Skip to content

SBOM: add support for CycloneDX v1.5 and add HOST_IMAGE SBOMSourceType#286

Closed
jinroh wants to merge 2 commits intomasterfrom
jinroh/sbom-host-image
Closed

SBOM: add support for CycloneDX v1.5 and add HOST_IMAGE SBOMSourceType#286
jinroh wants to merge 2 commits intomasterfrom
jinroh/sbom-host-image

Conversation

@jinroh
Copy link
Copy Markdown
Contributor

@jinroh jinroh commented Feb 7, 2024

What does this PR do?

Two changes in sbom.proto:

Motivation

cc @Bit-Doctor

Additional Notes

Possible Drawbacks / Trade-offs

Describe how to test/QA your changes

Reviewer's Checklist

Reviewers: please see the review guidelines.

@jinroh jinroh requested review from a team as code owners February 7, 2024 11:18
@jinroh jinroh force-pushed the jinroh/sbom-host-image branch from 8981c32 to 2a40370 Compare February 7, 2024 11:21
@jinroh jinroh requested review from a team as code owners February 7, 2024 11:21
@jinroh jinroh requested a review from a team February 7, 2024 11:21
@jinroh jinroh force-pushed the jinroh/sbom-host-image branch from 2a40370 to 64af5f2 Compare February 7, 2024 11:23
Comment thread proto/sbom/sbom.proto Outdated
Comment thread proto/sbom/sbom.proto
@@ -29,7 +30,8 @@ message SBOMEntity {
string hash = 9; // Hash of the SBOM
oneof sbom {
cyclonedx.v1_4.Bom cyclonedx = 10; // only cyclonedx will be supported initially but putting it optional will allow us to move to another format later
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m wondering if it would make sense to rename that field cyclonedx_1_4 for homogeneity with the new field.

Suggested change
cyclonedx.v1_4.Bom cyclonedx = 10; // only cyclonedx will be supported initially but putting it optional will allow us to move to another format later
cyclonedx.v1_4.Bom cyclonedx_1_4 = 10; // only cyclonedx will be supported initially but putting it optional will allow us to move to another format later

It would be a non source compatible change that will require to update:

when bumping the version of agent-payload in those repositories.
But as long as the ID (10) remains unchanged, it has no impact on the on-wire message.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. Can we plan that in another PR ?

Copy link
Copy Markdown
Contributor Author

@jinroh jinroh Feb 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or we can re-open two separate PRs. One for HOST_IMAGE and one for clyclonedx 1.5.x. That'll make things easier for us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants