gone... Besides, using that approach will preserve consistency and maintainability among our repos.
This is the PR I created #256 and I'll close this one in favor to #256.
2 participants
Replace the empty placeholder SBOM with a real SPDX 2.3 SBOM that lists all RPM packages installed in the QCOW2 guest and references the osc-podvm-payload container by digest.
The build now captures the RPM inventory via rpm -qa inside the guest, extracts it with virt-copy-out, and transfers it back to the Tekton pod. The sbom-generate step constructs valid SPDX JSON with package entries and PURL references for each RPM and the payload container.
The SBOM format was aligned against real SBOMs from osc-caa (syft) and osc-podvm-payload (mobster) to match field structure, PURL conventions, license fields, and checksums.
Issue: KATA-5098