Platform support for sBOM #268
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
natalieparellano
force-pushed
the
sbom-platform
branch
from
1fdccbf
to
2006859
Compare
Signed-off-by: Natalie Arellano <narellano@vmware.com>
natalieparellano
force-pushed
the
sbom-platform
branch
from
2006859
to
7078e56
Compare
Closed
Signed-off-by: Natalie Arellano <narellano@vmware.com>
jkutner
approved these changes
Nov 3, 2021
sclevine
approved these changes
Nov 5, 2021
nebhale
approved these changes
Nov 5, 2021
jromero
reviewed
Nov 9, 2021
Signed-off-by: Natalie Arellano <narellano@vmware.com>
Signed-off-by: Natalie Arellano <narellano@vmware.com>
sambhav
reviewed
Nov 10, 2021
platform.md
Outdated
| @@ -566,6 +567,10 @@ Usage: | |||
| - All run-image layers SHALL be preserved | |||
| - All run-image config values SHALL be preserved unless this conflicts with another requirement | |||
| - MUST contain all buildpack-provided launch layers as determined by the [Buildpack Interface Specfication](buildpack.md) | |||
| - MUST contain a layer containing all buildpack-provided standardized Bill of Materials (BOM) files for `launch` as determined by the [Buildpack Interface Specfication](buildpack.md) | |||
| - `<layers>/BOM/<buildpack-id>/launch.bom.<ext>` MUST contain the buildpack-provided `launch` BOM | |||
There was a problem hiding this comment.
Does this mean that this would cause issues if a buildpack with buildpack id bom exists? (We currently allow such buildpack ids)
There was a problem hiding this comment.
The buildpack would need id sbom, but yes
platform.md
Outdated
| @@ -1123,8 +1137,9 @@ Where: | |||
| Where: | |||
| - `app` MUST contain one entry per app slice layer where | |||
| - `sha` MUST contain the digest of the uncompressed layer | |||
| - `config.sha` MUST the digest of the uncompressed layer containing launcher config | |||
| - `launcher.sha` MUST the digest of the uncompressed layer containing the launcher binary | |||
| - `bom.sha` MUST contain the digest of the uncompressed layer containing buildpack-provided standardized Bill of Materials | |||
There was a problem hiding this comment.
Are we keeping this in lifecycle metadata or moving it to its own key?
There was a problem hiding this comment.
Per sub sync discussion, we plan to leave the sha in lifecycle metadata for now. In the future, we may duplicate this information in a new label.
Also clarify that `bom` usage is for legacy buildpacks Signed-off-by: Natalie Arellano <narellano@vmware.com>
Signed-off-by: Natalie Arellano <narellano@vmware.com>
natalieparellano
requested review from
jromero,
sambhav,
sclevine,
jkutner and
nebhale
jromero
approved these changes
Nov 10, 2021
aemengo
suggested changes
Nov 11, 2021
Signed-off-by: Natalie Arellano <narellano@vmware.com> Co-authored-by: Anthony Emengo <anthonyemengojr@gmail.com>
Signed-off-by: Natalie Arellano <narellano@vmware.com> Co-authored-by: Anthony Emengo <anthonyemengojr@gmail.com>
sambhav
approved these changes
Nov 16, 2021
jkutner
approved these changes
Nov 17, 2021
sclevine
approved these changes
Nov 17, 2021
nebhale
approved these changes
Nov 18, 2021
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This should be pointed to platform/0.8 but that branch doesn't exist yet...