Commit Graph
6 Commits
Author SHA1 Message Date
Matt Moore 9139f454d7 Populate base image information via DESCENDENT_OF (#744) 2022-07-05 15:19:03 -07:00
Matt Moore 2299765c54 Start emitting multi-arch SBOMs for SPDX with ko (#743)
This plumbs through support for building multi-arch SPDX SBOMs largely based on Puerco's outline, but with a few
adaptations.  I added a few minor refactorings to try to enable consistency across the Image/Index SBOMs.

Related: https://github.com/google/ko/issues/655
2022-07-05 12:47:15 -07:00
Matt Moore 787d625019 Unconditionally set the base image annotation. (#745)
* Unconditionally set the base image annotation.

Previously we only set this annotation when our base image was a tag, but this means when folks actually follow the best practice of use digest base images they get strictly worse resulting images!

It sounds like maybe the original motivation for this condition was that it was supposed to contain the mutable reference (tag), but I don't see anything detailing such a restriction (just an example), so there should be nothing
precluding this from the spec.

* Fold assignment into map initialization.
2022-07-05 11:17:28 -07:00
Matt Moore 31d1c612ba Fix off-by-one error (#742) 2022-07-01 10:09:28 -07:00
Matt Moore 12e5001192 Convert our SPDX SBOMs to spdx+json. (#740) 2022-07-01 07:13:30 -07:00
Matt Moore 31be2cb778 Take advantage of Chainguard maintained versions of various actions. (#609)
* Take advantage of Chainguard maintained versions of various actions.

* Bump cosign version
2022-02-23 07:23:48 -05:00