Skip to content

feat(build): sbom#12

Merged
asher merged 1 commit into
mainfrom
asher/sbom
Jun 26, 2026
Merged

feat(build): sbom#12
asher merged 1 commit into
mainfrom
asher/sbom

Conversation

@asher

@asher asher commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@asher

asher commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author
❯ cosign verify-attestation --type cyclonedx --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'edera-dev/edera-debug-report/.github/.*' ghcr.io/edera-dev/edera-debug-report-oci:latest | jq -r '.payload' | base64 -d | jq '.predicate.components[]["bom-ref"]'

Verification for ghcr.io/edera-dev/edera-debug-report-oci:latest --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates
Certificate subject: https://github.com/edera-dev/edera-debug-report/.github/workflows/build-oci.yml@refs/heads/asher/sbom
Certificate issuer URL: https://token.actions.githubusercontent.com
GitHub Workflow Trigger: workflow_dispatch
GitHub Workflow SHA: 02f10629f399c6704831571f9e718a1a1bf295c5
GitHub Workflow Name: build-oci-image
GitHub Workflow Repository: edera-dev/edera-debug-report
GitHub Workflow Ref: refs/heads/asher/sbom
"pkg:github/edera-dev/edera-debug-report@02f10629f399c6704831571f9e718a1a1bf295c5"
"pkg:generic/dmidecode@566922a"
"pkg:github/pciutils/pciutils@b424ac8b498317965bfd3ab33ae21b158a7f1dd2"
"pkg:generic/glibc@2.34-270.el9_8"
"pkg:generic/zlib@1.2.11-40.el9"

@bleggett bleggett left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving but we should actually gut this and its dependence on external C tools and just invoke sudo edera-check collect which collects the same info without external vendored binaries.

Comment thread generate-sbom.py
Comment on lines +4 to +10
The image is `FROM scratch` and ships, under /var/lib/edera/protect/support/:
- bin/dmidecode statically-linked C binary (submodule extern/dmidecode)
- bin/lspci, update-pciids statically-linked C binaries (submodule extern/pciutils)
- hwdata/pci.ids.gz PCI id database bundled with pciutils
- edera-debug-report the stdlib-only Python driver script (this repo)
- README.md

@bleggett bleggett Jun 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is another reason why we should just make this a script wrapper around

sudo edera-check collect - we collect the same DMI/lspci info there but with native Rust code and so we don't need to SBOM random in-tree CI binaries.

@asher asher merged commit 2155dd4 into main Jun 26, 2026
3 checks passed
@asher asher deleted the asher/sbom branch June 26, 2026 17:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants