Draft: SBOM refactor for registry images #298

natalieparellano · 2023-09-29T18:38:34Z

buildpack-bot · 2023-09-29T18:38:51Z

Maintainers,

As you review this RFC please queue up issues to be created using the following commands:

/queue-issue <repo> "<title>" [labels]...
/unqueue-issue <uid>

Issues

(none)

natalieparellano · 2023-09-29T18:51:00Z

text/0000-refactor-sbom.md

+
+## Next builds
+
+During `analyze`, the lifecyle should verify attestations for the previous application image, and download the SBOM data as files in `<layers>/sbom/launch/`


If there is an SBOM in the registry for the run image, we could do interesting things, like provide that to buildpacks (somehow, somewhere) so they could know more about what's available. But that should probably be out of scope for now.

text/0000-refactor-sbom.md

natalieparellano · 2023-09-29T18:53:02Z

text/0000-refactor-sbom.md

+- Why should we do this?
+
+Our current approach has a few drawbacks, namely:
+* It can make application images quite large


Examples here would be nice

natalieparellano · 2023-09-29T18:54:27Z

text/0000-refactor-sbom.md

+
+The `exporter` will accept a new optional flag `-omit-sbom` that defaults to `false`.
+* If `-omit-sbom=false` the exporter will behave as today, and include the SBOM layer containing the `<layers>/sbom/launch/` directory in the application image.
+* If `-omit-sbom=true` the exporter will not create the SBOM layer, but `<layers>/sbom/launch/` will remain on the filesystem and be available to the `signer`.


If -daemon is true we might log a warning or error

natalieparellano · 2023-09-29T18:56:26Z

text/0000-refactor-sbom.md

+
+### Example 3 - platform-provided SBOM file
+
+Platforms could inject TOML to describe the run image, e.g.:


This could be concatenated to the configuration file output by the exporter

text/0000-refactor-sbom.md

Signed-off-by: Natalie Arellano <narellano@vmware.com>

RealHarshThakur · 2023-09-29T20:13:10Z

Couple thoughts:
There's been recent work in Buildkit and Docker to provide SBOM and provenance as part of the image. I think there's a lot that can be potentially re-used or integrated directly.

Attestation storage: They've achieved it via storing all the attestations in a single manifest, which I thought was pretty neat compared to the "image tag of sha256-hash " way of doing things- https://docs.docker.com/build/attestations/attestation-storage
Other aspect that I think worth looking at is scanners . This will change the model of "who generates the SBOM?" . Often times, I've found not all buildpacks provide SBOMs and there's no easy fallback mechanism. I think having such scanners might help to provide a fallback or even merge the SBOMs to enrich them.
Buildkit supports attestations natively on the newer versions. So that might be handy. /~https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-provenance.md

Signed-off-by: Natalie Arellano <narellano@vmware.com>

AidanDelaney

In general, this looks good to me. I have one query as to whether we expect signer to write to a registry, or if it is generating an on-disk signature that exporter will export (I'm assuming the latter from the examples provided).

AidanDelaney · 2023-10-04T14:14:50Z

text/0000-refactor-sbom.md

+We should explore secure ways of allowing the platform to inject this data (TODO).
+It's worth noting that `cosign` as of v2 prefers keyless signing.
+
+The `signer` can both sign the image and attach attestations to it. By default, we should do both - but we may want to make this configurable.


signer is then a registry operation? This means that both signer and exporter now write to the registry?

natalieparellano · 2023-10-05T18:33:44Z

text/0000-refactor-sbom.md

+## Setup
+
+The lifecycle will ship with a new `signer` binary.
+In the past we've talked about making this binary totally separate from the lifecycle,


From 10/5 Working Group - cosign is nevertheless a significant dependency to take into the lifecycle. If cosign took a configuration file (sigstore/cosign#1288 or similar) maybe we could just set that configuration up according to the mapping defined below. That would take care of the signing part.

