Add image reference to SBOM #1629

Allda · 2024-11-20T15:25:45Z

The SBOM generated by the buildah task now contains the reference to the image itself. The new script supports both spdx and cyclonedx format.

In order to inject the image reference to the SBOM steps were rearanged to push first and then generate SBOM. The code that stored the sbom into image itself was removed as not used anymore.

JIRA: ISV-5411

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

Allda · 2024-11-21T13:23:52Z

The build task with new changes has been tested as part of this pipelinerun https://github.com/Allda/devfile-sample-python-basic/pull/16/checks?check_run_id=33323099120

Allda · 2024-11-25T09:46:35Z

@brunoapimentel @rcerven Can you guys please review this PR. Thanks

tnevrlka · 2024-11-26T09:18:48Z

/ok-to-test

chmeliik

Could you split this into two commits?

Stop injecting SBOM into image
Add image reference to SBOM

The first change has potential consequences, it shouldn't be "hidden" in a commit that does something else

Allda · 2024-11-26T10:09:13Z

Could you split this into two commits?
* Stop injecting SBOM into image

* Add image reference to SBOM
The first change has potential consequences, it shouldn't be "hidden" in a commit that does something else

I split the change into 2 commits as suggested.

task/buildah-oci-ta/0.2/buildah-oci-ta.yaml

chmeliik · 2024-11-26T13:45:45Z

/ok-to-test

chmeliik · 2024-11-26T14:10:00Z

/retest

chmeliik · 2024-11-26T14:48:33Z

tkn pr -n konflux-ci logs build-definitions-pull-request-nw6ql

[e2e-tests : e2e-test]   [FAILED] in [It] - /konflux-e2e/tests/build/build_templates.go:602 @ 11/26/24 14:28:35.951
[e2e-tests : e2e-test] • [FAILED] [4.849 seconds]
[e2e-tests : e2e-test] [build-service-suite Build templates E2E test] HACBS pipelines when the container image for component with Git source URL https://github.com/konflux-qe-bd/retrodep is created and pushed to container registry [It] contains non-empty sbom files [build, build-templates, HACBS, pipeline, sbom, slow, build-templates-e2e]
[e2e-tests : e2e-test] /konflux-e2e/tests/build/build_templates.go:600
[e2e-tests : e2e-test] 
[e2e-tests : e2e-test]   [FAILED] Unexpected error:
[e2e-tests : e2e-test]       <*errors.errorString | 0xc00171a0f0>: 
[e2e-tests : e2e-test]       failed to get sbom purl content: sbom file not found in path /tmp/eimage3422397966/root/buildinfo/content_manifests/sbom-purl.json
[e2e-tests : e2e-test]       {
[e2e-tests : e2e-test]           s: "failed to get sbom purl content: sbom file not found in path /tmp/eimage3422397966/root/buildinfo/content_manifests/sbom-purl.json",
[e2e-tests : e2e-test]       }
[e2e-tests : e2e-test]   occurred
[e2e-tests : e2e-test]   In [It] at: /konflux-e2e/tests/build/build_templates.go:602 @ 11/26/24 14:28:35.951

Looks like this will need a corresponding change in https://github.com/konflux-ci/e2e-tests

Allda · 2024-11-26T15:37:39Z

tkn pr -n konflux-ci logs build-definitions-pull-request-nw6ql

[e2e-tests : e2e-test]   [FAILED] in [It] - /konflux-e2e/tests/build/build_templates.go:602 @ 11/26/24 14:28:35.951
[e2e-tests : e2e-test] • [FAILED] [4.849 seconds]
[e2e-tests : e2e-test] [build-service-suite Build templates E2E test] HACBS pipelines when the container image for component with Git source URL https://github.com/konflux-qe-bd/retrodep is created and pushed to container registry [It] contains non-empty sbom files [build, build-templates, HACBS, pipeline, sbom, slow, build-templates-e2e]
[e2e-tests : e2e-test] /konflux-e2e/tests/build/build_templates.go:600
[e2e-tests : e2e-test] 
[e2e-tests : e2e-test]   [FAILED] Unexpected error:
[e2e-tests : e2e-test]       <*errors.errorString | 0xc00171a0f0>: 
[e2e-tests : e2e-test]       failed to get sbom purl content: sbom file not found in path /tmp/eimage3422397966/root/buildinfo/content_manifests/sbom-purl.json
[e2e-tests : e2e-test]       {
[e2e-tests : e2e-test]           s: "failed to get sbom purl content: sbom file not found in path /tmp/eimage3422397966/root/buildinfo/content_manifests/sbom-purl.json",
[e2e-tests : e2e-test]       }
[e2e-tests : e2e-test]   occurred
[e2e-tests : e2e-test]   In [It] at: /konflux-e2e/tests/build/build_templates.go:602 @ 11/26/24 14:28:35.951

