mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
Garry Tan
10315cf44d
* v1.91.27.0 fix(cso): package-level signed SBOMs and staged probes in the verifier container * Qualified scanner catalogs persist scan outcomes; catalog-state tests hold for either state; SBOM tests live with their owner
9 lines
547 B
Plaintext
9 lines
547 B
Plaintext
# Reduce a BuildKit SPDX 2.3 SBOM to its package inventory before signing it.
|
|
# File entries (tens of thousands for Ruby or Python images) push the signed
|
|
# statement past actions/attest's 16 MiB limit; packages, their versions and
|
|
# package relationships are what CSO's release evidence relies on.
|
|
((.files // []) | map({key: .SPDXID, value: true}) | from_entries) as $files
|
|
| del(.files)
|
|
| .packages |= map(del(.hasFiles))
|
|
| .relationships |= map(select(($files[.spdxElementId] // false | not) and ($files[.relatedSpdxElement] // false | not)))
|