Connect SBOMs with SPDX support. #511
Conversation
mattmoor
force-pushed
the
add-spdx-sboms
branch
from
3d3a4db
to
754949c
Compare
Codecov Report
@@ Coverage Diff @@
## main #511 +/- ##
==========================================
- Coverage 50.83% 50.51% -0.33%
==========================================
Files 41 41
Lines 2028 2051 +23
==========================================
+ Hits 1031 1036 +5
- Misses 826 840 +14
- Partials 171 175 +4
Continue to review full report at Codecov.
|
This combines Jason's SPDX stuff and my SBOM stuff to support SPDX-based SBOMs by default instead of our `go version -m` invention.
mattmoor
force-pushed
the
add-spdx-sboms
branch
from
754949c
to
0fda65b
Compare
| dir: dir, | ||
| sbom: spdx("(none)"), |
There was a problem hiding this comment.
Should this pass a real version value?
There was a problem hiding this comment.
So this is something I spent a bit of time futzing around with, so LMK if you have idea wrt plumbing, but basically the place we inject Version today is in the consuming pkg/commands package. The way the CLI defaults are set up, this is always overridden with WithSPDX(Version) so we get (devel) at HEAD today, and presumably even better with releases. However, I wanted the library default to be SPDX as well, and used (none) to distinguish.
| @@ -116,6 +116,24 @@ func withBuilder(b builder) Option { | |||
| } | |||
| } | |||
|
|
|||
| // WithGoVersionSBOM is a functional option to direct ko to use | |||
| // go version -m for SBOM format. | |||
| func WithGoVersionSBOM() Option { | |||
There was a problem hiding this comment.
I'll probably make this WithSBOM(impl) but that can happen later.
There was a problem hiding this comment.
I hate the signature for sbomber, so I didn't go that route (I started to), but I'd love to head that direction if you have ideas.
This combines Jason's SPDX stuff and my SBOM stuff to support
SPDX-based SBOMs by default instead of our
go version -minvention.
To simplify things, I got rid of
disableSBOMin favor of supportingniland simply eliding the SBOM call.