Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump epochs on some packages to rebuild with valid SBOMs #9297

Merged
merged 2 commits into from
Dec 5, 2023

Conversation

imjasonh
Copy link
Member

@imjasonh imjasonh commented Dec 1, 2023

This rebuilds some core packages to pick up melange fixes in chainguard-dev/melange#851

Without this change, when we produce SBOMs for images (by combining each apk's SBOMs), they don't have a supplier/originator, which fails the NTIA conformance checker, which we're starting to roll out here: chainguard-dev/terraform-publisher-apko#25

│ Components missing an supplier:
│ ca-certificates-bundle,wolfi-baselayout,ld-linux,glibc-locale-posix,glibc,libcrypt1,busybox,tzdata

Before this change:

curl -sL https://packages.wolfi.dev/os/aarch64/ca-certificates-bundle-20230506-r0.apk | tar -Oxz var/lib/db/sbom/ca-certificates-bundle-20230506-r0.spdx.json | grep originator

(no matches)

After this change:

tar -Oxf packages/aarch64/ca-certificates-bundle-20230506-r1.apk var/lib/db/sbom/ca-certificates-bundle-20230506-r1.spdx.json | grep -A10 -B11 originator
    {
      "SPDXID": "SPDXRef-Package-ca-certificates-bundle-20230506-r1",
      "name": "ca-certificates-bundle",
      "versionInfo": "20230506-r1",
      "filesAnalyzed": true,
      "hasFiles": [
        "SPDXRef-File--etc-ssl-certs-ca-certificates.crt"
      ],
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "MPL-2.0 AND MIT",
      "downloadLocation": "NOASSERTION",
      "originator": "Organization: WOLFI", <-- heyoo
      "copyrightText": "\n",

DRAFT while we wait for wolfictl updates to hit this repo in #8930, which is blocked on other stuff

@imjasonh imjasonh marked this pull request as ready for review December 5, 2023 00:02
@imjasonh imjasonh enabled auto-merge December 5, 2023 00:02
@imjasonh imjasonh added this pull request to the merge queue Dec 5, 2023
Merged via the queue into wolfi-dev:main with commit 7c5f687 Dec 5, 2023
7 checks passed
@imjasonh imjasonh deleted the bump-rebuild branch December 5, 2023 00:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants