Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for writing SBOMs when the build.Result is oci.Signed*. #506

Merged
merged 4 commits into from
Nov 22, 2021
+14,645 −309
Merged

Add support for writing SBOMs when the build.Result is oci.Signed*. #506

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7cfc361
Add support for writing SBOMs when the `build.Result` is signed.
mattmoor Nov 19, 2021
51088bf
Plumb through ctx
mattmoor Nov 20, 2021
84c2ffe
Avoid double negative
mattmoor Nov 20, 2021
2f2e1da
Add an interesting dependency to the test
mattmoor Nov 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/kind-e2e.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ jobs:
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."$REGISTRY_NAME:$REGISTRY_PORT"]
endpoint = ["http://$REGISTRY_NAME:$REGISTRY_PORT"]
EOF

- uses: helm/kind-action@v1.2.0
with:
cluster_name: kind
Expand All @@ -61,6 +62,11 @@ jobs:
run: |
kubectl wait --timeout=2m --for=condition=Ready nodes --all

- name: Install Cosign
uses: sigstore/cosign-installer@main
with:
cosign-release: 'v1.3.1'

- name: Run Smoke Test
run: |
# Test with kind load
Expand All @@ -73,6 +79,29 @@ jobs:
kubectl wait --timeout=60s --for=condition=Ready pod/kodata
kubectl delete pod kodata


- name: Check SBOM
run: |
set -o pipefail

IMAGE=$(ko publish ./test)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to add some dummy underscore-import to ./test that makes its SBOM a bit more interesting? I wouldn't want to add any deps that aren't already included in the main tool's go.mod, but at least having ./test's SBOM include ggcr would help exercise some code paths.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can add ./pkg/registry 😉

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

# cosign download sbom $(ko build -B ./test/)                                                                                                                                                                                          
2021/11/22 10:28:51 Using base gcr.io/distroless/static:nonroot for github.com/google/ko/test
2021/11/22 10:28:52 Building github.com/google/ko/test for linux/amd64
2021/11/22 10:28:53 Publishing gcr.io/mattmoor-chainguard/test:latest
2021/11/22 10:28:55 pushed blob: sha256:f0f9ae85d92dbd28f183a89b76294c6080bb496140dea890cef03a489639d1fe
2021/11/22 10:28:55 pushed blob: sha256:11f55e089f0062ef4a4d70bff133d915aeccf878528f765482e87cfbbc738743
2021/11/22 10:28:56 gcr.io/mattmoor-chainguard/test:sha256-16a451d99de28ffc98f053a918fe797766896bbe7c9b17d1146fbac0d4d62476.sbom: digest: sha256:c31b1e02ab1d549d3257c540f6f44e40e06a7a48e8d0d9e1df33dab80efac1a3 size: 329
2021/11/22 10:28:56 Published SBOM gcr.io/mattmoor-chainguard/test:sha256-16a451d99de28ffc98f053a918fe797766896bbe7c9b17d1146fbac0d4d62476.sbom
2021/11/22 10:28:56 existing blob: sha256:e8614d09b7bebabd9d8a450f44e88a8807c98a438a2ddd63146865286b132d1b
2021/11/22 10:28:57 pushed blob: sha256:4260a810acc66202754e7bf4f5db2d4df5589780c0c41716580d7de02eaa4e8d
2021/11/22 10:28:57 pushed blob: sha256:bfb7f3f84494f5e13f177efee4ca2e587619dbec98f68971c26428bc693efeba
2021/11/22 10:28:57 pushed blob: sha256:7d0e2ce4cf408744cfdbb1fc4fc9809408bedf55a12d92c43911739d645eeed5
2021/11/22 10:28:58 gcr.io/mattmoor-chainguard/test:latest: digest: sha256:16a451d99de28ffc98f053a918fe797766896bbe7c9b17d1146fbac0d4d62476 size: 952
2021/11/22 10:28:58 Published gcr.io/mattmoor-chainguard/test@sha256:16a451d99de28ffc98f053a918fe797766896bbe7c9b17d1146fbac0d4d62476
Found SBOM of media type: application/vnd.go.version-m
/ko-app/test: go1.17.1
        path    github.com/google/ko/test
        mod     github.com/google/ko    (devel)
        dep     github.com/google/go-containerregistry  v0.7.0  h1:u0onUUOcyoCDHEiJoyR1R1gx5er1+r06V5DBhUU5ndk=

