feat: being able to automatically pull and record attached SBOMS

未关闭
  • 哪里不对？
#244 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
停滞
技术栈
go
领域
cli, security

调研方向

The issue does not name implementation files or tests. Start by locating the CLI contract parsing and material-attachment entry points, then read how container-image metadata and cosign attestations are handled. The proposed behavior is complete when contracts can request an image-attached SBOM and the CLI downloads and records it, including in-toto predicates as well as raw SPDX or CycloneDX artifacts.

由索引模型根据 Issue 内容生成。

描述

component/artifact-cas component/CLI component/controlplane enhancement good first issue pinned security

A common use-case for people building and signing container images is to use cosign. Cosign allows not only to sign such container images but also in-toto attestations and SBOMS.

An operator, using Chainloop, might want to leverage this container image metadata and inject it as pieces of evidence.

Today this is possible by manually downloading the sbom (i.e oras pull) and then adding it to the attestation chainloop att add ....

We should simplify this process by automatically downloading, extracting and attaching such sboms.

One way we could do it is by extending the contract format

From

schemaVersion: v1

materials:
  - type: CONTAINER_IMAGE
    name: image
    output: true

  - type: SBOM_CYCLONEDX_JSON
    name: sbom

to

schemaVersion: v1

materials:
  - type: CONTAINER_IMAGE
    name: image
    output: true
    sboms:
      - type: SBOM_CYCLONEDX_JSON
        name: sbom

note how now operators can indicate that the container image to be added must "contain" an sbom. This new contract will indicate Chainloop CLI to find and download the sbom and attach it as sbom material type.

Note that this SBOMs might some as in-toto predicates too so we need to make sure we support not only raw spdx/cyclonedx artifacts but also in-toto specs

主要语言
Go
星标
582
派生
61
平均合并
12 小时 47 分钟
30 天内合并 PR
137

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

chainloop-dev/chainloop 的其他 Issue

查看 chainloop-dev/chainloop 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。