Looks like this will need a corresponding change in https://github.com/konflux-ci/e2e-tests

I am not familiar with the e2e code base and I did just a quick check. Is this the place that needs to be remove?
https://github.com/konflux-ci/e2e-tests/blob/main/tests/build/build_templates.go#L600

chmeliik · 2024-11-26T16:19:57Z

I am not familiar with the e2e code base and I did just a quick check. Is this the place that needs to be remove? https://github.com/konflux-ci/e2e-tests/blob/main/tests/build/build_templates.go#L600

Me neither 😅 but yes, I think that's the place

Allda · 2024-11-26T16:31:22Z

I am not familiar with the e2e code base and I did just a quick check. Is this the place that needs to be remove? https://github.com/konflux-ci/e2e-tests/blob/main/tests/build/build_templates.go#L600

Me neither 😅 but yes, I think that's the place

I opened a PR there with the change. Once the CI passes please review konflux-ci/e2e-tests#1465

chmeliik

file not found in path /tmp/eimage3422397966/root/buildinfo/content_manifests/sbom-purl.json

This made me realize we can also delete the code that creates sbom-purl.json. I believe that the file isn't used for anything anymore

Allda · 2024-11-28T08:46:25Z

/retest

Allda · 2024-11-28T09:17:35Z

/retest

Allda · 2024-11-28T10:38:44Z

@chmeliik The e2e test is green now. Can you do a last round of review and merge if all looks good? Thanks

Allda · 2024-11-29T09:35:05Z

@chmeliik I also removed the purl script from the tekton task and here is another PR that removes the script itself konflux-ci/build-tasks-dockerfiles#193

chmeliik

LGTM. We can keep the version bump after all, it doesn't really hurt anything. Thanks for adding the "changelog" to the README

Allda · 2024-11-29T09:51:11Z

LGTM. We can keep the version bump after all, it doesn't really hurt anything. Thanks for adding the "changelog" to the README

So do you want to bump a patch version to 0.2.1?

EDIT: Never mind.. I didn't realize I never reverted it back to 0.2

Allda · 2024-11-29T09:52:55Z

/retest

Allda · 2024-11-29T10:52:16Z

/retest

Allda · 2024-11-29T11:59:44Z

/retest

The SBOM was stored into a container image as part of a build step. This feature is however obsolete and not needed anymore. From now on a containers won't have an SBOM stored inside of /root/buildinfo/content_manifests/ directory. JIRA: ISV-5411 Signed-off-by: Ales Raszka <[email protected]>

The SBOM generated by the buildah task now contains the reference to the image itself. The new script supports both spdx and cyclonedx format. JIRA: ISV-5411 Signed-off-by: Ales Raszka <[email protected]>

The script is no longer needed since we don't use its output anymore. Signed-off-by: Ales Raszka <[email protected]>

openshift-ci bot requested review from brunoapimentel and rcerven November 20, 2024 15:25

Allda marked this pull request as draft November 20, 2024 15:28

Allda force-pushed the ISV-5411 branch 2 times, most recently from 37483c9 to 26ec0e3 Compare November 21, 2024 13:20

Allda changed the title ~~[WiP]Add image reference to SBOM~~ Add image reference to SBOM Nov 21, 2024

Allda marked this pull request as ready for review November 21, 2024 13:21

Allda force-pushed the ISV-5411 branch from 26ec0e3 to bde32c2 Compare November 21, 2024 14:31

rcerven removed request for brunoapimentel and rcerven November 25, 2024 19:40

Allda force-pushed the ISV-5411 branch from bde32c2 to d238a26 Compare November 26, 2024 08:02

chmeliik reviewed Nov 26, 2024

View reviewed changes

Allda force-pushed the ISV-5411 branch from d238a26 to bb0bccf Compare November 26, 2024 10:06

chmeliik reviewed Nov 26, 2024

View reviewed changes

task/buildah-oci-ta/0.2/buildah-oci-ta.yaml Outdated Show resolved Hide resolved

task/buildah-oci-ta/0.2/buildah-oci-ta.yaml Show resolved Hide resolved

task/buildah-oci-ta/0.2/buildah-oci-ta.yaml Show resolved Hide resolved

Allda force-pushed the ISV-5411 branch from bb0bccf to 4e156d9 Compare November 26, 2024 13:04

