Send list of extra SBOM scanner to use #17699

LaurentGoderre · 2024-10-09T15:20:35Z

No description provided.

tianon · 2024-10-09T16:50:46Z

.bin/bashbrew-buildkit-env-setup.sh

+
+			local scanners
+			scanners="php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"
+			vars="$(_jq_setenv <<<"$vars" BASHBREW_BUILDKIT_EXTRA_SCANNERS "$scanners")"


The EXTRA_SCANNERS configuration knob is something that's specific to docker/scout-sbom-indexer, right? (ie, it wouldn't be likely to be supported by any other scanner?)

So, relevant to docker-library/meta-scripts#86 (the implementation of this on the other side), I think this might be cleaner to use/abuse the fact that BASHBREW_BUILDKIT_SBOM_GENERATOR gets embedded directly as-is, since EXTRA_SCANNERS is technically a parameter of that generator:

local sbomGenerator # https://hub.docker.com/r/docker/scout-sbom-indexer/tags sbomGenerator="$(grep <<<"$externalPins" -m1 '^docker/scout-sbom-indexer:')" sbomGenerator="$(_resolve_external_pins "$sbomGenerator")" # https://github.com/moby/buildkit/pull/5372 - "EXTRA_SCANNERS" is an optional parameter to the Scout SBOM Indexer sbomGenerator+=',"EXTRA_SCANNERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"' vars="$(_jq_setenv <<<"$vars" BASHBREW_BUILDKIT_SBOM_GENERATOR "$sbomGenerator")"

(A side benefit of doing it here is that it's a lot easier to get the CSV-vs-shell-quoting right so those , don't trip us up 😅)

If we do that, we need to include the generator= part here as well because if the CSV parsing . The syntax is "generator=foo","arg=bar"

Right now, we're only shell quoting the generator, not CSV-quoting it, and in CSV quoting, we can optionally quote some values while not quoting others.

You can see that more accurately in https://github.com/docker-library/meta-scripts/blob/2084a63dca2ed7a0e0e0f7992a205333d32bfb56/.test/meta-commands/out.sh#L147 -- we're just doing --sbom=generator="$BASHBREW_BUILDKIT_SBOM_GENERATOR" which will expand to --sbom=generator=whatever-the-env-value-is as a single argument to docker buildx build, so any ,"foo" at the end of it will be passed as-is to the --sbom flag.

I was going to show this working, but I'm not actually sure the backport is working? Does it also need updates to buildx? 😬

$ docker buildx create --name foo --driver-opt image=tianon/buildkit --bootstrap ... $ docker buildx build --builder foo --sbom=generator='docker/scout-sbom-indexer:1' --output type=oci,dest=/dev/null --no-cache - <<<'FROM swipl' |& grep 'INFO Indexed ' INFO Indexed 217 packages $ docker buildx build --builder foo --sbom=generator='docker/scout-sbom-indexer:1,"EXTRA_SCANNERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"' --output type=oci,dest=/dev/null --no-cache - <<<'FROM swipl' |& grep 'INFO Indexed ' INFO Indexed 217 packages

Oh, false alarm, that's actually because docker/scout-sbom-indexer:1 doesn't actually support an EXTRA_SCANNERS variable yet; testing with your image works successfully and demonstrates what I mean:

$ docker buildx build --builder foo --sbom=generator='laurentgoderre689/scout-sbom-indexer:extra@sha256:17d0cba7e0a840e84c8e565ca0163ccac8ae7794775ca92a2f8fda71e227f08a' --output type=oci,dest=/dev/null --no-cache - <<<'FROM swipl' |& grep 'INFO Indexed ' INFO Indexed 217 packages $ docker buildx build --builder foo --sbom=generator='laurentgoderre689/scout-sbom-indexer:extra@sha256:17d0cba7e0a840e84c8e565ca0163ccac8ae7794775ca92a2f8fda71e227f08a,"EXTRA_SCANNERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"' --output type=oci,dest=/dev/null --no-cache - <<<'FROM swipl' |& grep 'INFO Indexed ' INFO Indexed 221 packages

To further illustrate, docker-library/meta-scripts#86 won't work as-is; this line:

"--sbom=\"generator=$BASHBREW_BUILDKIT_SBOM_GENERATOR\",\"EXTRA_SCANNERS=$BASHBREW_BUILDKIT_EXTRA_SCANNERS"

would need to instead be something like:

"--sbom=\"generator=$BASHBREW_BUILDKIT_SBOM_GENERATOR,\\\"EXTRA_SCANNERS=$BASHBREW_BUILDKIT_EXTRA_SCANNERS\\\"\""

(which is what I mean by it being much easier to get the quoting correct if we just do it here instead, where we've specified the SBOM generator and thus know that our EXTRA_SCANNERS parameter actually applies)

When I tried it, mixing quoting some fields and not other didn't seem to work but maybe I did it wrong

Yeah, it's definitely tricky to get right because of the interaction of the shell doing quoting (and needing to, for variable expansion to work correctly) and the quoting required for the CSV-style microformat used by the command we're passing this value to. 😬

Here's another way to illustrate this:

$ # just shell quoting $ sh -c 'echo "$@"' -- --sbom="generator=foo","EXTRA_SCANNERS=bar" --sbom=generator=foo,EXTRA_SCANNERS=bar $ # just shell quoting generator, but *also* CSV-quoting EXTRA_SCANNERS $ sh -c 'echo "$@"' -- --sbom="generator=foo","\"EXTRA_SCANNERS=bar\"" --sbom=generator=foo,"EXTRA_SCANNERS=bar"

tianon · 2024-10-10T18:40:43Z

.bin/bashbrew-buildkit-env-setup.sh

 			# https://hub.docker.com/r/docker/scout-sbom-indexer/tags
 			sbomTag="$(grep <<<"$externalPins" -m1 '^docker/scout-sbom-indexer:')"
 			sbomTag="$(_resolve_external_pins "$sbomTag")"
-			vars="$(_jq_setenv <<<"$vars" BASHBREW_BUILDKIT_SBOM_GENERATOR "$sbomTag")"
+			scanners="php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"
+			vars="$(_jq_setenv <<<"$vars" BASHBREW_BUILDKIT_SBOM_GENERATOR "$sbomTag,\"EXTRA_SCANNERS=$scanners\"")"


Repeating a few minor suggestions, this time with more explanation for each one (so they're hopefully easier to understand/discuss): 😇 ❤️

renaming sbomTag to sbomGenerator, since that's the variable it's setting so it's a more appropriate name

using Bash's += to append the scanners directly to that variable to avoid a second variable and so we can use single-quotes so that the CSV quoting is easier to get right (no escaping necessary)

adding a comment pointing to Added way to configure SBOM scanner moby/buildkit#5372 so we can easily find where this functionality was added to BuildKit + a note about what "EXTRA_SCANNERS" is (because it's not documented publicly anywhere)

local sbomGenerator # https://hub.docker.com/r/docker/scout-sbom-indexer/tags sbomGenerator="$(grep <<<"$externalPins" -m1 '^docker/scout-sbom-indexer:')" sbomGenerator="$(_resolve_external_pins "$sbomGenerator")" # https://github.com/moby/buildkit/pull/5372 - "EXTRA_SCANNERS" is an optional parameter to the Scout SBOM Indexer sbomGenerator+=',"EXTRA_SCANNERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger,swipl-pack-cataloger,opam-cataloger"' vars="$(_jq_setenv <<<"$vars" BASHBREW_BUILDKIT_SBOM_GENERATOR "$sbomGenerator")"

I also think we should probably wait to merge this until we have a new release of docker/scout-sbom-indexer that includes support for EXTRA_SCANNERS so we don't forget that this isn't actually doing anything yet and scratch our heads later. 🤔 Perhaps even include the swap from the 1-doi tag to the 1 tag?

github-actions · 2024-10-18T14:10:21Z

Diff for 3f6fae9:

diff --git a/.external-pins/docker/scout-sbom-indexer___1-doi/bashbrew.json b/.external-pins/docker/scout-sbom-indexer___1/bashbrew.json
similarity index 58%
rename from .external-pins/docker/scout-sbom-indexer___1-doi/bashbrew.json
rename to .external-pins/docker/scout-sbom-indexer___1/bashbrew.json
index 5d7eb7e..beb7ca6 100644
--- a/.external-pins/docker/scout-sbom-indexer___1-doi/bashbrew.json
+++ b/.external-pins/docker/scout-sbom-indexer___1/bashbrew.json
@@ -2,100 +2,100 @@
 	"arches": {
 		"amd64": [
 			{
-				"digest": "sha256:3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877",
+				"digest": "sha256:5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "amd64",
 					"os": "linux"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"arm32v5": [
 			{
-				"digest": "sha256:d26b3d8f41ce11cc98c06a918d3afd25f5b36a1c8cc0ce1f9161e0ea9c63c080",
+				"digest": "sha256:4a31dc02455840de2881aafcf25fe689bae582a44e63f7cd9d0f4f643952abf1",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "arm",
 					"os": "linux",
 					"variant": "v5"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"arm32v7": [
 			{
-				"digest": "sha256:fe0f07b2d1f32a8f2cdc64defcd0d783d498b651e9c565fadec1a05e5d1e6eff",
+				"digest": "sha256:84704befe00809ea3b4cd93c23734f4f71000861c537ebea7017ef8cb24a2cb2",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "arm",
 					"os": "linux",
 					"variant": "v7"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"arm64v8": [
 			{
-				"digest": "sha256:c3bcaf528de18672cee37a781da7e6aeba94b2b0239045c5429a3a74b47a0417",
+				"digest": "sha256:393fa9f19a2129126fda3177b4ac81a3efda0a7787d5cf408e8b98995ba2775f",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "arm64",
 					"os": "linux",
 					"variant": "v8"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"i386": [
 			{
-				"digest": "sha256:7264a6862027d997b733f6118e40f117891ec9f64f1e2c3ecb37c55c7da028ec",
+				"digest": "sha256:349295537ced90c5765687b543257bdee4909ab0132f56b528e9e6125e2da2fa",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "386",
 					"os": "linux"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"ppc64le": [
 			{
-				"digest": "sha256:e001f8ea82bb476917d5f35fda434347afafb23c823d4ea9018658a8b7929767",
+				"digest": "sha256:6f7897ffb2122529e257bc032d66bf9480f33e93ef413f37a79b3a35738db244",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "ppc64le",
 					"os": "linux"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"riscv64": [
 			{
-				"digest": "sha256:4522b218f6a5f6a18d75987bc7dafba442c2950133894ffab8b20b420ce94b70",
+				"digest": "sha256:af6b883f23456b1097bdd82ed65227930ee8a03f6e0274cc549c94287a21c1f4",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "riscv64",
 					"os": "linux"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		],
 		"s390x": [
 			{
-				"digest": "sha256:99e8684a97974938ad5000ef2f8ebe4ace56ccd008ce995e78f391430ae4851d",
+				"digest": "sha256:bd8b625098cf9e318bda844c3b3d01ef0508cc907b0d57a05cb1cdd47162f554",
 				"mediaType": "application/vnd.oci.image.manifest.v1+json",
 				"platform": {
 					"architecture": "s390x",
 					"os": "linux"
 				},
-				"size": 1613
+				"size": 1612
 			}
 		]
 	},
 	"desc": {
-		"digest": "sha256:45ba05d54d01ed53a964a0f09d9d638a3af7c0c15448cafd58995ef3ce27ee09",
+		"digest": "sha256:4fa68d539eb5a99e75a93dfbefe5a4dfacd9c90c4577925f492670c6a1b06894",
 		"mediaType": "application/vnd.oci.image.index.v1+json",
 		"size": 6175
 	},
-	"ref": "docker.io/docker/scout-sbom-indexer:1-doi@sha256:45ba05d54d01ed53a964a0f09d9d638a3af7c0c15448cafd58995ef3ce27ee09"
+	"ref": "docker.io/docker/scout-sbom-indexer:1@sha256:4fa68d539eb5a99e75a93dfbefe5a4dfacd9c90c4577925f492670c6a1b06894"
 }
diff --git a/.external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877-config.json b/.external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067-config.json
similarity index 50%
rename from .external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877-config.json
rename to .external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067-config.json
index 62d71e1..4f45cb0 100644
--- a/.external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877-config.json
+++ b/.external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067-config.json
@@ -6,97 +6,89 @@
 		],
 		"Env": [
 			"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-			"COLORTERM=true",
-			"DOCKER_SCOUT_SBOM_CATALOGERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger",
-			"DOCKER_SCOUT_ENVIRONMENT=indexer"
+			"COLORTERM=true"
 		],
 		"Labels": {
 			"com.docker.image.source.entrypoint": "Dockerfile",
-			"org.opencontainers.image.created": "2024-09-26T11:11:33.075Z",
+			"org.opencontainers.image.created": "2024-10-18T08:43:28.043Z",
 			"org.opencontainers.image.description": "Docker Scout CLI Plugin",
 			"org.opencontainers.image.licenses": "",
-			"org.opencontainers.image.revision": "99feeb65a0824ce8cf2ba4030dae010b3ce84957",
-			"org.opencontainers.image.source": "[email protected]:docker/scout-cli-plugin.git",
+			"org.opencontainers.image.revision": "c48ca6038e121579532a95276a9e7393a2b98550",
+			"org.opencontainers.image.source": "https://github.com/docker/scout-cli-plugin",
 			"org.opencontainers.image.title": "scout-cli-plugin",
 			"org.opencontainers.image.url": "https://github.com/docker/scout-cli-plugin",
-			"org.opencontainers.image.version": "1.14.1"
+			"org.opencontainers.image.version": "1.15.0"
 		},
 		"OnBuild": null,
 		"User": "docker-scout",
 		"WorkingDir": "/"
 	},
-	"created": "2024-09-26T10:11:12.841167179Z",
+	"created": "2024-10-18T08:47:01.171050111Z",
 	"history": [
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:11.344516595Z",
+			"created": "2024-10-18T08:43:31.574024733Z",
 			"created_by": "COPY /etc/passwd /etc/passwd # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:11.489322595Z",
+			"created": "2024-10-18T08:43:31.636392443Z",
 			"created_by": "COPY /etc/group /etc/group # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:11.770099303Z",
+			"created": "2024-10-18T08:43:31.707336263Z",
 			"created_by": "COPY /empty /tmp # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:11.945712553Z",
+			"created": "2024-10-18T08:43:31.790910835Z",
 			"created_by": "COPY /empty /home # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.095723178Z",
+			"created": "2024-10-18T08:43:40.379324941Z",
 			"created_by": "COPY /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.595110053Z",
+			"created": "2024-10-18T08:47:01.156884691Z",
 			"created_by": "COPY /go/src/dist/sbom-indexer /sbom-indexer # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.841167179Z",
+			"created": "2024-10-18T08:47:01.171050111Z",
 			"created_by": "COPY .vex/* /var/lib/db/vex/ # buildkit"
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.841167179Z",
+			"created": "2024-10-18T08:47:01.171050111Z",
 			"created_by": "ENV COLORTERM=true",
 			"empty_layer": true
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.841167179Z",
+			"created": "2024-10-18T08:47:01.171050111Z",
 			"created_by": "USER docker-scout",
 			"empty_layer": true
 		},
 		{
 			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.841167179Z",
+			"created": "2024-10-18T08:47:01.171050111Z",
 			"created_by": "ENTRYPOINT [\"/sbom-indexer\"]",
 			"empty_layer": true
-		},
-		{
-			"comment": "buildkit.dockerfile.v0",
-			"created": "2024-09-26T10:11:12.841167179Z",
-			"created_by": "ENV DOCKER_SCOUT_SBOM_CATALOGERS=php-composer-lock,erlang-otp-application,lua-rock-cataloger DOCKER_SCOUT_ENVIRONMENT=indexer",
-			"empty_layer": true
 		}
 	],
 	"os": "linux",
 	"rootfs": {
 		"diff_ids": [
-			"sha256:c2e7db17869c519cbc27a0e88fb169d7ac14dbe348bb448e25300a9bd9e10289",
