Publish SBOMs for the artifacts we produce #185
Assignees
Labels
Comments
|
It looks like the relevant KubeCon recording isn't uploaded yet, but when it is it'll be here: https://www.youtube.com/playlist?list=PLj6h78yzYM2PR4KLskmLmNU20VtEnUMlw |
|
Newer versions of Buildx have a SBOM feature that looks cool. It seems like it'll capture software used during the build process even if it's not in the final container build, which I don't know how we could achieve otherwise. https://github.com/docker/buildx/releases/tag/v0.10.0 It can also create attestations about the build process and environment: https://github.com/moby/buildkit/blob/v0.11.0/docs/attestations/slsa-provenance.md |
dfarrell07
added a commit
to dfarrell07/shipyard
that referenced
this issue
Apr 27, 2023
The 0.10.x releases of buildx add support for creating Software Bill of Materials during the build process. It seems like they can even capture software used during the build that doesn't make it into the final container. This may support submariner-io/enhancements#185. Signed-off-by: Daniel Farrell <[email protected]>
tpantelis
pushed a commit
to submariner-io/shipyard
that referenced
this issue
Apr 28, 2023
The 0.10.x releases of buildx add support for creating Software Bill of Materials during the build process. It seems like they can even capture software used during the build that doesn't make it into the final container. This may support submariner-io/enhancements#185. Signed-off-by: Daniel Farrell <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What would you like to be added:
Publish SBOMs alongside our release artifacts (container images,
subctlbinaries etc.).Why is this needed:
This allows end-users to accurately determine the contents of our release artifacts. It might be possible to use
krelto help with this; see this KubeCon presentation for details.The text was updated successfully, but these errors were encountered: