SPDX formatted SBOMs for our container images and binaries

[mac641]

release.yaml

• binaries
  • metal-stack:
    • Include SBOM as release asset metal-hammer#158
    • Include SBOM into container image and as release asset metalctl#286
• docker-images:
  • metal-stack:
    • control-plane:
      • include sbom in container image go-ipam#181
      • include sbom in container image masterdata-api#124
      • Include sbom in container image metal-api#622
      • include sbom in container image metal-apiserver#38
      • include sbom in container images metal-console#59
      • include sbom in container image metal-metrics-exporter#23
      • Include SBOM into container image and as release asset metalctl#286
      • include sbom in container image rethinkdb-exporter#7
    • gardener:
      • include sbom in container image firewall-controller-manager#73
      • include sbom in container image gardener-extension-audit#44
      • include sbom in container image gardener-extension-backup-s3#16
      • include sbom in container image gardener-extension-csi-driver-lvm#13
      • include sbom in container image gardener-extension-dns-powerdns#11
      • include sbom in container image gardener-extension-provider-metal#458
      • include sbom in container image machine-controller-manager-provider-metal#42
      • include sbom in container image os-metal-extension#60
    • generic:
      • include sbom in container image backup-restore-sidecar#115
      • include sbom in container image metal-deployment-base#41
    • kubernetes:
      • include sbom in container image csi-lvm#68
      • include sbom in container image droptailer#44
      • include sbom in container image duros-controller#94
      • include sbom in container image metal-ccm#117
      • include sbom in container image node-init#17
    • partition:
      • include sbom in container image metal-bmc#81
      • include sbom in container image metal-core#157
      • include sbom in container image metal-image-cache-sync#20
      • include sbom in container image pixie#35
      • include sbom in container image sonic-configdb-utils#26

not in release.yaml

• docker images
  • add generating sboms to actions workflows and enable uploading as release asset docs#271
  • include sboms in container images mini-lab#242
  • Add generating sbom to docker workflow and image cosigning. oci-mirror#14
  • add docker build step and include sboms in container image and as release asset cli#3
  • include sbom in container image gardener-extension-ontap#12
  • introduce standard docker workflow and include sbom in container images builder#83
  • include sbom in container image csi-driver-lvm#118
  • include sbom in container image go-dhcp-relay#9
  • include sbom in container image metallb-health-sidecar#4
  • include sbom as release asset nftables-exporter#33
  • include sbom as container image and as release asset firewall-controller#201
  • not sure how this shall be handled in terms of sboms: https://github.com/metal-stack/gardener-extension-duros-provider
  • include sbom in container image metal-robot#78
  • include sbom in container image gardener-vpn-gateway#3
  • include sbom in container image rethinkdb-backup-tools-build#2
  • include sbom in container image mini-lab-ovmf#2
  • include sbom in container image chrony#4

[Gerrit91]

Really nice! Thanks for the hard work. How long did it take to create the PRs? 😅

Because maybe we need to do it again to sign our images with cosign, migrate the base images to distroless (+ verify this base image with cosign). For the distroless migration it is important to check that the container images really start (also the WORKDIR usually needs to be set to /) and to demote the user to non-root.

[Gerrit91]

