Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ensure sbom dir is empty #106

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ensure sbom dir is empty #106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion rhtap/download-sbom-from-url-in-attestation.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,8 @@ find_blob_url() {
end' < "$attestation_file"
}

echo "Making sure $SBOMS_DIR directory exists"
echo "Making sure $SBOMS_DIR directory exists and is empty prior to downloading"
rm -rf "$SBOMS_DIR"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks scary for running the script locally. A dev can have the SBOMS_DIR set to something that they wouldn't want rm -rfed

The init.sh file is not run as part of the gitops pipeline so the SBOM dir was not being reset.

Should we just run the init.sh file for the gitops pipeline?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, if its set wrong (currently env.sh sets to export SBOMS_DIR=results/sboms) and for gitlab to work, its needed to be in results because the results directory gets copied between job steps

When run locally, the directory will be in tmp/reponame/results but if a user sets to ~/save-forever-files then yeah :(

Re: add back the init... Yes. the init script already does an rm -rf results and then checks for all those extra ENV vars for the build pipeline which are extra for the gitops one.
Given we know the env vars for in the pipelines via data.yaml we generate the list of mandatory vars similar to how we check in github actions (which currently checks twice) we could probably generate an ENV var like "REQUIRE_ENVS") and then init checks the ones in that variable.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's okay, though I guess we could do a rm -rf $SBOMS_DIR/*.json or something like that to make it safer. The -o nounset provides some safety here also.

mkdir -p "$SBOMS_DIR"

jq -r '.components[].containerImage' <<< "$IMAGES" | while read -r image; do
Expand Down
Loading