Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clean up sbom #26

Merged
merged 3 commits into from
Nov 5, 2024
Merged

clean up sbom #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d2a3059
clean up sbom
daniel-noland Nov 5, 2024
ef03b44
temp drop nightly
daniel-noland Nov 5, 2024
b6ae8b7
no more diff-store
daniel-noland Nov 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 10 additions & 15 deletions .github/workflows/build-and-push-container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,12 +118,10 @@ jobs:
cargo binstall --no-confirm just
- name: nix cache
uses: DeterminateSystems/magic-nix-cache-action@main
with:
diff-store: true
- name: confirm sources
run: ./scripts/confirm-sources.sh
- name: build
run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} build
- name: build + push
run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} push
- name: Install SBOM generator dependencies
run: |
for f in /tmp/dpdk-sys/builds/*; do
Expand All @@ -134,32 +132,29 @@ jobs:
sudo apt-get install --yes --no-install-recommends graphviz
- name: Generate SBOM
run: ./scripts/sbom.sh
- name: push
run: just --yes debug=true max_nix_builds=1 rust=${{matrix.toolchain.key}} push
- name: remove links from /tmp/dpdk-sys/builds
run: |
for f in /tmp/dpdk-sys/builds/*; do
[ -h "$f" ] && rm "$f"
done
- name: step summary
continue-on-error: true # might fail due to $GITHUB_STEP_SUMMARY size limit of 1MB
run: |
echo "# Outdated packages:" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.outdated.md >> $GITHUB_STEP_SUMMARY
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.outdated.md >> $GITHUB_STEP_SUMMARY

echo "" >> "$GITHUB_STEP_SUMMARY"
echo "# Vuln scan (gnu64):" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.vulns.triage.md >> $GITHUB_STEP_SUMMARY
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.vulns.triage.md >> $GITHUB_STEP_SUMMARY

echo "" >> "$GITHUB_STEP_SUMMARY"
echo "# Runtime SBOM (gnu64):" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.release.runtime.sbom.md >> $GITHUB_STEP_SUMMARY
cat /tmp/dpdk-sys/builds/env.sysroot.gnu64.sbom.md >> $GITHUB_STEP_SUMMARY

echo "" >> "$GITHUB_STEP_SUMMARY"

- name: remove links from /tmp/dpdk-sys/builds
run: |
for f in /tmp/dpdk-sys/builds/*; do
[ -h "$f" ] && rm "$f"
done
- uses: actions/upload-artifact@v4
with:
name: builds-${{ matrix.toolchain.key }}
Expand Down
14 changes: 7 additions & 7 deletions builds.template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,12 @@ matrix:
- "x86_64-unknown-linux-gnu"
- "x86_64-unknown-linux-musl"
just: *just_version
- # pinned nightly
<<: *default
key: "nightly"
llvm: *llvm_nightly
rust:
channel: "nightly"
version: *nightly_pin
# - # pinned nightly
# <<: *default
# key: "nightly"
# llvm: *llvm_nightly
# rust:
# channel: "nightly"
# version: *nightly_pin
nixpkgs:
- *nixpkgs_unstable
14 changes: 7 additions & 7 deletions builds.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,12 @@ matrix:
- "x86_64-unknown-linux-gnu"
- "x86_64-unknown-linux-musl"
just: *just_version
- # pinned nightly
<<: *default
key: "nightly"
llvm: *llvm_nightly
rust:
channel: "nightly"
version: *nightly_pin
# - # pinned nightly
# <<: *default
# key: "nightly"
# llvm: *llvm_nightly
# rust:
# channel: "nightly"
# version: *nightly_pin
nixpkgs:
- *nixpkgs_unstable
7 changes: 7 additions & 0 deletions scripts/sbom.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,10 @@ declare -r builds="/tmp/dpdk-sys/builds"
pushd "${builds}"
declare -r package="env.sysroot"

nix build "${sbomnix}" --out-link /tmp/sbomnix

for libc in "gnu64" "musl64"; do
cd "$(mktemp -d)"
nix run \
"${sbomnix}#sbomnix" \
-- \
Expand All @@ -20,26 +23,30 @@ for libc in "gnu64" "musl64"; do
--verbose=1 \
--include-vulns \
"${builds}/${package}.${libc}.release" &
cd "$(mktemp -d)"
nix run \
"${sbomnix}#vulnxscan" \
-- \
--out "${builds}/${package}.${libc}.vulns.csv" \
--triage \
--verbose=1 \
"${builds}/${package}.${libc}.release" &
cd "$(mktemp -d)"
nix run \
"${sbomnix}#nix_outdated" \
-- \
--out "${builds}/${package}.${libc}.outdated.csv" \
--verbose=1 \
"${builds}/${package}.${libc}.release" &
cd "$(mktemp -d)"
nix run \
"${sbomnix}#provenance" \
-- \
--out "${builds}/${package}.${libc}.provenance.json" \
--verbose=1 \
--recursive \
"${builds}/${package}.${libc}.release" &
cd "$(mktemp -d)"
nix run \
"${sbomnix}#nixgraph" \
-- \
Expand Down