diff --git a/task/buildah-remote/0.1/buildah-remote.yaml b/task/buildah-remote/0.1/buildah-remote.yaml index abe6d77bf2..0148534369 100644 --- a/task/buildah-remote/0.1/buildah-remote.yaml +++ b/task/buildah-remote/0.1/buildah-remote.yaml @@ -303,9 +303,9 @@ spec: image: quay.io/redhat-appstudio/syft:v0.98.0@sha256:4d3856e6a2622700b9a9d5d74d9aaf5d8a55671653f80bf6c636677658680ede name: sbom-syft-generate script: | - syft dir:$(workspaces.source.path)/source --output cyclonedx-json=$(workspaces.source.path)/sbom-source.json + syft dir:$(workspaces.source.path)/source --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-source.json find $(cat /workspace/container_path) -xtype l -delete - syft dir:$(cat /workspace/container_path) --output cyclonedx-json=$(workspaces.source.path)/sbom-image.json + syft dir:$(cat /workspace/container_path) --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-image.json volumeMounts: - mountPath: /var/lib/containers name: varlibcontainers diff --git a/task/buildah/0.1/buildah.yaml b/task/buildah/0.1/buildah.yaml index fc0deaecf1..618d148b6b 100644 --- a/task/buildah/0.1/buildah.yaml +++ b/task/buildah/0.1/buildah.yaml @@ -230,9 +230,9 @@ spec: # the cluster will set imagePullPolicy to IfNotPresent # also per direction from Ralph Bean, we want to use image digest based tags to use a cue to automation like dependabot or renovatebot to periodially submit pull requests that update the digest as new images are released. script: | - syft dir:$(workspaces.source.path)/source --output cyclonedx-json=$(workspaces.source.path)/sbom-source.json + syft dir:$(workspaces.source.path)/source --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-source.json find $(cat /workspace/container_path) -xtype l -delete - syft dir:$(cat /workspace/container_path) --output cyclonedx-json=$(workspaces.source.path)/sbom-image.json + syft dir:$(cat /workspace/container_path) --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-image.json volumeMounts: - mountPath: /var/lib/containers name: varlibcontainers diff --git a/task/rpm-ostree/0.1/rpm-ostree.yaml b/task/rpm-ostree/0.1/rpm-ostree.yaml index 6498756f9d..bfed23d387 100644 --- a/task/rpm-ostree/0.1/rpm-ostree.yaml +++ b/task/rpm-ostree/0.1/rpm-ostree.yaml @@ -145,7 +145,7 @@ spec: requests: memory: 6Gi script: | - syft oci-dir:/var/lib/containers/rhtap-final-image --output cyclonedx-json=$(workspaces.source.path)/sbom-cyclonedx.json + syft oci-dir:/var/lib/containers/rhtap-final-image --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-cyclonedx.json volumeMounts: - mountPath: /var/lib/containers name: varlibcontainers diff --git a/task/s2i-java/0.1/s2i-java.yaml b/task/s2i-java/0.1/s2i-java.yaml index fba697c9c6..9095f47788 100644 --- a/task/s2i-java/0.1/s2i-java.yaml +++ b/task/s2i-java/0.1/s2i-java.yaml @@ -154,9 +154,9 @@ spec: # also per direction from Ralph Bean, we want to use image digest based tags to use a cue to automation like dependabot or renovatebot to periodially submit pull requests that update the digest as new images are released. name: sbom-syft-generate script: | - syft dir:$(workspaces.source.path)/source --output cyclonedx-json=$(workspaces.source.path)/sbom-source.json + syft dir:$(workspaces.source.path)/source --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-source.json find $(cat /workspace/container_path) -xtype l -delete - syft dir:$(cat /workspace/container_path) --output cyclonedx-json=$(workspaces.source.path)/sbom-image.json + syft dir:$(cat /workspace/container_path) --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-image.json volumeMounts: - mountPath: /var/lib/containers name: varlibcontainers diff --git a/task/s2i-nodejs/0.1/s2i-nodejs.yaml b/task/s2i-nodejs/0.1/s2i-nodejs.yaml index 1bd389e08e..3b02bd018b 100644 --- a/task/s2i-nodejs/0.1/s2i-nodejs.yaml +++ b/task/s2i-nodejs/0.1/s2i-nodejs.yaml @@ -135,9 +135,9 @@ spec: # also per direction from Ralph Bean, we want to use image digest based tags to use a cue to automation like dependabot or renovatebot to periodially submit pull requests that update the digest as new images are released. name: sbom-syft-generate script: | - syft dir:$(workspaces.source.path)/source --output cyclonedx-json=$(workspaces.source.path)/sbom-source.json + syft dir:$(workspaces.source.path)/source --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-source.json find $(cat /workspace/container_path) -xtype l -delete - syft dir:$(cat /workspace/container_path) --output cyclonedx-json=$(workspaces.source.path)/sbom-image.json + syft dir:$(cat /workspace/container_path) --output cyclonedx-json@1.4=$(workspaces.source.path)/sbom-image.json volumeMounts: - mountPath: /var/lib/containers name: varlibcontainers