Comments (2)
puerco
commented on July 22, 2024
As discussed at the contributor's summit, we will modernize the k8s sboms, so I think I'll build this.
from bom.
dharmjit
commented on July 22, 2024
I was also experimenting with bom utility to see the ingredients of K8s OCI Image and was wondering the same why it doesn't list the binary. Dumb question, Is there a way to see the packages, files, and binaries part of the OCI image underneath those OCI layers, or perhaps that is not what SBOMs are for?
bom generate --analyze-images --scan-images --format json --image registry.k8s.io/kube-apiserver@sha256:07ec0f29e172784b9fda870d63430a84befade590a2220c1fcce52f17cd24631 | bom document outline -
INFO bom v0.5.1: Generating SPDX Bill of Materials
INFO Processing image reference: registry.k8s.io/kube-apiserver@sha256:07ec0f29e172784b9fda870d63430a84befade590a2220c1fcce52f17cd24631
.........
📂 SPDX Document SBOM-SPDX-9e5b46f0-9aa4-4197-a1c0-66ad1450fa2d
│
│ 📦 DESCRIBES 1 Packages
│
├ sha256:07ec0f29e172784b9fda870d63430a84befade590a2220c1fcce52f17cd24631
│ │ 🔗 11 Relationships
│ ├ CONTAINS PACKAGE sha256:a7ca0d9ba68fdce7e15bc0952d3e898e970548ca24d57698725836c039086639
│ ├ CONTAINS PACKAGE sha256:fe5ca62666f04366c8e7f605aa82997d71320183e99962fa76b3209fdfbb8b58
│ ├ CONTAINS PACKAGE sha256:b02a7525f878e61fc1ef8a7405a2cc17f866e8de222c1c98fd6681aff6e509db
│ ├ CONTAINS PACKAGE sha256:fcb6f6d2c9986d9cd6a2ea3cc2936e5fc613e09f1af9042329011e43057f3265
│ ├ CONTAINS PACKAGE sha256:e8c73c638ae9ec5ad70c49df7e484040d889cca6b4a9af056579c3d058ea93f0
│ ├ CONTAINS PACKAGE sha256:1e3d9b7d145208fa8fa3ee1c9612d0adaac7255f1bbc9ddea7e461e0b317805c
│ ├ CONTAINS PACKAGE sha256:4aa0ea1413d37a58615488592a0b827ea4b2e48fa5a77cf707d0e35f025e613f
│ ├ CONTAINS PACKAGE sha256:7c881f9ab25e0d86562a123b5fb56aebf8aa0ddd7d48ef602faf8d1e7cf43d8c
│ ├ CONTAINS PACKAGE sha256:5627a970d25e752d971a501ec7e35d0d6fdcd4a3ce9e958715a686853024794a
│ ├ CONTAINS PACKAGE [email protected]
│ └ CONTAINS PACKAGE sha256:6021ef4e32c708f4759a7292b12fa3bb2999cedadbfad2e5c75ed0e08f471f9a
│
└ 📄 DESCRIBES 0 Files
from bom.
Related Issues (20)
- Error When Installing With Published Command
- Error When Creating SBOM for Image Specified with Digest HOT 2
- SPDX2.2: bom generates SBOM with invalid value for packageVerificationCodeValue
- [SPDX][TV/JSON] SBOM required field 'Creator' is missing/incorrect HOT 1
- Panic when building with both --image and --file HOT 3
- SBOMs support dependency hierarchy for file systems and containers HOT 13
- info? compare and contrast this project viz a viz anchore/syft HOT 5
- PackageFromDirectory segfault HOT 2
- Replace `golang.org/x/tools/go/vcs` HOT 5
- SPDX relationships like `DEPENDENCY_OF` and `TEST_DEPENDENCY_OF` seem to be not supported HOT 9
- Update asciinema tutorial to use mage not compile-release-tools HOT 4
- RPM Scanner does not work on layers where /var/lib/rpm is a symlink HOT 5
- Release v0.5.1 of `bom generate` can panic while main has been fixed, could we get v0.5.2? HOT 5
- typo maybe? HOT 3
- Record module version
- Push to github release HOT 1
- Refactor internals to use protobom
- Support for SBOMs in (signed) in-toto attestations
- Support reading/writing SBOMs from OCI registries
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bom.