Repository navigation

DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar - #418

Merged

justsanjeev merged 17 commits into

developfrom

dlpx/pr/justsanjeev/721d0991-92c3-46ab-a792-d34028a44ae9

Oct 1, 2026

Merged

DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar#418
justsanjeev merged 17 commits into
developfrom
dlpx/pr/justsanjeev/721d0991-92c3-46ab-a792-d34028a44ae9

Commits on Sep 9, 2026
Commits on Sep 10, 2026
- DLPX-98872: suppress Syft's file-metadata component in per-package SBOM
  justsanjeev
  committed
  bdabf2b
- DLPX-98872: pin cyclonedx-cli merge's --output-version to v1_6
  
  justsanjeev
  and
  claude
  committed
  703a4de
- DLPX-98872: strict 1:1 .deb <-> BOM mapping, drop cyclonedx-cli merge
  
  justsanjeev
  and
  claude
  committed
  8923f53
Commits on Sep 11, 2026
- DLPX-98872: provision syft/cyclonedx-cli as generic build tooling
  
  justsanjeev
  and
  claude
  committed
  3d769d7
- DLPX-98872: explain the SBOM_DEEP_SCAN decision in the lint failure
  
  justsanjeev
  and
  claude
  committed
  7934898
Commits on Sep 14, 2026
- DLPX-98872: extract each .deb before scanning it
  
  justsanjeev
  and
  claude
  committed
  e5921bb
- DLPX-98872: enable SBOM deep scan for performance-diagnostics
  
  justsanjeev
  and
  claude
  committed
  06fedec
Commits on Sep 18, 2026
- DLPX-98872: sanitize the CycloneDX sidecar before publishing it
  
  justsanjeev
  and
  claude
  committed
  751943f
- DLPX-98872: retain syft:package:type in the sanitized sidecar
  
  justsanjeev
  and
  claude
  committed
  2f05bef
Commits on Sep 24, 2026
- DLPX-98872: type the SBOM root as application and declare a flat dependency graph
  
  justsanjeev
  and
  claude
  committed
  40ed440
Commits on Sep 25, 2026
- DLPX-98872: fix sanitize_sbom() crashing when Syft finds no components
  
  justsanjeev
  and
  claude
  committed
  15f355b
Commits on Sep 28, 2026
- DLPX-98872 TEMPORARY DO NOT MERGE: default CYCLONEDX_FILTERING to false
  
  justsanjeev
  and
  claude
  committed
  eb9e155
Commits on Sep 29, 2026
- post testing that flipping the flag CYCLONEDX_FILTERING to false is stopping the bom filtering, which is working fine. Changing back the CYCLONEDX_FILTERING to true
  justsanjeev
  committed
  a4d72b4
Commits on Sep 30, 2026
- DLPX-98872: drop the "sidecar" jargon in favour of SBOM
  
  justsanjeev
  and
  claude
  committed
  cc46d94

Navigation Menu

Repository navigation

DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar - #418

DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar#418
justsanjeev merged 17 commits into
developfrom
dlpx/pr/justsanjeev/721d0991-92c3-46ab-a792-d34028a44ae9

Commits on Sep 9, 2026

DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar

fixed packages/docker-python-image/config.sh

DLPX-98872 fix: install syft/cyclonedx-cli before generate_sbom, fix version

Commits on Sep 10, 2026

DLPX-98872: suppress Syft's file-metadata component in per-package SBOM

DLPX-98872: pin cyclonedx-cli merge's --output-version to v1_6

DLPX-98872: strict 1:1 .deb <-> BOM mapping, drop cyclonedx-cli merge

Commits on Sep 11, 2026

DLPX-98872: provision syft/cyclonedx-cli as generic build tooling

DLPX-98872: explain the SBOM_DEEP_SCAN decision in the lint failure

Commits on Sep 14, 2026

DLPX-98872: extract each .deb before scanning it

DLPX-98872: enable SBOM deep scan for performance-diagnostics

Commits on Sep 18, 2026

DLPX-98872: sanitize the CycloneDX sidecar before publishing it

DLPX-98872: retain syft:package:type in the sanitized sidecar

Commits on Sep 24, 2026

DLPX-98872: type the SBOM root as application and declare a flat dependency graph

Commits on Sep 25, 2026

DLPX-98872: fix sanitize_sbom() crashing when Syft finds no components

Commits on Sep 28, 2026

DLPX-98872 TEMPORARY DO NOT MERGE: default CYCLONEDX_FILTERING to false

Commits on Sep 29, 2026

post testing that flipping the flag CYCLONEDX_FILTERING to false is stopping the bom filtering, which is working fine. Changing back the CYCLONEDX_FILTERING to true

Commits on Sep 30, 2026

DLPX-98872: drop the "sidecar" jargon in favour of SBOM