Allda mentioned this pull request Nov 26, 2024

test: remove SBOM test konflux-ci/e2e-tests#1465

Merged

9 tasks

chmeliik reviewed Nov 27, 2024

View reviewed changes

tisutisu force-pushed the ISV-5411 branch from 4e156d9 to e607cc2 Compare November 28, 2024 10:07

Allda force-pushed the ISV-5411 branch 2 times, most recently from 6c56baf to 39d172c Compare November 29, 2024 09:34

chmeliik approved these changes Nov 29, 2024

View reviewed changes

chmeliik mentioned this pull request Nov 29, 2024

Remove unused create_purl_sbom.py script konflux-ci/build-tasks-dockerfiles#193

Merged

Allda added 3 commits November 29, 2024 13:13

Add image reference to SBOM

150e18a

The SBOM generated by the buildah task now contains the reference to the image itself. The new script supports both spdx and cyclonedx format. JIRA: ISV-5411 Signed-off-by: Ales Raszka <[email protected]>

Remove create_purl_sbom.py from buildah

a0d869a

The script is no longer needed since we don't use its output anymore. Signed-off-by: Ales Raszka <[email protected]>

Allda force-pushed the ISV-5411 branch from 39d172c to a0d869a Compare November 29, 2024 12:14

chmeliik added this pull request to the merge queue Nov 29, 2024

Merged via the queue into konflux-ci:main with commit 4ccd3a6 Nov 29, 2024
15 checks passed

rh-tap-build-team bot mentioned this pull request Nov 29, 2024

build-definitions update redhat-appstudio/infra-deployments#4994

Closed

tisutisu mentioned this pull request Dec 2, 2024

fix: adjust the cpu/mem values as per the step changed #1675

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add image reference to SBOM #1629

Add image reference to SBOM #1629

Allda commented Nov 20, 2024 •

edited by openshift-ci bot

Loading

Allda commented Nov 21, 2024

Allda commented Nov 25, 2024

tnevrlka commented Nov 26, 2024

chmeliik left a comment

Allda commented Nov 26, 2024

chmeliik commented Nov 26, 2024

chmeliik commented Nov 26, 2024

chmeliik commented Nov 26, 2024

Allda commented Nov 26, 2024

chmeliik commented Nov 26, 2024

Allda commented Nov 26, 2024

chmeliik left a comment

Allda commented Nov 28, 2024

Allda commented Nov 28, 2024

Allda commented Nov 28, 2024

Allda commented Nov 29, 2024 •

edited

Loading

chmeliik left a comment

Allda commented Nov 29, 2024 •

edited

Loading

Allda commented Nov 29, 2024

Allda commented Nov 29, 2024

Allda commented Nov 29, 2024

Add image reference to SBOM #1629

Add image reference to SBOM #1629

Conversation

Allda commented Nov 20, 2024 • edited by openshift-ci bot Loading

Before you complete this pull request ...

Allda commented Nov 21, 2024

Allda commented Nov 25, 2024

tnevrlka commented Nov 26, 2024

chmeliik left a comment

Choose a reason for hiding this comment

Allda commented Nov 26, 2024

chmeliik commented Nov 26, 2024

chmeliik commented Nov 26, 2024

chmeliik commented Nov 26, 2024

Allda commented Nov 26, 2024

chmeliik commented Nov 26, 2024

Allda commented Nov 26, 2024

chmeliik left a comment

Choose a reason for hiding this comment

Allda commented Nov 28, 2024

Allda commented Nov 28, 2024

Allda commented Nov 28, 2024

Allda commented Nov 29, 2024 • edited Loading

chmeliik left a comment

Choose a reason for hiding this comment

Allda commented Nov 29, 2024 • edited Loading

Allda commented Nov 29, 2024

Allda commented Nov 29, 2024

Allda commented Nov 29, 2024

Allda commented Nov 20, 2024 •

edited by openshift-ci bot

Loading

Allda commented Nov 29, 2024 •

edited

Loading

Allda commented Nov 29, 2024 •

edited

Loading