🐛 Right now `--sbom-dir` with a multi-arch build just writes the same file over and over.
This loosely follows the lead of apko which uses the form `sbom-{arch}.{form}.json`, but we are going with: `{app}-{platform}.{form}.json`.
It is notable that `{platform}` is a superset of `{arch}` and we sanitize the string encoding replacing the `/` and `:` characters with `-`.
/kind bug
* Support --tag and --tag-only with nop publisher
* log the output, for debugging
* unset KO_DOCKER_REPO for push=false test
* run e2e test first before other stuff
* review feedback
* Deprecate ko deps and ko run
* update-codegen.sh
* delete docs for deprecated stuff
* update deprecation message for ko run
* un-deprecate ko run
* add doc/ko_run.md
* Have `--image-refs` list all images for multi-arch builds.
This change alters the behavior of `--image-refs` to also include all of the image references when a multi-architecture build is being performed.
* Add test coverage for the new path
* Add ref count check to unit test
* Decorate per-architecture images with base image annotations.
Currently we only decorate the topmost index/image with base image data for the base index/image (for everything except docker manifest lists).
This change makes multi-arch builds decorate the manifest of the per-architecture images with the reference of the base index, and the digest of the specific base image used for that particular architecture's image.
This results in the per-architecture SBOMs starting to encode `DESCENDENT_OF` links as well.
* Add a detailed comment outlining why the per-arch digest is preferable even for cases where we want to watch the base index for updates.
This plumbs through support for building multi-arch SPDX SBOMs largely based on Puerco's outline, but with a few
adaptations. I added a few minor refactorings to try to enable consistency across the Image/Index SBOMs.
Related: https://github.com/google/ko/issues/655
* Unconditionally set the base image annotation.
Previously we only set this annotation when our base image was a tag, but this means when folks actually follow the best practice of use digest base images they get strictly worse resulting images!
It sounds like maybe the original motivation for this condition was that it was supposed to contain the mutable reference (tag), but I don't see anything detailing such a restriction (just an example), so there should be nothing
precluding this from the spec.
* Fold assignment into map initialization.
* check if have all and other platforms set in the --platform flag
Signed-off-by: cpanato <ctadeu@gmail.com>
* update per feedback
Signed-off-by: cpanato <ctadeu@gmail.com>
Matt Moore
Jon Johnson
Felix Yan
Carlos Tadeu Panato Junior
Batuhan Apaydın
Jason Hall
Michael GaschandJason Hall
Carlos Alexandro Becker
Reto Lehmann
Nico Braun
Ben Moss
Josh Wolf
Jason Hall
jonjohnsonjr
Ben Moss
Sean Liao