☂️ SPDX formatted SBOMs for container images and binaries

[mac641]

release.yaml

• binaries
  • metal-stack:
    • Include SBOM as release asset metal-hammer#158
    • Include SBOM into container image and as release asset metalctl#286
• docker-images:
  • metal-stack:
    • control-plane:
      • include sbom in container image go-ipam#181
      • include sbom in container image masterdata-api#124
      • Include sbom in container image metal-api#622
      • include sbom in container image metal-apiserver#38
      • include sbom in container images metal-console#59
      • include sbom in container image metal-metrics-exporter#23
      • Include SBOM into container image and as release asset metalctl#286
      • include sbom in container image rethinkdb-exporter#7
    • gardener:
      • include sbom in container image firewall-controller-manager#73
      • include sbom in container image gardener-extension-audit#44
      • include sbom in container image gardener-extension-backup-s3#16
      • include sbom in container image gardener-extension-csi-driver-lvm#13
      • include sbom in container image gardener-extension-dns-powerdns#11
      • include sbom in container image gardener-extension-provider-metal#458
      • include sbom in container image machine-controller-manager-provider-metal#42
      • include sbom in container image os-metal-extension#60
    • generic:
      • include sbom in container image backup-restore-sidecar#115
      • include sbom in container image metal-deployment-base#41
    • kubernetes:
      • include sbom in container image csi-lvm#68
      • include sbom in container image droptailer#44
      • include sbom in container image duros-controller#94
      • include sbom in container image metal-ccm#117
      • include sbom in container image node-init#17
    • partition:
      • include sbom in container image metal-bmc#81
      • include sbom in container image metal-core#157
      • include sbom in container image metal-image-cache-sync#20
      • include sbom in container image pixie#35
      • include sbom in container image sonic-configdb-utils#26

not in release.yaml

• docker images
  • add generating sboms to actions workflows and enable uploading as release asset docs-archive#271
  • include sboms in container images mini-lab#242
  • Add generating sbom to docker workflow and image cosigning. oci-mirror#14
  • include SBOM in container image oci-mirror#16
  • add docker build step and include sboms in container image and as release asset cli#3
  • include sbom in container image gardener-extension-ontap#12
  • introduce standard docker workflow and include sbom in container images builder#83
  • include sbom in container image csi-driver-lvm#118
  • include sbom in container image go-dhcp-relay#9
  • include sbom in container image metallb-health-sidecar#4
  • include sbom as release asset nftables-exporter#33
  • include sbom as container image and as release asset firewall-controller#201
  • include sbom in container image gardener-extension-duros#3
  • include sbom in container image metal-robot#78
  • include sbom in container image gardener-vpn-gateway#3
  • include sbom in container image rethinkdb-backup-tools-build#2
  • include sbom in container image mini-lab-ovmf#2
  • include sbom in container image chrony#4
  • Migrate to docker bake and include sboms in generated images metal-images#341
• binaries
  • include generating sbom in actions workflow go-lldpd#30

[Gerrit91]

Really nice! Thanks for the hard work. How long did it take to create the PRs? 😅

Because maybe we need to do it again to sign our images with cosign, migrate the base images to distroless (+ verify this base image with cosign). For the distroless migration it is important to check that the container images really start (also the WORKDIR usually needs to be set to /) and to demote the user to non-root.

[Gerrit91]

