Stack BOM

[sophiewigmore]

Summary

First pass at https://github.com/paketo-buildpacks/rfcs/pull/125

Notes: This PR does not exactly conform to the RFC. It has some additions that are being considered in the upstream CNB RFC, which have not yet been decided on. This implementation could be subject to change. Notable features of this implementation include:

• The BOM files are named <first 8 characters of the original image digest>.<ext>.json rather than bom.<syft>.json
• The Syft scan generates a Squashed output right now, rather than the alternative All Layers option. This decision is not discussed in any RFC that I am aware of right now.
• The version of Syft library used (v0.30.1) generates CycloneDX XML schema 1.2. Because of that, github.com/CycloneDX/cyclonedx-go is pinned to a version (v0.3.0) that includes schema 1.2 support.
  • Schema 1.3 is specified in the RFC
  • Newer versions of Syft may include schema 1.3, so we should keep an eye out
  • There is currently an open PR on Syft that adds support for CycloneDX JSON, if implemented, XML to JSON conversion logic can be removed.

How To Use

1. go build the create-stack binary by running cd create-stack && go build .
2. run ./create-stack --build-destination <build image name> --run-destination <run image name> --version <some version> --stack <tiny, base, or full> --stacks-dir $PWD/.. This step will take a few minutes to run.
3. Resulting images will appear on the docker daemon:
   • <build image name>:<version>
   • <build image name>:<version>-cnb
   • <run image name>:<version>
   • <run image name>:<version>-cnb
4. The <run image name>:<version>-cnb contains the BOM files. Check it out by:
   • docker inspect <run image name>:<version>-cnb | jq -r '.[0].Config.Labels."io.buildpacks.base.sbom"' to see the newly added label. The value is the SHA256 of the newly added layer that contains the BOM entries.
   • docker inspect <run image name>:<version>-cnb | jq -r '.[0].RootFS.Layers' to see that this layer exists
   • To actually see the content of the BOM files, you will have to copy the files out of the container, since we do not have root privileges to view the files in the container. This can be achieved by running docker run -it <run image name>:<version>-cnb, and then in a separate tab, run docker cp <container ID>:/cnb/sbom <output dir>. Inside will be two files, a CycloneDX BOM and and a Syft BOM.

Checklist

• [X] I have viewed, signed, and submitted the Contributor License Agreement.
• [X] I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• [X] I have added an integration test, if necessary.
• [X] I have reviewed the styleguide for guidance on my code quality.
• [X] I'm happy with the commit history on this PR (I have rebased/squashed as needed).

[ryanmoran]

@sophiewigmore I think you could test Attach with something like the following as a skeleton:

    context("Attach", func() {
        var (
            bom          stack.BOM
            dockerClient *client.Client
        )

        it.Before(func() {
            var err error
            dockerClient, err = client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
            Expect(err).NotTo(HaveOccurred())

            ctx := gocontext.Background()

            logs, err := dockerClient.ImagePull(ctx, "alpine:latest", types.ImagePullOptions{})
            Expect(err).NotTo(HaveOccurred())
            defer logs.Close()

            // NOTE: required to force a wait for the image to pull
            _, err = io.Copy(io.Discard, logs)
            Expect(err).NotTo(HaveOccurred())
        })

        it.After(func() {
            _, err := dockerClient.ImageRemove(gocontext.Background(), "alpine:latest", types.ImageRemoveOptions{Force: true})
            Expect(err).NotTo(HaveOccurred())
        })

        it("attaches the BOM layer to the image", func() {
            err := bom.Attach("alpine:latest", []string{syftFile, cdxFile})
            Expect(err).NotTo(HaveOccurred())

            // You can then use the `daemon` package to fetch the image and take a look to confirm that the labels and layers are there.
        })
    })

[ryanmoran]

The feature is now hidden behind a feature flag. You can enable it by running the create-stack command while setting the EXPERIMENTAL_ATTACH_RUN_IMAGE_SBOM environment variable to true.

[sophiewigmore]

@ryanmoran your changes look good to me!

[sophiewigmore]

When the flag isn't set, is it confirmed the produced run image doesn't have the BOM/looks as expected?

[ryanmoran]

I've updated one of the acceptance tests, for base, to build without the flag and asserted that the SBOM does not appear.