CalvinBackup/gstack
1
0 Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-11-09 18:28:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

v1.91.27.0 fix(cso): package-level signed SBOMs and staged probes in the verifier container

Browse Source
This commit is contained in:
garrytan committed 2026-10-05 14:23:37 +00:00
1 parent 857466ff8b
commit 25aa906439
10 files changed
+76 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/cso-runtime-images.yml
+3 -2
View File
@@ -209,8 +209,9 @@ jobs:
CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
run: |
set -eu
docker buildx imagetools inspect "$CSO_IMAGE" --format '{{ json .SBOM.SPDX }}' > sbom.spdx.json
jq -e '.spdxVersion == "SPDX-2.3" and (.packages | type == "array")' sbom.spdx.json
docker buildx imagetools inspect "$CSO_IMAGE" --format '{{ json .SBOM.SPDX }}' > sbom.full.spdx.json
jq -c -f scripts/cso-sbom-packages.jq sbom.full.spdx.json > sbom.spdx.json
jq -e -f scripts/cso-sbom-packages-check.jq sbom.spdx.json >/dev/null
- name: Sign build provenance
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
with:
.github/workflows/cso-scanner-images.yml
+3 -2
View File
@@ -145,8 +145,9 @@ jobs:
CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
run: |
set -eu
docker buildx imagetools inspect "$CSO_IMAGE" --format '{{ json .SBOM.SPDX }}' > sbom.spdx.json
jq -e '.spdxVersion == "SPDX-2.3" and (.packages | type == "array")' sbom.spdx.json
docker buildx imagetools inspect "$CSO_IMAGE" --format '{{ json .SBOM.SPDX }}' > sbom.full.spdx.json
jq -c -f scripts/cso-sbom-packages.jq sbom.full.spdx.json > sbom.spdx.json
jq -e -f scripts/cso-sbom-packages-check.jq sbom.spdx.json >/dev/null
- name: Sign build provenance
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
with: