Repository navigation
feat(stack): attach package receipts to images as SBOM attestations - #1470
Open
anthonydahanne wants to merge 1 commit into
Open
anthonydahanne wants to merge 1 commit into
anthonydahanne wants to merge 1 commit into
Conversation
Each stack image gets a CycloneDX receipt per architecture, but it is only published as a GitHub release asset: nothing ties it to the image in the registry. The push workflow now downloads the receipts of the release, and publish.sh hands the ones of each image to `jam publish-image --sbom`, which adds them to the image index. It finds them by name, which is why the image archive keeps the name of its release asset. With a jam that has no --sbom, or when a receipt is missing, the image is published without SBOM. The copy pushed to GCR is rebuilt from the Docker Hub image and does not get the attestations. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Each stack image gets a CycloneDX package receipt per architecture, but it is only published as a GitHub release asset. Nothing ties it to the image in the registry. The push workflow now hands the receipts of each image to
jam publish-image --sbom, which stores them in the image index.What
stack/scripts/publish.shfinds the receipts of an image by the name of its archive, so the workflow keeps the release asset name instead ofsaved_image.oci.--sbom, or when a receipt is missing, the image is still published, without SBOM.ubuntu-noble-run-tiny0.0.157 release files; the workflow change itself has only been checked as valid YAML.Merge order
--sbom, then needs a releasestack/scripts/.util/tools.jsonbumped to that release