Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Platform support for sBOM #268

Merged
merged 10 commits into from
Nov 18, 2021
Merged

Platform support for sBOM #268

Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
7078e56
Platform support for sBOM
natalieparellano Nov 3, 2021
7d5d953
Add more detail
natalieparellano Nov 3, 2021
9180211
Fix
natalieparellano Nov 3, 2021
4f6a803
Add bom.sha to where
natalieparellano Nov 10, 2021
6efa274
Replace sBOM -> BOM to avoid confusion
natalieparellano Nov 10, 2021
0e69465
Use SBOM everywhere
natalieparellano Nov 10, 2021
cf67713
Clarify that sbom files MUST be included only if they are present
natalieparellano Nov 10, 2021
44173d4
Fix
natalieparellano Nov 10, 2021
aaa04ac
Update platform.md
natalieparellano Nov 16, 2021
50bb6cd
Update platform.md
natalieparellano Nov 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 26 additions & 11 deletions platform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,14 +421,15 @@ Usage:
| `<skip-layers>`| `CNB_SKIP_LAYERS` | `false` | Do not perform [layer restoration]((#layer-restoration)

##### Outputs
| Output | Description
|---------------------------------------|----------------------------------------------
| [exit status] | (see Exit Code table below for values)
| `/dev/stdout` | Logs (info)
| `/dev/stderr` | Logs (warnings, errors)
| `<layers>/<buidpack-id>/store.toml` | Persistent metadata (see data format in [Buildpack Interface Specification](buildpack.md))
| `<layers>/<buidpack-id>/<layer>.toml` | Files containing the layer content metadata of each analyzed layer (see data format in [Buildpack Interface Specification](buildpack.md))
| `<layers>/<buidpack-id>/<layer>/*`. | Restored layer contents
| Output | Description
|--------------------------------------------|----------------------------------------------
| [exit status] | (see Exit Code table below for values)
| `/dev/stdout` | Logs (info)
| `/dev/stderr` | Logs (warnings, errors)
| `<layers>/<buidpack-id>/store.toml` | Persistent metadata (see data format in [Buildpack Interface Specification](buildpack.md))
| `<layers>/<buidpack-id>/<layer>.toml` | Files containing the layer content metadata of each analyzed layer (see data format in [Buildpack Interface Specification](buildpack.md))
| `<layers>/<buidpack-id>/<layer>.bom.<ext>` | Files containing the standardized Bill of Materials for each analyzed layer (see [Buildpack Interface Specification](buildpack.md))
| `<layers>/<buidpack-id>/<layer>/*`. | Restored layer contents
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved

| Exit Code | Result|
|-----------|-------|
Expand Down Expand Up @@ -566,6 +567,10 @@ Usage:
- All run-image layers SHALL be preserved
- All run-image config values SHALL be preserved unless this conflicts with another requirement
- MUST contain all buildpack-provided launch layers as determined by the [Buildpack Interface Specfication](buildpack.md)
- MUST contain a layer containing all buildpack-provided standardized Bill of Materials (sBOM) files for `launch` as determined by the [Buildpack Interface Specfication](buildpack.md)
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved
- `<layers>/sbom/<buildpack-id>/launch.bom.<ext>` MUST contain the buildpack-provided `launch` sBOM
- `<layers>/sbom/<buildpack-id>/<layer-id>/launch.bom.<ext>` MUST contain the buildpack-provided layer sBOM if `<layer-id>` is a `launch` layer
- A merged sBOM MAY be included in the layer at `<layers>/sbom/launch.bom.<ext>`
- MUST contain one or more app layers as determined by the [Buildpack Interface Specfication](buildpack.md)
- MUST contain one or more launcher layers that include:
- A file with the contents of the `<launcher>` file at path `/cnb/lifecycle/launcher`
Expand Down Expand Up @@ -594,8 +599,14 @@ Usage:

- The lifecycle SHALL write a [report](#reporttoml-toml) to `<report>` describing the exported app image

- The `<layers>` directory:
- MUST include all buildpack-provided standardized Bill of Materials (sBOM) files for `build` as determined by the [Buildpack Interface Specfication](buildpack.md)
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved
- `<layers>/sbom/<buildpack-id>/build.bom.<ext>` MUST contain the buildpack-provided `build` sBOM
- `<layers>/sbom/<buildpack-id>/<layer-id>/build.bom.<ext>` MUST contain the buildpack-provided layer sBOM if `<layer-id>` is not a `launch` layer
- A merged sBOM MAY be included in the directory at `<layers>/sbom/build.bom.<ext>`

- *If* a cache is provided the lifecycle:
- SHALL write the contents of all cached layers to the cache
- SHALL write the contents of all cached layers and any provided sBOM files to the cache
- SHALL record the diffID and layer content metadata of all cached layers in the cache

#### `creator`
Expand Down Expand Up @@ -1088,6 +1099,9 @@ Where:
"app": [
{"sha": "<slice-layer-diffID>"}
],
"bom": {
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved
"sha": "<sbom-layer-diffID>"
natalieparellano marked this conversation as resolved.
Show resolved Hide resolved
},
"config": {
"sha": "<config-layer-diffID>"
},
Expand Down Expand Up @@ -1123,8 +1137,9 @@ Where:
Where:
- `app` MUST contain one entry per app slice layer where
- `sha` MUST contain the digest of the uncompressed layer
- `config.sha` MUST the digest of the uncompressed layer containing launcher config
- `launcher.sha` MUST the digest of the uncompressed layer containing the launcher binary
- `bom.sha` MUST contain the digest of the uncompressed layer containing buildpack-provided standardized Bill of Materials
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we keeping this in lifecycle metadata or moving it to its own key?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per sub sync discussion, we plan to leave the sha in lifecycle metadata for now. In the future, we may duplicate this information in a new label.

- `config.sha` MUST contain the digest of the uncompressed layer containing launcher config
- `launcher.sha` MUST contain the digest of the uncompressed layer containing the launcher binary
- `buildpacks` MUST contain one entry per buildpack that participated in the build where
- `key` is required and MUST contain the buildpack ID
- `version` is required and MUST contain the buidpack Version
Expand Down