go/goreleaser
1
0
Fork 0
mirror of https://github.com/goreleaser/goreleaser.git synced 2026-06-19 23:24:39 +02:00
Code Issues Releases Activity

fix: update SBOM generation to add .json as file type (#4781)

Browse Source 
- add the file type in the end of the sbom generated file 
- fix wrong value attribution in the doc example

---------

Signed-off-by: cpanato <ctadeu@gmail.com>
This commit is contained in:
Carlos Tadeu Panato Junior
2024-04-12 11:04:55 -03:00
committed by GitHub
parent 84df502f63
commit 780a3a40d9
3 changed files with 55 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/pipe/sbom/sbom.go
+2 -2
View File
@@ -63,11 +63,11 @@ func setConfigDefaults(cfg *config.SBOM) error {
if len(cfg.Documents) == 0 { if len(cfg.Documents) == 0 {
switch cfg.Artifacts { switch cfg.Artifacts {
case "binary": case "binary":
cfg.Documents = []string{"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"} cfg.Documents = []string{"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.json"}
case "any": case "any":
cfg.Documents = []string{} cfg.Documents = []string{}
default: default:
cfg.Documents = []string{"{{ .ArtifactName }}.sbom"} cfg.Documents = []string{"{{ .ArtifactName }}.sbom.json"}
} }
} }
if cfg.Cmd == "syft" { if cfg.Cmd == "syft" {
internal/pipe/sbom/sbom_test.go
+49 -49
View File
@@ -26,7 +26,7 @@ func TestDescription(t *testing.T) {
func TestSBOMCatalogDefault(t *testing.T) { func TestSBOMCatalogDefault(t *testing.T) {
defaultArgs := []string{"$artifact", "--output", "spdx-json=$document"} defaultArgs := []string{"$artifact", "--output", "spdx-json=$document"}
defaultSboms := []string{ defaultSboms := []string{
"{{ .ArtifactName }}.sbom", "{{ .ArtifactName }}.sbom.json",
} }
defaultCmd := "syft" defaultCmd := "syft"
tests := []struct { tests := []struct {
@@ -113,7 +113,7 @@ func TestSBOMCatalogDefault(t *testing.T) {
}, },
artifact: "binary", artifact: "binary",
cmd: defaultCmd, cmd: defaultCmd,
sboms: []string{"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"}, sboms: []string{"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.json"},
args: defaultArgs, args: defaultArgs,
}, },
{ {
@@ -261,8 +261,8 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
{Artifacts: "source"}, {Artifacts: "source"},
}, },
}), }),
sbomPaths: []string{"artifact5.tar.gz.sbom"}, sbomPaths: []string{"artifact5.tar.gz.sbom.json"},
sbomNames: []string{"artifact5.tar.gz.sbom"}, sbomNames: []string{"artifact5.tar.gz.sbom.json"},
}, },
{ {
desc: "catalog archives", desc: "catalog archives",
@@ -271,8 +271,8 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
{Artifacts: "archive"}, {Artifacts: "archive"},
}, },
}), }),
sbomPaths: []string{"artifact1.sbom", "artifact2.sbom"}, sbomPaths: []string{"artifact1.sbom.json", "artifact2.sbom.json"},
sbomNames: []string{"artifact1.sbom", "artifact2.sbom"}, sbomNames: []string{"artifact1.sbom.json", "artifact2.sbom.json"},
}, },
{ {
desc: "catalog linux packages", desc: "catalog linux packages",
@@ -281,8 +281,8 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
{Artifacts: "package"}, {Artifacts: "package"},
}, },
}), }),
sbomPaths: []string{"package1.deb.sbom"}, sbomPaths: []string{"package1.deb.sbom.json"},
sbomNames: []string{"package1.deb.sbom"}, sbomNames: []string{"package1.deb.sbom.json"},
}, },
{ {
desc: "catalog binaries", desc: "catalog binaries",
@@ -292,12 +292,12 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
}, },
}), }),
sbomPaths: []string{ sbomPaths: []string{
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
"artifact4-name_1.2.2_linux_amd64.sbom", "artifact4-name_1.2.2_linux_amd64.sbom.json",
}, },
sbomNames: []string{ sbomNames: []string{
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
"artifact4-name_1.2.2_linux_amd64.sbom", "artifact4-name_1.2.2_linux_amd64.sbom.json",
}, },
}, },
{ {
@@ -312,13 +312,13 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
"artifact5.tar.gz", "artifact5.tar.gz",
}, },
Documents: []string{ Documents: []string{
"final.sbom", "final.sbom.json",
}, },
}, },
}, },
}), }),
sbomPaths: []string{"final.sbom"}, sbomPaths: []string{"final.sbom.json"},
sbomNames: []string{"final.sbom"}, sbomNames: []string{"final.sbom.json"},
}, },
{ {
desc: "multiple SBOM configs", desc: "multiple SBOM configs",
@@ -334,21 +334,21 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
{ {
ID: "s2", ID: "s2",
Artifacts: "archive", Artifacts: "archive",
Documents: []string{"{{ .ArtifactName }}.{{ .Env.SBOM_SUFFIX }}.sbom"}, Documents: []string{"{{ .ArtifactName }}.{{ .Env.SBOM_SUFFIX }}.sbom.json"},
}, },
}, },
}), }),
sbomPaths: []string{ sbomPaths: []string{
"artifact1.s2-ish.sbom", "artifact1.s2-ish.sbom.json",
"artifact2.s2-ish.sbom", "artifact2.s2-ish.sbom.json",
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
"artifact4-name_1.2.2_linux_amd64.sbom", "artifact4-name_1.2.2_linux_amd64.sbom.json",
}, },
sbomNames: []string{ sbomNames: []string{
"artifact1.s2-ish.sbom", "artifact1.s2-ish.sbom.json",
"artifact2.s2-ish.sbom", "artifact2.s2-ish.sbom.json",
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
"artifact4-name_1.2.2_linux_amd64.sbom", "artifact4-name_1.2.2_linux_amd64.sbom.json",
}, },
}, },
{ {
@@ -362,10 +362,10 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
}, },
}), }),
sbomPaths: []string{ sbomPaths: []string{
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
}, },
sbomNames: []string{ sbomNames: []string{
"artifact3-name_1.2.2_linux_amd64.sbom", "artifact3-name_1.2.2_linux_amd64.sbom.json",
}, },
}, },
{ {
@@ -380,7 +380,7 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
"$artifact", "$artifact",
}, },
Documents: []string{ Documents: []string{
"{{ .ArtifactName }}.{{ .Env.TEST_USER }}.sbom", "{{ .ArtifactName }}.{{ .Env.TEST_USER }}.sbom.json",
}, },
}, },
}, },
@@ -389,12 +389,12 @@ func TestSBOMCatalogArtifacts(t *testing.T) {
}, },
}), }),
sbomPaths: []string{ sbomPaths: []string{
"artifact3-name.test-user-name.sbom", "artifact3-name.test-user-name.sbom.json",
"artifact4.test-user-name.sbom", "artifact4.test-user-name.sbom.json",
}, },
sbomNames: []string{ sbomNames: []string{
"artifact3-name.test-user-name.sbom", "artifact3-name.test-user-name.sbom.json",
"artifact4.test-user-name.sbom", "artifact4.test-user-name.sbom.json",
}, },
}, },
{ {
@@ -647,13 +647,13 @@ func Test_templateNames(t *testing.T) {
cfg: config.SBOM{}, cfg: config.SBOM{},
dist: "/somewhere/to/dist", dist: "/somewhere/to/dist",
expectedPaths: []string{ expectedPaths: []string{
"/somewhere/to/dist/name-it.sbom", "/somewhere/to/dist/name-it.sbom.json",
}, },
expectedValues: map[string]string{ expectedValues: map[string]string{
"artifact": "to/a/place", "artifact": "to/a/place",
"artifactID": "id-it", "artifactID": "id-it",
"document": "/somewhere/to/dist/name-it.sbom", "document": "/somewhere/to/dist/name-it.sbom.json",
"document0": "/somewhere/to/dist/name-it.sbom", "document0": "/somewhere/to/dist/name-it.sbom.json",
}, },
}, },
{ {
@@ -662,13 +662,13 @@ func Test_templateNames(t *testing.T) {
cfg: config.SBOM{}, cfg: config.SBOM{},
dist: "somewhere/to/dist", dist: "somewhere/to/dist",
expectedPaths: []string{ expectedPaths: []string{
filepath.Join(wd, "somewhere/to/dist/name-it.sbom"), filepath.Join(wd, "somewhere/to/dist/name-it.sbom.json"),
}, },
expectedValues: map[string]string{ expectedValues: map[string]string{
"artifact": "to/a/place", // note: this is always relative to ${dist} "artifact": "to/a/place", // note: this is always relative to ${dist}
"artifactID": "id-it", "artifactID": "id-it",
"document": filepath.Join(wd, "somewhere/to/dist/name-it.sbom"), "document": filepath.Join(wd, "somewhere/to/dist/name-it.sbom.json"),
"document0": filepath.Join(wd, "somewhere/to/dist/name-it.sbom"), "document0": filepath.Join(wd, "somewhere/to/dist/name-it.sbom.json"),
}, },
}, },
{ {
@@ -681,18 +681,18 @@ func Test_templateNames(t *testing.T) {
// note: the artifact name is probably an incorrect value here since it can't express all attributes // note: the artifact name is probably an incorrect value here since it can't express all attributes
// of the binary (os, arch, etc), so builds with multiple architectures will create SBOMs with the // of the binary (os, arch, etc), so builds with multiple architectures will create SBOMs with the
// same name. // same name.
