buildpacks / libcnb

A non-opinionated language binding for the Cloud Native Buildpack Buildpack and Extension specifications
Apache License 2.0
31 stars 13 forks source link

SBOM validation fails if buildpack API is 0.6 #107

Closed dmikusa closed 2 years ago

dmikusa commented 2 years ago

If you have a buildpack using buildpack API 0.6, libcnb will still perform SBOM validation even though that is a feature of buildpack API 0.7. This causes a problem because it expects the a list of supported SBOM media types to be present in buildpack.toml, but that is specific to API 0.7 so buildpacks with API 0.6 won't have it.

I think we need to check the buildpack API before making this call.

Thoughts?