search

submariner-io / enhancements

Enhancement proposals for Submariner projects.
https://submariner.io/
Apache License 2.0
5 stars 24 forks source link

Publish SBOMs for the artifacts we produce #185

Open skitt opened 1 year ago

skitt commented 1 year ago

What would you like to be added:

Publish SBOMs alongside our release artifacts (container images, subctl binaries etc.).

Why is this needed:

This allows end-users to accurately determine the contents of our release artifacts. It might be possible to use krel to help with this; see this KubeCon presentation for details.

dfarrell07 commented 1 year ago

It looks like the relevant KubeCon recording isn't uploaded yet, but when it is it'll be here: https://www.youtube.com/playlist?list=PLj6h78yzYM2PR4KLskmLmNU20VtEnUMlw

dfarrell07 commented 1 year ago

Newer versions of Buildx have a SBOM feature that looks cool. It seems like it'll capture software used during the build process even if it's not in the final container build, which I don't know how we could achieve otherwise.

https://github.com/docker/buildx/releases/tag/v0.10.0 https://github.com/moby/buildkit/blob/v0.11.0/docs/attestations/sbom.md

It can also create attestations about the build process and environment:

https://github.com/moby/buildkit/blob/v0.11.0/docs/attestations/slsa-provenance.md