"${artifact}.cdx.sbom", "${artifact}.cdx.sbom.json",
}, },
}, },
dist: "somewhere/to/dist", dist: "somewhere/to/dist",
expectedPaths: []string{ expectedPaths: []string{
filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom"), filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom.json"),
}, },
expectedValues: map[string]string{ expectedValues: map[string]string{
"artifact": "to/a/place", "artifact": "to/a/place",
"artifactID": "id-it", "artifactID": "id-it",
"document": filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom"), "document": filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom.json"),
"document0": filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom"), "document0": filepath.Join(wd, "somewhere/to/dist/to/a/place.cdx.sbom.json"),
}, },
}, },
{ {
@@ -700,19 +700,19 @@ func Test_templateNames(t *testing.T) {
artifact: art, artifact: art,
cfg: config.SBOM{ cfg: config.SBOM{
Documents: []string{ Documents: []string{
"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.cdx.sbom", "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.cdx.sbom.json",
}, },
}, },
version: "1.0.0", version: "1.0.0",
dist: "somewhere/to/dist", dist: "somewhere/to/dist",
expectedPaths: []string{ expectedPaths: []string{
filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
}, },
expectedValues: map[string]string{ expectedValues: map[string]string{
"artifact": "to/a/place", "artifact": "to/a/place",
"artifactID": "id-it", "artifactID": "id-it",
"document": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), "document": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
"document0": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), "document0": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
}, },
}, },
{ {
@@ -720,7 +720,7 @@ func Test_templateNames(t *testing.T) {
artifact: art, artifact: art,
cfg: config.SBOM{ cfg: config.SBOM{
Documents: []string{ Documents: []string{
"{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.cdx.sbom", "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.cdx.sbom.json",
}, },
Env: []string{ Env: []string{
"with-env-var=value", "with-env-var=value",
@@ -731,7 +731,7 @@ func Test_templateNames(t *testing.T) {
version: "1.0.0", version: "1.0.0",
dist: "somewhere/to/dist", dist: "somewhere/to/dist",
expectedPaths: []string{ expectedPaths: []string{
filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
}, },
expectedValues: map[string]string{ expectedValues: map[string]string{
"artifact": "to/a/place", "artifact": "to/a/place",
@@ -739,8 +739,8 @@ func Test_templateNames(t *testing.T) {
"with-env-var": "value", "with-env-var": "value",
"custom-os": "darwin-unique", "custom-os": "darwin-unique",
"custom-arch": "amd64-unique", "custom-arch": "amd64-unique",
"document": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), "document": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
"document0": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom"), "document0": filepath.Join(wd, "somewhere/to/dist/binary-name_1.0.0_darwin_amd64.cdx.sbom.json"),
}, },
}, },
} }
www/docs/customization/sbom.md
+4 -4
View File
@@ -46,12 +46,12 @@ sboms:
# "artifacts" is "any". # "artifacts" is "any".
# #
# Default: # Default:
# When "binary": ["{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"] # When "binary": ["{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.json"]
# When "any": [] # When "any": []
# Otherwise: ["{{ .ArtifactName }}.sbom"] # Otherwise: ["{{ .ArtifactName }}.sbom.json"]
# Templates: allowed # Templates: allowed
documents: documents:
- "${artifact}.spdx.sbom" - "${artifact}.spdx.sbom.json"
# Path to the SBOM generator command # Path to the SBOM generator command
# #
@@ -64,7 +64,7 @@ sboms:
# #
# Default: ["$artifact", "--output", "spdx-json=$document"] # Default: ["$artifact", "--output", "spdx-json=$document"]
# Templates: allowed # Templates: allowed
args: ["$artifact", "--output", "cyclonedx-json:$document"] args: ["$artifact", "--output", "cyclonedx-json=$document"]
# List of environment variables that will be passed to the SBOM command as # List of environment variables that will be passed to the SBOM command as
# well as the templates. # well as the templates.