mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-04 08:28:19 +08:00
alangou
37072ee81c
* feat(build): embed auditable Rust dependency metadata Signed-off-by: Adrien Langou <alangou@nvidia.com> * feat(build): publish OCI SBOM and provenance attestations Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
54 lines
1.6 KiB
Bash
Executable File
54 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
# Validate the final image's SBOM attestation and, for auditable builds, require
|
|
# at least one Cargo package discovered from the binary metadata.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "${SCRIPT_DIR}/container-engine.sh"
|
|
|
|
usage() {
|
|
echo "Usage: verify-image-sbom.sh <image-ref> [--require-cargo]" >&2
|
|
}
|
|
|
|
IMAGE=${1:-}
|
|
REQUIRE_CARGO=${2:-}
|
|
if [[ -z "${IMAGE}" || $# -gt 2 || ( -n "${REQUIRE_CARGO}" && "${REQUIRE_CARGO}" != "--require-cargo" ) ]]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
if ! ce_is_docker; then
|
|
echo "Error: SBOM attestations are produced on the Docker/buildx path; ${CONTAINER_ENGINE} has no imagetools equivalent" >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "==> Inspecting SBOM attestation of ${IMAGE}"
|
|
SBOM_JSON="$(ce buildx imagetools inspect "${IMAGE}" --format '{{ json .SBOM }}')"
|
|
COUNTS="$(
|
|
jq -r '
|
|
[.. | objects | .SPDX? | select(type == "object")] as $documents
|
|
| [
|
|
($documents | length),
|
|
([$documents[] | .. | strings | select(startswith("pkg:cargo/"))] | length)
|
|
]
|
|
| @tsv
|
|
' <<<"${SBOM_JSON}"
|
|
)"
|
|
read -r SPDX_COUNT CARGO_COUNT <<<"${COUNTS}"
|
|
|
|
if [[ "${SPDX_COUNT}" -eq 0 ]]; then
|
|
echo "Error: ${IMAGE} carries no SPDX SBOM" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${REQUIRE_CARGO}" == "--require-cargo" && "${CARGO_COUNT}" -eq 0 ]]; then
|
|
echo "Error: ${IMAGE} SBOM contains no Cargo packages" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "SBOM attestation verified: SPDX=${SPDX_COUNT}, Cargo=${CARGO_COUNT}"
|