Docker Images

• https://github.com/metal-stack/metal-image-cache-sync
• https://github.com/metal-stack/metal-bmc
• https://github.com/metal-stack/node-init
• https://github.com/metal-stack/metal-ccm
• https://github.com/metal-stack/duros-controller
• https://github.com/metal-stack/droptailer
• https://github.com/metal-stack/csi-lvm
• https://github.com/metal-stack/metal-deployment-base
• https://github.com/metal-stack/os-metal-extension
• https://github.com/metal-stack/machine-controller-manager-provider-metal
• https://github.com/metal-stack/gardener-extension-provider-metal
• https://github.com/metal-stack/gardener-extension-csi-driver-lvm
• https://github.com/metal-stack/gardener-extension-audit
• https://github.com/metal-stack/firewall-controller-manager
• https://github.com/metal-stack/rethinkdb-exporter
• https://github.com/metal-stack/metal-metrics-exporter
• https://github.com/metal-stack/metal-api
• https://github.com/metal-stack/masterdata-api
• https://github.com/metal-stack/go-ipam
• https://github.com/metal-stack/metal-core
• https://github.com/metal-stack/gardener-extension-dns-powerdns
• https://github.com/metal-stack/gardener-extension-backup-s3
• https://github.com/metal-stack/pixie
• https://github.com/metal-stack/backup-restore-sidecar
• https://github.com/metal-stack/sonic-configdb-utils
• https://github.com/metal-stack/metal-apiserver
• https://github.com/metal-stack/metalctl
• https://github.com/metal-stack/mini-lab
• https://github.com/metal-stack/metal-images
• https://github.com/metal-stack/cluster-api-provider-metal-stack
• https://github.com/metal-stack/oci-mirror
• https://github.com/metal-stack/cli
• https://github.com/metal-stack/gardener-extension-ontap
• https://github.com/metal-stack/builder
• https://github.com/metal-stack/csi-driver-lvm
• https://github.com/metal-stack/go-dhcp-relay
• https://github.com/metal-stack/metallb-health-sidecar
• https://github.com/metal-stack/nftables-exporter
• https://github.com/metal-stack/metal-console
• https://github.com/metal-stack/firewall-controller
• https://github.com/metal-stack/gardener-extension-duros-provider
• https://github.com/metal-stack/metal-robot
• https://github.com/metal-stack/gardener-vpn-gateway
• https://github.com/metal-stack/rethinkdb-backup-tools-build
• https://github.com/metal-stack/mini-lab-ovmf
• https://github.com/metal-stack/chrony

Binary (optional)

Similar to metalctl (see metal-stack/metalctl@3724496).

• https://github.com/metal-stack/metal-hammer
• https://github.com/metal-stack/go-lldpd

OCI Images

For this we must find out how to do it. Also some of these are still pull requests.

• https://github.com/metal-stack/metal-roles
• https://github.com/metal-stack/releases
• https://github.com/metal-stack/helm-charts
• https://github.com/metal-stack/ansible-common
• https://github.com/metal-stack/metal-ansible-modules
• https://github.com/metal-stack/metal-ansible-collections

Not Applicable / No Artifacts

• https://github.com/metal-stack/docs
• https://github.com/metal-stack/kernel
• https://github.com/metal-stack/api
• https://github.com/metal-stack/metal-networker
• https://github.com/metal-stack/metal-lib
• https://github.com/metal-stack/security
• https://github.com/metal-stack/metal-go
• https://github.com/metal-stack/metal-python
• https://github.com/metal-stack/sonic-build
• https://github.com/metal-stack/ontap-go
• https://github.com/metal-stack/duros-go
• https://github.com/metal-stack/go-hal
• https://github.com/metal-stack/.github
• https://github.com/metal-stack/updater
• https://github.com/metal-stack/frr
• https://github.com/metal-stack/sonic-go-swsssdk
• https://github.com/metal-stack/v
• https://github.com/metal-stack/metal-stack
• https://github.com/metal-stack/metal-stack.github.io

Investigate If We Need It in Our Organization

• https://github.com/metal-stack/cluster-api-provider-gardener
• https://github.com/metal-stack/frr-monitor
• https://github.com/metal-stack/syncrd
• https://github.com/metal-stack/csilvmctl

[Gerrit91]

How do you download the SBOMs by the way? I am a bit upset I can't find an easy way to download it (like single command). I came up with the following but... yeah, complex. 😅

IMAGE=ghcr.io/metal-stack/oci-mirror:sbom-and-cosign; oras blob fetch $IMAGE@$(oras manifest fetch $IMAGE --platform unknown/unknown | jq -r '.layers[] | select(.annotations."in-toto.io/predicate-type"=="https://spdx.dev/Document") | .digest') --output sbom.json

[mac641]

How do you download the SBOMs by the way? I am a bit upset I can't find an easy way to download it (like single command). I came up with the following but... yeah, complex. 😅

IMAGE=ghcr.io/metal-stack/oci-mirror:sbom-and-cosign; oras blob fetch $IMAGE@$(oras manifest fetch $IMAGE --platform unknown/unknown | jq -r '.layers[] | select(.annotations."in-toto.io/predicate-type"=="https://spdx.dev/Document") | .digest') --output sbom.json

@Gerrit91 I would download it using docker buildx imagetools. There's an example on how to use it in the docs.

This should work: docker buildx imagetools inspect ghcr.io/metal-stack/oci-mirror:sbom-and-cosign --format "{{ json .SBOM.SPDX }}" > sbom.json