Run syft directly to collect SBOM #1787
Conversation
Can you quantify this or is this a wait and see? Curious how much improvement we will see for the scenarios mentioned in dotnet/dotnet-buildtools-prereqs-docker#1435. |
See dotnet/dotnet-buildtools-prereqs-docker#1435 (comment):
|
We could create and run a BTPR unofficial build pipeline with these changes. Otherwise it's a wait and see. @mthalman do you want to create an unofficial pipeline and do that? Or just go ahead with these changes without validating? |
| @@ -4,3 +4,4 @@ variables: | |||
| imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId) | |||
| imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner | |||
| imageNames.testRunner.withrepo: testrunner-withrepo:$(Build.BuildId)-$(System.JobId) | |||
| imageNames.syft: anchore/syft:v1.26.1 | |||
There was a problem hiding this comment.
How will this stay updated? Is there a way we can utilize dependabot or renovate here?
There was a problem hiding this comment.
I will log a follow-up issue to handle the automatic updating of the syft image tag that is defined in the YAML file.
Yes, Renovate could be used here.
There was a problem hiding this comment.
Can we update to v1.32.0-debug at least? That's the latest.
| imageNames.syft: anchore/syft:v1.26.1 | |
| imageNames.syft: anchore/syft:v1.32.0-debug |
I plan on just going with these changes and see what it looks like. It's definitely going to be faster. |
eng/common/Dockerfile.syft
Outdated
| FROM ${SYFT_IMAGE_NAME} AS syft | ||
| FROM ${TARGET_IMAGE_NAME} AS target | ||
|
|
||
| RUN --mount=from=syft,source=/,target=/syft /syft/syft scan / --select-catalogers image -o spdx-json=/manifest.spdx.json |
There was a problem hiding this comment.
Does this work for distroless images? Since it's using shell form and not exec form.
Here's the dotnet-docker test implementation, for reference: https://github.com/dotnet/dotnet-docker/blob/8e0a89c21c0eedc9658c3e4e9019693711869828/tests/Microsoft.DotNet.Docker.Tests/SyftHelper.cs#L138-L150
There was a problem hiding this comment.
Indeed it doesn't. I followed your pattern the tests. Fixed with 8fb672e. You should be able to consume this Dockerfile from the tests. I solved the issue of setting the source name by using an environment variable so I don't need to pass it in and have the value resolution problem.
Fixes dotnet/dotnet-buildtools-prereqs-docker#1435
Fixes https://github.com/dotnet/dotnet-docker-internal/issues/8172
Replaces the use of ManifestGeneratorTask with calling of the
syfttool directly in order to product SBOMs. This is done using a Dockerfile pattern that executessyfttargeting a local file system from within a container rather than callingsyfttargeting an image name. This greatly improves performance when targeting large images.I will log a follow-up issue to handle the automatic updating of the syft image tag that is defined in the YAML file.