fix(KFLUXBUGS-1152): add support for multi-arch #871

scoheb · 2024-03-12T12:50:18Z

if IMAGE_URL is a multi-arch one, print out sbom
for each arch present

arewm

LGTM, thanks.

arewm · 2024-03-12T13:34:59Z

/retest-required

chmeliik · 2024-03-12T14:51:32Z

Similar: #873

^ is possibly a more generic change?

ralphbean · 2024-03-12T15:16:11Z

I started something similar in 95c15a7. A difference is that it would print all of the sboms, one for each arch, if an image index was detected. I didn't get a chance to test it yet though. I got hung up when I realized that the existing image for the task contains only cosign, and doesn't contain skopeo. At that point I backed out and tried #873

If you see a way to easily get skopeo and cosign both in the image here, I think the dynamic approach here is better than #873. If we do go ahead with this, consider pulling in the looping idea from 95c15a7 instead of assuming that amd64 is the only arch the user cares about.

ralphbean · 2024-03-12T15:19:53Z

Note, the other architectures are actually important. For the bootc images, for instance, we expect the sbom content to differ between the different arches - and those differences will be important for some users to know.

For example, try one of the centos-bootc images: quay.io/redhat-user-workloads/centos-bootc-tenant/centos-bootc/centos-bootc. Download the sbom twice, once with --platform linux/amd64 and once with --platform linux/arm64. Note the grub2-pc package in the diff between those SBOMs.

scoheb · 2024-03-14T23:08:37Z

updated PR to use different task image that includes skopeo and included looping over all the arches present.

arewm · 2024-03-15T00:42:30Z

task/show-sbom/0.1/show-sbom.yaml

+        for arch in $ARCHES; do
+          echo ""
+          echo "Arch: $arch"
+          echo ""
+          download_sbom_with_retry " --platform=linux/$arch "
+        done


Since this is just a task to show the summary in the console, I don't know if users would get any value iterating through all of the arches and showing all SBOMs. I wouldn't expect this to be a primary means to see the information. Instead, this might decrease the utility as it just increases the size of the logs.

See @ralphbean 's comment:

#871 (comment)

Yes, the SBOM content is important, but I don't know if it is important in this context. This Tekton task is just an "quick method" to show users what is in the builds. I posit that if users want to see detailed information then they will likely try to either access it locally where they can target specific architectures or they will upload the SBOMs to some tool like guac.sh.

I started this conversation with @ralphbean in #873 (review) but it wasn't resolved before that PR was closed.

scoheb · 2024-03-15T01:07:59Z

so we remove the task from the pipeline? I am not familiar with the history of why this task was needed in the first place.

arewm · 2024-03-15T20:12:55Z

@ralphbean and I chatted again. We agree that it would make sense to use a solution like #873 where we default to amd64 by default. This would prevent e2e tests from breaking as you observed in this PR and it would allow users to show specific architecture's SBOMs on their own if they are interested in it.

scoheb · 2024-03-15T20:14:53Z

That's what I was thinking too. Although we still have to detect if it is a multi-arch image because you cannot specify a platform for a single Arch image with cosign.

scoheb · 2024-03-15T22:26:21Z

@arewm @ralphbean please review

ralphbean · 2024-03-15T23:08:53Z

task/show-sbom/0.1/show-sbom.yaml

+      echo "Inspecting image ${IMAGE_URL}"
+


Does this need to be dropped so as not to break the e2e-tests and other sensitive parsers who are expecting only JSON here?

true! dropped.

ralphbean · 2024-03-15T23:13:39Z

task/show-sbom/0.1/show-sbom.yaml

+        if [ -z "${PLATFORM}" ]; then
+          PLATFORM="amd64"
+        fi
+        download_sbom_with_retry " --platform=linux/$PLATFORM "


Let's not hardcode the "linux/" prefix here to make the task more generic. Let PLATFORM be exactly whatever the user specifies and modify the documentation to tell users to set it to "linux/amd64" if they want amd64.

Note, there are actually non-linux containers like mcr.microsoft.com/windows/servercore:ltsc2022.

updated to be more flexible.

ralphbean · 2024-03-15T23:14:49Z

task/show-sbom/0.1/README.md

+| name      | description                                                                                                                                                                                   | default value | required  |
+|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|-----------|
+| IMAGE_URL | Fully qualified image name to show SBOM for.                                                                                                                                                  |               | true      |
+| PLATFORM  | Specific architecture to display the SBOM for. An example arch would be "amd64". If IMAGE_URL refers to a multi-arch image and this parameter is empty, the task will default to use "amd64". |               | false     |


See comment below - I think this should be updated to expect a string like "linux/amd64" so that we don't box ourselves in.

ralphbean

See inline comments above. Consider changing both the PLATFORM string and the echo statement.

scoheb · 2024-03-16T02:06:11Z

/retest

task/show-sbom/0.1/show-sbom.yaml

arewm · 2024-03-18T14:32:55Z

task/show-sbom/0.1/README.md

+| name      | description                                                                                                                                                                                               | default value | required  |
+|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|-----------|
+| IMAGE_URL | Fully qualified image name to show SBOM for.                                                                                                                                                              |               | true      |
+| PLATFORM  | Specific architecture to display the SBOM for. An example arch would be "linux/amd64". If IMAGE_URL refers to a multi-arch image and this parameter is empty, the task will default to use "linux/amd64". |               | false     |


Nit: The default value is not included in the table column

arewm

Thanks!

tkdchen

LGTM.

