search

chainguard-dev / apko

Build OCI images from APK packages directly without Dockerfile
https://apko.dev
Apache License 2.0
1.18k stars 117 forks source link

Surface SBOMs from /var/lib/db/sbom #308

Closed jdolitsky closed 1 year ago

jdolitsky commented 2 years ago

After building the image filesystem, scan the /var/lib/db/sbom directory looking for files in the form:

These files should be included during a melange build of APK with name $package.

The package data from these should be included in the final SBOM(s), noting the APK which it derives from.

amouat commented 2 years ago

Upped this to P1 as I think it would give us a strong sell in demos if our SBOMs are bomb. For the moment at least it will be a USP.

luhring commented 1 year ago

Closed by https://github.com/chainguard-dev/apko/pull/309 (thanks @puerco!)