imjasonh/sbom-fun
1
0
Fork 0
mirror of https://github.com/imjasonh/sbom-fun synced 2026-07-07 00:42:36 +00:00
Code Activity
No description
6 commits 1 branch 0 tags 59 KiB
Find a file
Exact
Jason Hall 2d962e4a68
add test dependency on testify
2022-08-08 06:30:39 -04:00
.github/workflows load bearing v 2022-06-06 16:27:43 -04:00
.gitignore initial commit 2022-06-06 16:18:57 -04:00
go.mod add test dependency on testify 2022-08-08 06:30:39 -04:00
go.sum add test dependency on testify 2022-08-08 06:30:39 -04:00
LICENSE add license 2022-06-06 16:41:07 -04:00
main.go initial commit 2022-06-06 16:18:57 -04:00
main_amd64.go initial commit 2022-06-06 16:18:57 -04:00
main_arm64.go initial commit 2022-06-06 16:18:57 -04:00
main_ppc64le.go initial commit 2022-06-06 16:18:57 -04:00
main_test.go add test dependency on testify 2022-08-08 06:30:39 -04:00
main_windows.go initial commit 2022-06-06 16:18:57 -04:00
README.md add test dependency on testify 2022-08-08 06:30:39 -04:00

README.md

SBOM FUN!

This repo produces a multi-platform image when built with ko, where each platform-specific image has a different SBOM.

$ crane manifest ghcr.io/imjasonh/sbom-fun/github.com/imjasonh/sbom-fun | jq '.manifests[].platform'
{
  "architecture": "amd64",
  "os": "linux"
}
{
  "architecture": "arm",
  "os": "linux"
}
{
  "architecture": "arm64",
  "os": "linux"
}
{
  "architecture": "ppc64le",
  "os": "linux"
}
{
  "architecture": "s390x",
  "os": "linux"
}

Select a platform and get that image's digest, then get that image's SBOM:

$ crane digest ghcr.io/imjasonh/sbom-fun/github.com/imjasonh/sbom-fun --platform=linux/arm64
sha256:18f3efcc2edee3500445ee2b3a968834d1396cbcdd6300e4bd8b01b980c50b67

$ cosign download sbom ghcr.io/imjasonh/sbom-fun/github.com/imjasonh/sbom-fun@sha256:18f3efcc2edee3500445ee2b3a968834d1396cbcdd6300e4bd8b01b980c50b67 | jq -r '.components[].name'
github.com/BurntSushi/toml
github.com/google/go-github/v45
github.com/google/go-querystring
golang.org/x/crypto

Select a different platform, get a different SBOM:

$ crane digest ghcr.io/imjasonh/sbom-fun/github.com/imjasonh/sbom-fun --platform=linux/ppc64le
sha256:b4c3ee6f0f5093c27f3710a18209e6922f56b3a9e7efef53271f5b5d50b91745

$ cosign download sbom ghcr.io/imjasonh/sbom-fun/github.com/imjasonh/sbom-fun@sha256:b4c3ee6f0f5093c27f3710a18209e6922f56b3a9e7efef53271f5b5d50b91745 | jq -r '.components[].name'
github.com/BurntSushi/toml
github.com/google/go-cmp

There's also a test dependency on https://github.com/stretchr/testify, which shows up in go.mod but shouldn't appear in any image's SBOM since it's only a test dependency.