kubernetes-sigs / bom

A utility to generate SPDX-compliant Bill of Materials manifests
https://kubernetes-sigs.github.io/bom/
Apache License 2.0
329 stars 48 forks source link

bom will leave cloned modules in tmp #458

Open puerco opened 1 month ago

puerco commented 1 month ago

What happened:

To generate license and other data, bom clones the go modules it needs to tmp. It is supposed to remove them after it's done. After trying to generate an SBOM for cilium/cilium, my tmp dir was left with 11 GB of files in /tmp/spdx/gomod-scanner/.

What you expected to happen:

Disk space should be reclaimed after generating the SBOM.

How to reproduce it (as minimally and precisely as possible):

Generate an SBOM and check /tmp/spdx/gomod-scanner/