From 18f343c90c72084cad7f6d29f14721e1309ed1ac Mon Sep 17 00:00:00 2001
From: Wen Zhou <wenzhou@redhat.com>
Date: Thu, 12 Jan 2023 12:54:13 +0100
Subject: [PATCH] fix: inaccurate value "using docker" in sbom (#3045)
* fix: inaccurate value for if using docker image in sbom
generated content of docker.txt by get env variable:BUILDIMAGESHA passed from "doccker run"
* fix: set default to "N.A" if no env.variable BUILDIMAGESHA passed from docker
* fix: add check if cyclonedbx existing
---
sbin/build.sh | 17 ++++++++++++-----
sbin/prepareWorkspace.sh | 6 ++++++
2 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/sbin/build.sh b/sbin/build.sh
index a3df95236..33190ee38 100755
--- a/sbin/build.sh
+++ b/sbin/build.sh
@@ -760,7 +760,6 @@ generateSBoM() {
# Add OS full version (Kernel is covered in the first field)
addSBOMMetadataProperty "${javaHome}" "${classpath}" "${sbomJson}" "OS version" "${BUILD_CONFIG[OS_FULL_VERSION]^}"
addSBOMMetadataProperty "${javaHome}" "${classpath}" "${sbomJson}" "OS architecture" "${BUILD_CONFIG[OS_ARCHITECTURE]^}"
- addSBOMMetadataProperty "${javaHome}" "${classpath}" "${sbomJson}" "Use Docker for build" "${BUILD_CONFIG[USE_DOCKER]^}"
# Create JDK Component
addSBOMComponent "${javaHome}" "${classpath}" "${sbomJson}" "Eclipse Temurin" "${fullVer}" "${BUILD_CONFIG[BUILD_VARIANT]^} JDK Component"
@@ -794,9 +793,17 @@ generateSBoM() {
addSBOMMetadataTools "${javaHome}" "${classpath}" "${sbomJson}" "FreeType" "$(cat ${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/dependency_version_freetype.txt)"
# Add FreeMarker 3rd party (openj9)
addSBOMMetadataTools "${javaHome}" "${classpath}" "${sbomJson}" "FreeMarker" "$(cat ${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/dependency_version_freemarker.txt)"
- # Add Build Docker image SHA1
- addSBOMMetadataTools "${javaHome}" "${classpath}" "${sbomJson}" "Docker image SHA1" "$(cat ${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/docker.txt)"
+ # Add Build Docker image SHA1
+ buildimagesha=$(cat ${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/docker.txt)
+ # ${BUILD_CONFIG[USE_DOCKER]^} always set to false cannot rely on it.
+ if [ -n "${buildimagesha}" ] && [ "${buildimagesha}" != "N.A" ]; then
+ addSBOMMetadataProperty "${javaHome}" "${classpath}" "${sbomJson}" "Use Docker for build" "true"
+ addSBOMMetadataTools "${javaHome}" "${classpath}" "${sbomJson}" "Docker image SHA1" "${buildimagesha}"
+ else
+ addSBOMMetadataProperty "${javaHome}" "${classpath}" "${sbomJson}" "Use Docker for build" "false"
+ fi
+
# Print SBOM json
echo "CycloneDX SBOM:"
cat "${sbomJson}"
@@ -1803,7 +1810,7 @@ if [[ "${BUILD_CONFIG[ASSEMBLE_EXPLODED_IMAGE]}" == "true" ]]; then
printJavaVersionString
addInfoToReleaseFile
addInfoToJson
- if [[ "${BUILD_CONFIG[CREATE_SBOM]}" == "true" ]]; then
+ if [[ "${BUILD_CONFIG[CREATE_SBOM]}" == "true" ]] && [[ -d "${CYCLONEDB_DIR}" ]]; then
javaHome="$(setupAntEnv)"
buildCyclonedxLib "${javaHome}"
generateSBoM "${javaHome}"
@@ -1839,7 +1846,7 @@ if [[ "${BUILD_CONFIG[MAKE_EXPLODED]}" != "true" ]]; then
printJavaVersionString
addInfoToReleaseFile
addInfoToJson
- if [[ "${BUILD_CONFIG[CREATE_SBOM]}" == "true" ]]; then
+ if [[ "${BUILD_CONFIG[CREATE_SBOM]}" == "true" ]] && [[ -d "${CYCLONEDB_DIR}" ]]; then
javaHome="$(setupAntEnv)"
buildCyclonedxLib "${javaHome}"
generateSBoM "${javaHome}"
diff --git a/sbin/prepareWorkspace.sh b/sbin/prepareWorkspace.sh
index 533bd2a0e..7f7fd37f9 100644
--- a/sbin/prepareWorkspace.sh
+++ b/sbin/prepareWorkspace.sh
@@ -536,6 +536,11 @@ checkingAndDownloadingFreeType() {
echo "${FREETYPE_BUILD_INFO}" > "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/dependency_version_freetype.txt"
}
+# Recording Build image SHA into docker.txt
+writeDockerImageSHA(){
+ echo "${BUILDIMAGESHA-N.A}" > "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/docker.txt"
+}
+
# Generates cacerts file
prepareMozillaCacerts() {
echo "Generating cacerts from Mozilla's bundle"
@@ -682,4 +687,5 @@ function configureWorkspace() {
prepareMozillaCacerts
fi
fi
+ writeDockerImageSHA
}