-
Notifications
You must be signed in to change notification settings - Fork 174
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Create SBOMs for images pulled during package creation (#367)
* Create SBOMs for images while creating packages * docs: add adr for sbom capability * Use existing multi-image tars when generating SBOMs during package create * docs: add basic sbom docs * add sbom html viewer generator * Use gotemplate for sbom viewer and make each html file standalone/portable * Add deploy prompt for SBOM Co-authored-by: Jeff McCoy <[email protected]>
- Loading branch information
1 parent
0463f0d
commit 3c6afd5
Showing
16 changed files
with
1,045 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,3 +25,4 @@ terraform.tfstate.backup | |
| .zarf* | ||
| zarf-pki | ||
| .scratch/ | ||
| zarf-sbom/ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # 4. SBOM Generation with Witness | ||
|
|
||
| Date: 2022-03-29 | ||
|
|
||
| ## Status | ||
|
|
||
| Accepted | ||
|
|
||
| ## Context | ||
|
|
||
| SBOM are required for software running on government hardware per EO14028. | ||
|
|
||
| ## Decision | ||
|
|
||
| Using Witness' Syft attestor functionality allows Zarf to continue to get more refined SBOM capabilities as Witness' capabilities expand over time. Syft is capable of finding installed packages and some binaries for statically compiled dependencies over each image within a Zarf package. This allows for SBOMs for each image to be generated and packaged along with the Zarf package. Abilities to export the SBOM to SDPX and CycloneDX formatted documents as well as a browsable web page are in works. | ||
|
|
||
| ## Consequences | ||
|
|
||
| Added depenencies of Witness and Syft which may inflate Zarf binary size. Increased Zarf package size -- Jeff noted that uncompressed SBOMs for Big Bang Core came in at around 200MB. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # SBOMs in Zarf | ||
|
|
||
| A Zarf generates a Software Bill of Material (SBOM) for each of the images within a Zarf package. This allows consumers of Zarf packages to get in depth knowledge of what is contained within the Zarf package. | ||
|
|
||
| ## What are SBOMs? | ||
|
|
||
| SBOMs are a collection of dependencies, tools, and other information about how a piece of software was built. Zarf collects information about the images within a Zarf package such as the base distro, packages installed, licenses of installed software, and more. | ||
|
|
||
| This allows users of the software to have a clearer understanding of what is running and find potential vulnerabilities that may otherwise go undetected. | ||
|
|
||
|
|
||
| ## How does Zarf generate SBOMs? | ||
|
|
||
| Zarf uses [Syft](https://github.com/anchore/syft/) to generate SBOMs for each image during `zarf package create` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.