Add Supplier Support in JSON encoded SBOMs #269
Conversation
This commit adds support to the JSON serializer to render the originator and supplier into the SBOMs. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
|
@puerco: GitHub didn't allow me to request PR reviews from the following users: kubernetes-sigs/release-engineering. Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cpanato, puerco The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind bug
What this PR does / why we need it:
This PR modifies the json serializer to add the supplier and originator data. It seems that we forgot to add it to the type and SBOMs encoded in JSON were missing the supplier info. It's there now:
{ "SPDXID": "SPDXRef-Package-SPDXRef-Package-index.docker.io-library-debian-f5802c738e07905ae30f1006c922c1cce3a4955574751a44d5344e9cefabca8c-sha256-015f7b32198b1c57333fa9e151a0b54ccfe05dfef57e98b87c27d426f134db80-66d94da4-a71b-40b7-adc6-6d927d0f47e1", "name": "libp11-kit0", "versionInfo": "0.24.1-2", "filesAnalyzed": false, "supplier": "Person: Debian GnuTLS Maintainers (pkg-gnutls-maint@lists.alioth.debian.org)", "copyrightText": "NOASSERTION", "checksums": [], "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=arm64", "referenceType": "purl" } ] }None
Special notes for your reviewer:
This PR also adds a unit test to ensure we are parsing the data in the debian db as expected.
/cc @kubernetes-sigs/release-engineering
Does this PR introduce a user-facing change?