Docker Images

• https://github.com/metal-stack/metal-image-cache-sync
• https://github.com/metal-stack/metal-bmc
• https://github.com/metal-stack/node-init
• https://github.com/metal-stack/metal-ccm
• https://github.com/metal-stack/duros-controller
• https://github.com/metal-stack/droptailer
• https://github.com/metal-stack/csi-lvm
• https://github.com/metal-stack/metal-deployment-base
• https://github.com/metal-stack/os-metal-extension
• https://github.com/metal-stack/machine-controller-manager-provider-metal
• https://github.com/metal-stack/gardener-extension-provider-metal
• https://github.com/metal-stack/gardener-extension-csi-driver-lvm
• https://github.com/metal-stack/gardener-extension-audit
• https://github.com/metal-stack/firewall-controller-manager
• https://github.com/metal-stack/rethinkdb-exporter
• https://github.com/metal-stack/metal-metrics-exporter
• https://github.com/metal-stack/metal-api
• https://github.com/metal-stack/masterdata-api
• https://github.com/metal-stack/go-ipam
• https://github.com/metal-stack/metal-core
• https://github.com/metal-stack/gardener-extension-dns-powerdns
• https://github.com/metal-stack/gardener-extension-backup-s3
• https://github.com/metal-stack/pixie
• https://github.com/metal-stack/backup-restore-sidecar
• https://github.com/metal-stack/sonic-configdb-utils
• https://github.com/metal-stack/metal-apiserver
• https://github.com/metal-stack/metalctl
• https://github.com/metal-stack/mini-lab
• https://github.com/metal-stack/metal-images
• https://github.com/metal-stack/cluster-api-provider-metal-stack
• https://github.com/metal-stack/oci-mirror
• https://github.com/metal-stack/cli
• https://github.com/metal-stack/gardener-extension-ontap
• https://github.com/metal-stack/builder
• https://github.com/metal-stack/csi-driver-lvm
• https://github.com/metal-stack/go-dhcp-relay
• https://github.com/metal-stack/metallb-health-sidecar
• https://github.com/metal-stack/nftables-exporter
• https://github.com/metal-stack/metal-console
• https://github.com/metal-stack/firewall-controller
• https://github.com/metal-stack/gardener-extension-duros-provider
• https://github.com/metal-stack/metal-robot
• https://github.com/metal-stack/gardener-vpn-gateway
• https://github.com/metal-stack/rethinkdb-backup-tools-build
• https://github.com/metal-stack/mini-lab-ovmf
• https://github.com/metal-stack/chrony

Binary (optional)

Similar to metalctl (see metal-stack/metalctl@3724496).

• https://github.com/metal-stack/metal-hammer
• https://github.com/metal-stack/go-lldpd

OCI Images

It's unclear how to handle these as they do not contain services running somewhere and mainly YAML files required for the deployment. Also the layer format is non-conformant to Docker. I think it's fine to exclude these for the time being and just continue with image signing to ensure contents are fine.

• https://github.com/metal-stack/metal-roles
• https://github.com/metal-stack/releases
• https://github.com/metal-stack/helm-charts
• https://github.com/metal-stack/ansible-common
• https://github.com/metal-stack/metal-ansible-modules
• https://github.com/metal-stack/metal-ansible-collections

Not Applicable / No Artifacts

• https://github.com/metal-stack/docs
• https://github.com/metal-stack/kernel
• https://github.com/metal-stack/api
• https://github.com/metal-stack/metal-networker
• https://github.com/metal-stack/metal-lib
• https://github.com/metal-stack/security
• https://github.com/metal-stack/metal-go
• https://github.com/metal-stack/metal-python
• https://github.com/metal-stack/sonic-build
• https://github.com/metal-stack/ontap-go
• https://github.com/metal-stack/duros-go
• https://github.com/metal-stack/go-hal
• https://github.com/metal-stack/.github
• https://github.com/metal-stack/updater
• https://github.com/metal-stack/frr
• https://github.com/metal-stack/sonic-go-swsssdk
• https://github.com/metal-stack/v
• https://github.com/metal-stack/metal-stack
• https://github.com/metal-stack/metal-stack.github.io

Investigate If We Need It in Our Organization

• https://github.com/metal-stack/cluster-api-provider-gardener
• https://github.com/metal-stack/frr-monitor
• https://github.com/metal-stack/syncrd
• https://github.com/metal-stack/csilvmctl

[Gerrit91]

How do you download the SBOMs by the way? I am a bit upset I can't find an easy way to download it (like single command). I came up with the following but... yeah, complex. 😅

IMAGE=ghcr.io/metal-stack/oci-mirror:sbom-and-cosign; oras blob fetch $IMAGE@$(oras manifest fetch $IMAGE --platform unknown/unknown | jq -r '.layers[] | select(.annotations."in-toto.io/predicate-type"=="https://spdx.dev/Document") | .digest') --output sbom.json

[mac641]

How do you download the SBOMs by the way? I am a bit upset I can't find an easy way to download it (like single command). I came up with the following but... yeah, complex. 😅

IMAGE=ghcr.io/metal-stack/oci-mirror:sbom-and-cosign; oras blob fetch $IMAGE@$(oras manifest fetch $IMAGE --platform unknown/unknown | jq -r '.layers[] | select(.annotations."in-toto.io/predicate-type"=="https://spdx.dev/Document") | .digest') --output sbom.json

@Gerrit91 I would download it using docker buildx imagetools. There's an example on how to use it in the docs.

This should work: docker buildx imagetools inspect ghcr.io/metal-stack/oci-mirror:sbom-and-cosign --format "{{ json .SBOM.SPDX }}" > sbom.json