-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #181 from Allda/ISV-5411
Add a script for sbom enrichment
- Loading branch information
Showing
8 changed files
with
862 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
144 changes: 144 additions & 0 deletions
144
sbom-utility-scripts/scripts/add-image-reference-script/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| # Add image reference script | ||
|
|
||
| The script aims to enrich the SBOM file with additional information about the output image used in the build process. | ||
| Based on a input SBOM type, the script updates certain fields with the image reference information. This is needed | ||
| to provide a complete SBOM file that can be used for further analysis. | ||
|
|
||
| ## Usage | ||
|
|
||
| ```bash | ||
| python add_image_reference.py \ | ||
| --input-file ./input-sbom.json \ | ||
| --output-file ./updated-sbom.json \ | ||
| --image-url quay.io/foo/bar/ubi8:1.1 \ | ||
| --image-digest sha256:011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc | ||
| ``` | ||
| The script stores the updated SBOM in the output path provided. | ||
|
|
||
| ## List of updates | ||
| ### SPDX | ||
| The script updates the following fields in the SPDX SBOM:SHA256 | ||
| - `packages` - the script adds a new package with the image reference information | ||
| - `relationships` - the script adds a new relationship between the package and the image reference | ||
| - `name` - the script adds the image reference as a name | ||
|
|
||
| The logic of adding new packages and updating replationships is visualized in the following diagram: | ||
| ``` | ||
| example SPDX SBOM: | ||
| ROOT | ||
| / \ | ||
| / \ | ||
| DESCRIBES DESCRIBES | ||
| / \ | ||
| / \ | ||
| <pip main package> <npm main package> | ||
| | | | ||
| | | | ||
| CONTAINS CONTAINS | ||
| | | | ||
| | | | ||
| <pip deps> <npm deps> | ||
| SBOM after enrichment: | ||
| ROOT | ||
| | | ||
| | | ||
| DESCRIBES | ||
| | | ||
| | | ||
| <container> | ||
| / \ | ||
| / \ | ||
| CONTAINS CONTAINS | ||
| / \ | ||
| / \ | ||
| <pip main package> <npm main package> | ||
| | | | ||
| | | | ||
| CONTAINS CONTAINS | ||
| | | | ||
| | | | ||
| <pip deps> <npm deps> | ||
| ``` | ||
|
|
||
| #### Example | ||
| ```json | ||
| { | ||
| "name": "quay.io/foo/bar/ubi8@sha256:011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc", | ||
| "packages": [ | ||
| { | ||
| "SPDXID": "SPDXRef-image", | ||
| "name": "ubi8", | ||
| "versionInfo": "1.1", | ||
| "downloadLocation": "NOASSERTION", | ||
| "licenseConcluded": "NOASSERTION", | ||
| "supplier": "NOASSERTION", | ||
| "externalRefs": [ | ||
| { | ||
| "referenceLocator": "pkg:oci/ubi8@sha256:011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc?repository_url=quay.io/foo/bar/ubi8", | ||
| "referenceType": "purl", | ||
| "referenceCategory": "PACKAGE-MANAGER" | ||
| } | ||
| ], | ||
| "checksums": [ | ||
| { | ||
| "algorithm": "SHA256", | ||
| "checksumValue": "011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc" | ||
| } | ||
| ] | ||
| }, | ||
| ], | ||
| "relationships": [ | ||
| { | ||
| "spdxElementId": "SPDXRef-DOCUMENT", | ||
| "relationshipType": "DESCRIBES", | ||
| "relatedSpdxElement": "SPDXRef-image" | ||
| }, | ||
| ] | ||
| } | ||
|
|
||
| ``` | ||
|
|
||
| ### CycloneDX | ||
| - `components` - the script adds a new component with the image reference information | ||
| - `metadata.component` - the script adds the image reference as a metadata.component | ||
|
|
||
| #### Example | ||
| ```json | ||
| { | ||
| "metadata": { | ||
| "component": { | ||
| "type": "container", | ||
| "name": "ubi8", | ||
| "purl": "pkg:oci/ubi8@sha256:011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc?repository_url=quay.io/foo/bar/ubi8", | ||
| "version": "1.1", | ||
| "publisher": "Red Hat, Inc.", | ||
| "hashes": [ | ||
| { | ||
| "alg": "SHA-256", | ||
| "content": "011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc" | ||
| } | ||
| ] | ||
| }, | ||
| }, | ||
| "components": [ | ||
| { | ||
| "type": "container", | ||
| "name": "ubi8", | ||
| "purl": "pkg:oci/ubi8@sha256:011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc?repository_url=quay.io/foo/bar/ubi8", | ||
| "version": "1.1", | ||
| "publisher": "Red Hat, Inc.", | ||
| "hashes": [ | ||
| { | ||
| "alg": "SHA-256", | ||
| "content": "011ff0cd8f34588d3eca86da97619f7baf99c8cc12e24cc3a7f337873c8d36cc" | ||
| } | ||
| ] | ||
| }, | ||
| ] | ||
| } | ||
| ``` |
Oops, something went wrong.