-			"sha256:1a4c8454197c59eb8927d3aab61af0f698d5ed5195b68e27213421a2a062b51a",
-			"sha256:aff3f1f5ba469bd5bbd14ba98911f409a750c39243bf0868eba961bbca5627b9",
-			"sha256:e0c91b38aeadd65e1d497e2ea3ecfdb49c3bcad981efceecbdb5bd19f1976a45",
-			"sha256:24a813be93b828664775c7096fb307357fd688d09c9ae955cf79daad1405a068",
-			"sha256:b65e29c4a139e0648d54286742ac93ed2800318f464e82e78553a72023020d3c",
-			"sha256:4d603c7fd9ad101b8b1d317c6d203f4fc605ac2d2c29b54c6e743a0d83f4c006"
+			"sha256:2117968a12308b14cd914f06869dbe9dfd82abea7e04429e8d2b124ffbf114bb",
+			"sha256:e118c243aef150a7937a17fc7c01cfd378fe362f7f1fabe3fffe17c383042ba1",
+			"sha256:59bd82fd34fe15dcd1dfb0012292237b1e6c1235d2a0e56ebf357f935073e066",
+			"sha256:51a5f45c89bb9e55f487fbb86f5855a4de38836185e77c3ab0af045171484e16",
+			"sha256:4fbd5725e35e15b949ec92a273388c1f513069f23745bd9088a801a0f7e5d2e6",
+			"sha256:74585e6ee38c44f1e663979d545f5063d5eb419c5b205d2d65d4eeaa5f485ecd",
+			"sha256:135bcf550b0d11cbb240b0195f009e32ec67b71ca8de69d71a0ffabf784ae705"
 		],
 		"type": "layers"
 	}
diff --git a/.external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877.json b/.external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067.json
similarity index 45%
rename from .external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877.json
rename to .external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067.json
index 1cf3c33..ca465d4 100644
--- a/.external-pins/docker/scout-sbom-indexer___1-doi/manifest-sha256_3c5a6776b4361b270937c944c136ebb35fb8de65878deb9f22721c740298b877.json
+++ b/.external-pins/docker/scout-sbom-indexer___1/manifest-sha256_5fc2aba234b9dcb6c48fb742675af2db46e3673d31237645088435100ed2c067.json
@@ -1,44 +1,44 @@
 {
 	"config": {
-		"digest": "sha256:275a9a4a7dcd216152bec51880289ed660b1f80a58c7e6c2b183319a98fe8cdf",
+		"digest": "sha256:c3fc569a5ed1eb8674ef366cdf1cac6c7714595404b49deee6678c4c3124fdd7",
 		"mediaType": "application/vnd.oci.image.config.v1+json",
-		"size": 3135
+		"size": 2769
 	},
 	"layers": [
 		{
-			"digest": "sha256:f3a5c7d3228f67d0db71a6084e30f4d1f38feaae83b7c2e2f70e2fd129ab9a4d",
+			"digest": "sha256:5fcb9872042990529b82b517a99852f7c517107c15a1697958c553e1b723747e",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 451
+			"size": 447
 		},
 		{
-			"digest": "sha256:e902181874be737a507b8bcae27e0902bb3678a13ddd8076b6df5dd656eb4597",
+			"digest": "sha256:96c2f9d0077cf5bcc6337db3c9881d5b8dca79d7df550409810c2a75b1615e92",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 429
+			"size": 423
 		},
 		{
-			"digest": "sha256:89567579757e2d7255a9bc1d2219ebc28f86c441c8f5b779f338d13547c3fc90",
+			"digest": "sha256:816a4b5f827b654e5bdee2d88e5d045e572d1eacc5770296e8a29dbbdcae74aa",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 100
+			"size": 99
 		},
 		{
-			"digest": "sha256:7c800b5d298c597963542e819d4158c505f58ce22621ec973e1e2a321c33fbf4",
+			"digest": "sha256:0d4453cd024d1d47ecda2db71a0f7f2735c81844499a42802daa9c62b96a668b",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
 			"size": 101
 		},
 		{
-			"digest": "sha256:f4b8b819df520f8175b38883ab4f50b9dca5cc5c3428f91ea1f946c97884d591",
+			"digest": "sha256:ab0862ebc960ebcaa59fa7036d5e413e28d9d47d652b86a11f4e8c77a27146fc",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 126708
+			"size": 126712
 		},
 		{
-			"digest": "sha256:62f9846e8552bce261a6e452b7277ee3cb865327570bdc9caf8668f33ed05197",
+			"digest": "sha256:736ac40aae453671295351415556a78c176d76871d9aa2b2234e4679df07446a",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 19900968
+			"size": 19908592
 		},
 		{
-			"digest": "sha256:d8c34e4c24710f11f094c21333c9bd908228356a40b42500c0de543da4d7a00f",
+			"digest": "sha256:6e83cfb8a7f21d130082fa9ce427acada788d8172288f4ba9dfea3dbb50c9345",
 			"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
-			"size": 646
+			"size": 645
 		}
 	],
 	"mediaType": "application/vnd.oci.image.manifest.v1+json",

