Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build: use docker to generate and attest SBOMs #3387

Closed
wants to merge 5 commits into from
Closed

build: use docker to generate and attest SBOMs #3387

wants to merge 5 commits into from

Conversation

AryanBakliwal
Copy link
Contributor

@AryanBakliwal AryanBakliwal commented Apr 4, 2024 •
edited
Loading

use docker to generate and attest SBOMs

Right now Keptn is using anchore/sbom-action to generate SBOMs for images which generates SBOMs post the build process. This PR adds docker/build-push-action to generate and attest the SBOM during the release pipeline.

Fixes #3309

How to test

  • Manual Test A
  • Unit Test B
  • Integration Test C

Checklist

  • My PR fulfills the Definition of Done of the corresponding issue and not more (or parts if the issue is separated
    into multiple PRs)
  • I used descriptive commit messages to help reviewers understand my thought process
  • I signed off all my commits according to the Developer Certificate of Origin (DCO)
    see Contribution Guide
  • My PR title is formatted according to the semantic PR conventions described in
    the Contribution Guide
  • My code follows the style guidelines of this project (golangci-lint passes, YAMLLint passes)
  • I have performed a self-review of my code
  • My changes result in all-green PR checks (first-time contributors need to ask a maintainer to approve their test runs)
  • New and existing unit and integration tests pass locally with my changes

@AryanBakliwal AryanBakliwal requested a review from a team as a code owner April 4, 2024 10:27
@AryanBakliwal AryanBakliwal changed the title sec: Use Docker to generate and attest SBOMs build: Use Docker to generate and attest SBOMs Apr 4, 2024
@AryanBakliwal AryanBakliwal changed the title build: Use Docker to generate and attest SBOMs build: use docker to generate and attest SBOMs Apr 4, 2024
@odubajDT odubajDT marked this pull request as draft April 4, 2024 10:59
@AryanBakliwal
add change
3a70161 
Signed-off-by: Aryan Bakliwal <[email protected]>
@github-actions github-actions bot added the ops label Apr 4, 2024
@AryanBakliwal AryanBakliwal marked this pull request as ready for review April 4, 2024 11:06
mowies
mowies reviewed Apr 4, 2024
View reviewed changes
Copy link
Member

@mowies mowies left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please test this out in your own fork to showcase that it works.
you will need to adjust the image tags and stuff to point to different registries that you can push to

mowies
mowies reviewed Apr 4, 2024
View reviewed changes
kustomize Outdated Show resolved Hide resolved
@AryanBakliwal
remove file
ce39860 
Signed-off-by: Aryan Bakliwal <[email protected]>
@odubajDT odubajDT marked this pull request as draft April 4, 2024 12:27
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@mowies
Copy link
Member

mowies commented Aug 5, 2024

I think we want to keep our current setup that attaches the sboms to the releases. I will close this PR

@mowies mowies closed this Aug 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mowies mowies mowies left review comments

Assignees
No one assigned
Labels
ops
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Use Docker to generate and attest SBOMs
2 participants
@AryanBakliwal @mowies