feat: write sbom result to disk #822

developer-guy · 2022-09-14T20:38:07Z

Signed-off-by: Batuhan Apaydın batuhan.apaydin@trendyol.com

Fixes #728

codecov-commenter · 2022-09-14T20:41:04Z

Codecov Report

Merging #822 (9e93ca2) into main (bb84aa3) will decrease coverage by 0.26%.
The diff coverage is 18.51%.

@@            Coverage Diff             @@
##             main     #822      +/-   ##
==========================================
- Coverage   51.37%   51.10%   -0.27%     
==========================================
  Files          44       44              
  Lines        3354     3381      +27     
==========================================
+ Hits         1723     1728       +5     
- Misses       1408     1428      +20     
- Partials      223      225       +2

Impacted Files	Coverage Δ
pkg/commands/resolver.go	`33.44% <0.00%> (-0.89%)`	⬇️
pkg/build/options.go	`62.92% <11.11%> (-5.83%)`	⬇️
pkg/build/gobuild.go	`58.57% <25.00%> (-0.34%)`	⬇️
pkg/commands/options/build.go	`70.08% <100.00%> (+0.52%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

imjasonh · 2022-09-14T20:45:28Z

pkg/commands/resolver.go

@@ -120,6 +120,17 @@ func gobuildOptions(bo *options.BuildOptions) ([]build.Option, error) {
 		opts = append(opts, build.WithConfig(bo.BuildConfigs))
 	}

+	if bo.SBOMDir != "" {
+		if bo.SBOMDir == "." {


We shouldn't special-case ., since users might also do ../foo etc. Look into what --image-refs does, so we're at least consistent. If that doesn't support .. etc (I doubt it does), that's okay, but we should be consistent.

ping on this comment.

imjasonh · 2022-09-14T20:46:24Z

pkg/build/gobuild.go

+		if g.sbomDir != "" {
+			fp := fmt.Sprintf("%s.%s", filepath.Join(g.sbomDir, appFilename(ref.Path())), g.sbomType)
+			log.Printf("Writing an SBOM to %s", fp)
+			if err := os.WriteFile(fp, sbom, 0644); err != nil {
+				return nil, err
+			}
+		}


Can this be part of the sbomber impl's responsibility? It already knows the type of SBOM it's generating, and can also know its file name extension.

yes, it can but wouldn't it cause code duplication? Because I need to add this logic into all of the somber impls. WDYT?

I updated the code according to your feedback, can you please take a look? Thx

pkg/build/options.go

pkg/build/gobuild.go

pkg/commands/options/build.go

imjasonh · 2022-09-16T15:44:43Z

doc/ko_run.md

@@ -44,6 +44,7 @@ ko run IMPORTPATH [flags]
  -P, --preserve-import-paths    Whether to preserve the full import path after KO_DOCKER_REPO.
      --push                     Push images to KO_DOCKER_REPO (default true)
      --sbom string              The SBOM media type to use (none will disable SBOM synthesis and upload, also supports: spdx, cyclonedx, go.version-m). (default "spdx")
+      --sbom-dir string          The directory to write the SBOM to.


Suggested change

--sbom-dir string The directory to write the SBOM to.

--sbom-dir string Path to file where the SBOM will be written.

I'd like to think about making this more consistent with --image-refs if possible, which takes a path to a file, instead of a directory.

That may bite us later if/when we end up generating multiple SBOMs, but I'm not sure we'll do that anyway. If we do, we can only write the first one to disk or something. WDYT?

I'd like to think about making this more consistent with --image-refs if possible, which takes a path to a file instead of a directory.

That's also ok for me. It should change the logic of determining the file path, that's all (I guess?). But what if I'm building more than one binary configured via the builds section?

Yeah good point. You could be ko resolveing, or eventually ko build ./...ing, so there might be multiple SBOMs.

In that case a dir sounds better, with files named after the app. So let's keep it like this.

Is there anything left that you want me to do? Or are we all good 🕺🏻

What do you think about adding an e2e test in e2e.yaml? You could even have it --push=false with --sbom-dir then check that the file exists and can be read with jq . <file>.

I have added a test, can you please take a look at them? Thx

.github/workflows/e2e.yaml

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

imjasonh reviewed Sep 14, 2022

View reviewed changes

developer-guy force-pushed the feature/728 branch 4 times, most recently from 7c85f0c to 1395e4c Compare September 15, 2022 10:16

imjasonh reviewed Sep 16, 2022

View reviewed changes

developer-guy force-pushed the feature/728 branch 2 times, most recently from adcfc0d to 5fe3926 Compare September 19, 2022 14:13

developer-guy requested a review from imjasonh September 19, 2022 19:00

developer-guy force-pushed the feature/728 branch 8 times, most recently from 483642f to 47087bb Compare September 19, 2022 21:47

imjasonh reviewed Sep 20, 2022

View reviewed changes

.github/workflows/e2e.yaml Outdated Show resolved Hide resolved

imjasonh reviewed Sep 20, 2022

View reviewed changes

.github/workflows/e2e.yaml Outdated Show resolved Hide resolved

developer-guy force-pushed the feature/728 branch 5 times, most recently from fb4374c to aa6219b Compare September 20, 2022 09:05

developer-guy requested a review from imjasonh September 20, 2022 09:07

developer-guy force-pushed the feature/728 branch from aa6219b to 45b86f5 Compare September 20, 2022 09:56

imjasonh reviewed Sep 20, 2022

View reviewed changes

.github/workflows/e2e.yaml Outdated Show resolved Hide resolved

developer-guy force-pushed the feature/728 branch from 45b86f5 to 39ab81a Compare September 20, 2022 13:00

developer-guy requested a review from imjasonh September 20, 2022 13:30

feat: write sbom result to disk

b57104e

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

developer-guy force-pushed the feature/728 branch from 39ab81a to b57104e Compare September 20, 2022 14:11

imjasonh approved these changes Sep 20, 2022

View reviewed changes

imjasonh merged commit 5e0452a into ko-build:main Sep 20, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: write sbom result to disk #822

feat: write sbom result to disk #822

developer-guy commented Sep 14, 2022

codecov-commenter commented Sep 14, 2022

imjasonh Sep 14, 2022

imjasonh Sep 19, 2022

imjasonh Sep 14, 2022

developer-guy Sep 15, 2022

developer-guy Sep 15, 2022

imjasonh Sep 16, 2022

developer-guy Sep 19, 2022 •

edited

imjasonh Sep 19, 2022

developer-guy Sep 19, 2022

imjasonh Sep 19, 2022

developer-guy Sep 19, 2022

	--sbom-dir string The directory to write the SBOM to.
	--sbom-dir string Path to file where the SBOM will be written.

feat: write sbom result to disk #822

feat: write sbom result to disk #822

Conversation

developer-guy commented Sep 14, 2022

codecov-commenter commented Sep 14, 2022

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

developer-guy Sep 19, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

developer-guy Sep 19, 2022 •

edited