For retrieving SBOMs from the previous image, we could:

explore making verifying attestations the responsibility of the "preparer" binary, if we ever have one; the preparer could write the predicate data as json for the analyzer to find

put this in the analyzer and hope the dependency footprint would be smaller if we're only verifying signatures (not creating them)

natalieparellano · 2023-10-05T18:36:17Z

text/0000-refactor-sbom.md

+
+The exporter will additionally generate configuration for the `signer` irrespective of the value of `-omit-sbom`.
+
+## Sign


From 10/5 Working Group - adding signatures could be a big jump for platforms that just want to get the SBOM out of the application image. We could provide an option to generate unsigned attestations as OCI artifacts in the registry which might ease the migration path for some folks.

tomkennedy513 · 2023-10-05T20:54:17Z

text/0000-refactor-sbom.md

+
+TODO
+
+Discuss prior art, both the good and bad.


Maybe the current cosign implementation in kpack could be referenced here?

natalieparellano commented Sep 29, 2023

View reviewed changes

text/0000-refactor-sbom.md Outdated Show resolved Hide resolved

natalieparellano commented Sep 29, 2023

View reviewed changes

text/0000-refactor-sbom.md Outdated Show resolved Hide resolved

natalieparellano force-pushed the refactor-sbom branch from 699eee3 to 0e42bfc Compare September 29, 2023 19:49

Initial draft

be4fb90

Signed-off-by: Natalie Arellano <narellano@vmware.com>

natalieparellano force-pushed the refactor-sbom branch from 0e42bfc to be4fb90 Compare September 29, 2023 20:00

natalieparellano added 2 commits October 2, 2023 10:57

Formatting

e0bf160

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Update examples and add BuildKit

d0396bd

Signed-off-by: Natalie Arellano <narellano@vmware.com>

natalieparellano changed the title ~~Draft: SBOM refactor~~ Draft: SBOM refactor for registry images Oct 2, 2023

natalieparellano added 4 commits October 2, 2023 13:58

Add TODO

659aa82

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Address some TODOs

51887cc

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Add buildpack ID to image-scoped layers

17ea26f

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Wording

c989ed9

Signed-off-by: Natalie Arellano <narellano@vmware.com>

AidanDelaney reviewed Oct 4, 2023

View reviewed changes

natalieparellano commented Oct 5, 2023

View reviewed changes

tomkennedy513 reviewed Oct 5, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Draft: SBOM refactor for registry images #298

Draft: SBOM refactor for registry images #298

natalieparellano commented Sep 29, 2023 •

edited

Loading

buildpack-bot commented Sep 29, 2023

natalieparellano Sep 29, 2023

natalieparellano Sep 29, 2023

natalieparellano Sep 29, 2023

natalieparellano Sep 29, 2023

RealHarshThakur commented Sep 29, 2023

AidanDelaney left a comment

AidanDelaney Oct 4, 2023

natalieparellano Oct 5, 2023 •

edited

Loading

natalieparellano Oct 5, 2023

tomkennedy513 Oct 5, 2023


		## Next builds

		During `analyze`, the lifecyle should verify attestations for the previous application image, and download the SBOM data as files in `<layers>/sbom/launch/`


		### Example 3 - platform-provided SBOM file

		Platforms could inject TOML to describe the run image, e.g.:


		The exporter will additionally generate configuration for the `signer` irrespective of the value of `-omit-sbom`.

		## Sign

Draft: SBOM refactor for registry images #298

Are you sure you want to change the base?

Draft: SBOM refactor for registry images #298

Conversation

natalieparellano commented Sep 29, 2023 • edited Loading

buildpack-bot commented Sep 29, 2023

Issues

natalieparellano Sep 29, 2023

Choose a reason for hiding this comment

natalieparellano Sep 29, 2023

Choose a reason for hiding this comment

natalieparellano Sep 29, 2023

Choose a reason for hiding this comment

natalieparellano Sep 29, 2023

Choose a reason for hiding this comment

RealHarshThakur commented Sep 29, 2023

AidanDelaney left a comment

Choose a reason for hiding this comment

AidanDelaney Oct 4, 2023

Choose a reason for hiding this comment

natalieparellano Oct 5, 2023 • edited Loading

Choose a reason for hiding this comment

natalieparellano Oct 5, 2023

Choose a reason for hiding this comment

tomkennedy513 Oct 5, 2023

Choose a reason for hiding this comment

natalieparellano commented Sep 29, 2023 •

edited

Loading

natalieparellano Oct 5, 2023 •

edited

Loading