# Strip the first line of each which contains garbage filenames.
SBOM=$(cosign download sbom ${IMAGE} | sed 1d)
KO_DEPS=$(ko deps ${IMAGE} | sed 1d)

echo '::group:: SBOM'
echo "${SBOM}"
echo '::endgroup::'

echo '::group:: ko deps'
echo "${KO_DEPS}"
echo '::endgroup::'

if [ "${SBOM}" != "${KO_DEPS}" ] ; then
echo Wanted SBOM and 'ko deps' to match, got differences!
exit 1
fi

- name: Collect logs
if: ${{ always() }}
run: |
Expand Down
1 change: 1 addition & 0 deletions doc/ko_apply.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ ko apply -f FILENAME [flags]
--push Push images to KO_DOCKER_REPO (default true)
-R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (DEPRECATED)
--sbom string The SBOM media type to use (none will disable SBOM synthesis and upload). (default "go.version-m")
-l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
-s, --server string The address and port of the Kubernetes API server (DEPRECATED)
--tag-only Include tags but not digests in resolved image references. Useful when digests are not preserved when images are repopulated.
Expand Down
1 change: 1 addition & 0 deletions doc/ko_build.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ ko build IMPORTPATH... [flags]
--platform string Which platform to use when pulling a multi-platform base. Format: all | <os>[/<arch>[/<variant>]][,platform]*
-P, --preserve-import-paths Whether to preserve the full import path after KO_DOCKER_REPO.
--push Push images to KO_DOCKER_REPO (default true)
--sbom string The SBOM media type to use (none will disable SBOM synthesis and upload). (default "go.version-m")
--tag-only Include tags but not digests in resolved image references. Useful when digests are not preserved when images are repopulated.
-t, --tags strings Which tags to use for the produced image instead of the default 'latest' tag (may not work properly with --base-import-paths or --bare). (default [latest])
--tarball string File to save images tarballs
Expand Down
1 change: 1 addition & 0 deletions doc/ko_create.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ ko create -f FILENAME [flags]
--push Push images to KO_DOCKER_REPO (default true)
-R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (DEPRECATED)
--sbom string The SBOM media type to use (none will disable SBOM synthesis and upload). (default "go.version-m")
-l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
-s, --server string The address and port of the Kubernetes API server (DEPRECATED)
--tag-only Include tags but not digests in resolved image references. Useful when digests are not preserved when images are repopulated.
Expand Down
1 change: 1 addition & 0 deletions doc/ko_resolve.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ ko resolve -f FILENAME [flags]
-P, --preserve-import-paths Whether to preserve the full import path after KO_DOCKER_REPO.
--push Push images to KO_DOCKER_REPO (default true)
-R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--sbom string The SBOM media type to use (none will disable SBOM synthesis and upload). (default "go.version-m")
-l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
--tag-only Include tags but not digests in resolved image references. Useful when digests are not preserved when images are repopulated.
-t, --tags strings Which tags to use for the produced image instead of the default 'latest' tag (may not work properly with --base-import-paths or --bare). (default [latest])
Expand Down
1 change: 1 addition & 0 deletions doc/ko_run.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ ko run IMPORTPATH [flags]
--platform string Which platform to use when pulling a multi-platform base. Format: all | <os>[/<arch>[/<variant>]][,platform]*
-P, --preserve-import-paths Whether to preserve the full import path after KO_DOCKER_REPO.
--push Push images to KO_DOCKER_REPO (default true)
--sbom string The SBOM media type to use (none will disable SBOM synthesis and upload). (default "go.version-m")
--tag-only Include tags but not digests in resolved image references. Useful when digests are not preserved when images are repopulated.
-t, --tags strings Which tags to use for the produced image instead of the default 'latest' tag (may not work properly with --base-import-paths or --bare). (default [latest])
--tarball string File to save images tarballs
Expand Down
4 changes: 1 addition & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,18 @@ require (
github.com/containerd/stargz-snapshotter/estargz v0.10.1
github.com/docker/docker v20.10.11+incompatible
github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960
github.com/evanphx/json-patch/v5 v5.5.0 // indirect
github.com/fsnotify/fsnotify v1.5.1
github.com/go-training/helloworld v0.0.0-20200225145412-ba5f4379d78b
github.com/google/go-cmp v0.5.6
github.com/google/go-containerregistry v0.7.0
github.com/mattmoor/dep-notify v0.0.0-20190205035814-a45dec370a17
github.com/mattn/go-isatty v0.0.13 // indirect
github.com/opencontainers/image-spec v1.0.2-0.20210730191737-8e42a01fb1b7
github.com/sigstore/cosign v1.3.2-0.20211120003522-90e2dcfe7b92
github.com/spf13/cobra v1.2.1
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.9.0
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
golang.org/x/text v0.3.7 // indirect
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
golang.org/x/tools v0.1.7
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
k8s.io/apimachinery v0.22.4
Expand Down
Loading