A new parameter is added, we need to make a new version with MIGRATION.md for this task.

ralphbean · 2024-03-21T01:09:52Z

/retest

ralphbean · 2024-03-21T01:25:44Z

/retest

- add new parameter called PLATFORM. The user can supply this parameter value if they want to display the sbom for a particular arch in the case of a multi-arch image. - In the case of a single arch image, the parameter is ignored. - if PLATFORM is empty and the image is multi-arch, the task defaults to 'amd64' Signed-off-by: Scott Hebert <[email protected]>

sonarqubecloud · 2024-04-15T13:02:25Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

scoheb · 2024-04-15T15:11:27Z

A new parameter is added, we need to make a new version with MIGRATION.md for this task.

README mentions this: Adding a new parameter with a default value does not require the task version increase

so we should be ok as-is

arewm approved these changes Mar 12, 2024

View reviewed changes

arewm mentioned this pull request Mar 12, 2024

Add platform specificity to the show-sbom task #873

Closed

scoheb force-pushed the KBUGS-1152 branch 2 times, most recently from 5a4f9b9 to 7077a82 Compare March 14, 2024 23:06

scoheb force-pushed the KBUGS-1152 branch 3 times, most recently from 300c4fd to 188f004 Compare March 15, 2024 00:40

arewm reviewed Mar 15, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from 188f004 to 88de9d7 Compare March 15, 2024 00:52

scoheb force-pushed the KBUGS-1152 branch 2 times, most recently from 5da9e4b to 43eb761 Compare March 15, 2024 22:25

scoheb force-pushed the KBUGS-1152 branch from 43eb761 to b519555 Compare March 15, 2024 22:27

ralphbean reviewed Mar 15, 2024

View reviewed changes

ralphbean requested changes Mar 15, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from b519555 to 681a344 Compare March 16, 2024 01:51

arewm reviewed Mar 17, 2024

View reviewed changes

task/show-sbom/0.1/show-sbom.yaml Outdated Show resolved Hide resolved

scoheb force-pushed the KBUGS-1152 branch from 681a344 to e7a437c Compare March 18, 2024 13:03

ralphbean approved these changes Mar 18, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from e7a437c to 2b7348b Compare March 18, 2024 14:25

arewm approved these changes Mar 18, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from 2b7348b to a677bec Compare March 18, 2024 15:25

arewm approved these changes Mar 18, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from a677bec to 7bee017 Compare March 20, 2024 02:30

tkdchen reviewed Mar 20, 2024

View reviewed changes

scoheb force-pushed the KBUGS-1152 branch from 0a4514b to b8d4017 Compare April 15, 2024 13:02

ralphbean added this pull request to the merge queue Apr 15, 2024

Merged via the queue into konflux-ci:main with commit 6172b64 Apr 15, 2024
6 checks passed

rh-tap-build-team bot mentioned this pull request Apr 15, 2024

build-definitions update redhat-appstudio/infra-deployments#3566

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(KFLUXBUGS-1152): add support for multi-arch #871

fix(KFLUXBUGS-1152): add support for multi-arch #871

scoheb commented Mar 12, 2024 •

edited

Loading

arewm left a comment

arewm commented Mar 12, 2024

chmeliik commented Mar 12, 2024 •

edited

Loading

ralphbean commented Mar 12, 2024

ralphbean commented Mar 12, 2024 •

edited

Loading

scoheb commented Mar 14, 2024

arewm Mar 15, 2024

scoheb Mar 15, 2024

arewm Mar 15, 2024

arewm Mar 15, 2024

scoheb commented Mar 15, 2024

arewm commented Mar 15, 2024

scoheb commented Mar 15, 2024

scoheb commented Mar 15, 2024

ralphbean Mar 15, 2024

scoheb Mar 16, 2024

ralphbean Mar 15, 2024

scoheb Mar 16, 2024

ralphbean Mar 15, 2024

scoheb Mar 16, 2024

ralphbean left a comment

scoheb commented Mar 16, 2024

arewm Mar 18, 2024

scoheb Mar 18, 2024

arewm left a comment

tkdchen left a comment

ralphbean commented Mar 21, 2024

ralphbean commented Mar 21, 2024

sonarqubecloud bot commented Apr 15, 2024

scoheb commented Apr 15, 2024

fix(KFLUXBUGS-1152): add support for multi-arch #871

fix(KFLUXBUGS-1152): add support for multi-arch #871

Conversation

scoheb commented Mar 12, 2024 • edited Loading

arewm left a comment

Choose a reason for hiding this comment

arewm commented Mar 12, 2024

chmeliik commented Mar 12, 2024 • edited Loading

ralphbean commented Mar 12, 2024

ralphbean commented Mar 12, 2024 • edited Loading

scoheb commented Mar 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scoheb commented Mar 15, 2024

arewm commented Mar 15, 2024

scoheb commented Mar 15, 2024

scoheb commented Mar 15, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ralphbean left a comment

Choose a reason for hiding this comment

scoheb commented Mar 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

arewm left a comment

Choose a reason for hiding this comment

tkdchen left a comment

Choose a reason for hiding this comment

ralphbean commented Mar 21, 2024

ralphbean commented Mar 21, 2024

sonarqubecloud bot commented Apr 15, 2024

Quality Gate passed

scoheb commented Apr 15, 2024

scoheb commented Mar 12, 2024 •

edited

Loading

chmeliik commented Mar 12, 2024 •

edited

Loading

ralphbean commented Mar 12, 2024 •

edited

Loading