diff --git a/task/buildah/0.2/buildah.yaml b/task/buildah/0.2/buildah.yaml index 35af0fde84..d9e8a83a8d 100644 --- a/task/buildah/0.2/buildah.yaml +++ b/task/buildah/0.2/buildah.yaml @@ -450,16 +450,46 @@ spec: unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command" container=$(buildah from --pull-never "$IMAGE") - buildah mount $container | tee /shared/container_path - # delete symlinks - they may point outside the container rootfs, messing with SBOM scanners - find $(cat /shared/container_path) -xtype l -delete - echo $container > /shared/container_name # Save the SBOM produced by Cachi2 so it can be merged into the final SBOM later if [ -f "/tmp/cachi2/output/bom.json" ]; then cp /tmp/cachi2/output/bom.json ./sbom-cachi2.json + + # Inject a content sets file for backwards compatibility + # This is only possible for images built hermetically with prefetch + base_image_name=$(buildah inspect --format '{{ index .ImageAnnotations "org.opencontainers.image.base.name"}}' $IMAGE | cut -f1 -d'@') + base_image_digest=$(buildah inspect --format '{{ index .ImageAnnotations "org.opencontainers.image.base.digest"}}' $IMAGE) + read -r -d '' CONTENT_SETS_JSON < content-sets.json + buildah copy $container content-sets.json /root/buildinfo/content_manifests/ + buildah config -a org.opencontainers.image.base.name=${base_image_name} -a org.opencontainers.image.base.digest=${base_image_digest} $container + + BUILDAH_ARGS=() + if [ "${SQUASH}" == "true" ]; then + BUILDAH_ARGS+=("--squash") + fi + + buildah commit "${BUILDAH_ARGS[@]}" $container $IMAGE + # End content sets backwards compatibility fi + buildah mount $container | tee /shared/container_path + # delete symlinks - they may point outside the container rootfs, messing with SBOM scanners + find $(cat /shared/container_path) -xtype l -delete + echo $container > /shared/container_name + touch /shared/base_images_digests for image in $BASE_IMAGES; do base_image_digest=$(buildah images --format '{{ .Name }}:{{ .Tag }}@{{ .Digest }}' --filter reference="$image")