LaurentGoderre mentioned this pull request Oct 9, 2024

Add way to specify extra SBOM scanner docker-library/meta-scripts#86

Closed

tianon reviewed Oct 9, 2024

View reviewed changes

LaurentGoderre force-pushed the extra-sbom-scanners branch from bc10359 to 309e066 Compare October 10, 2024 16:30

LaurentGoderre requested a review from tianon October 10, 2024 16:30

LaurentGoderre marked this pull request as ready for review October 10, 2024 16:32

LaurentGoderre requested a review from a team as a code owner October 10, 2024 16:32

tianon reviewed Oct 10, 2024

View reviewed changes

LaurentGoderre force-pushed the extra-sbom-scanners branch from 309e066 to f9eaa98 Compare October 11, 2024 14:27

Send list of extra SBOM scanner to use

3f6fae9

LaurentGoderre force-pushed the extra-sbom-scanners branch from f9eaa98 to 3f6fae9 Compare October 18, 2024 14:08

github-actions bot added the external/docker/scout-sbom-indexer label Oct 18, 2024

tianon approved these changes Oct 18, 2024

View reviewed changes

yosifkit approved these changes Oct 18, 2024

View reviewed changes

tianon merged commit d459bfc into docker-library:master Oct 18, 2024
6 checks passed

LaurentGoderre deleted the extra-sbom-scanners branch October 18, 2024 20:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Send list of extra SBOM scanner to use #17699

Send list of extra SBOM scanner to use #17699

LaurentGoderre commented Oct 9, 2024

tianon Oct 9, 2024

LaurentGoderre Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 9, 2024

LaurentGoderre Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 9, 2024

tianon Oct 10, 2024

github-actions bot commented Oct 18, 2024

Send list of extra SBOM scanner to use #17699

Send list of extra SBOM scanner to use #17699

Conversation

LaurentGoderre commented Oct 9, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Oct 18, 2024