14 Commits

Author SHA1 Message Date
Michael Stapelberg
703a860502 sbom: do not hash source files, record buildid of binaries instead
Before this commit, the mere presence of files with certain names in local
package directories would make the build fail (see nonmodulefiles_test.go).

With this commit, we now record the buildinfo and buildid of all built Go
programs of this gokrazy instance.

related to https://github.com/gokrazy/gokrazy/issues/297

fixes https://github.com/gokrazy/gokrazy/issues/299
2025-02-21 18:51:16 +01:00
Michael Stapelberg
4726b7d4b2 sbom: fix ExtraFileHashes paths (accidentally pointed to go.mod)
related to https://github.com/gokrazy/gokrazy/issues/299
2025-02-21 17:52:03 +01:00
Michael Stapelberg
70c48e594c sbom: use absolute instancePath, not (relative) config.InstancePath
fixes https://github.com/gokrazy/gokrazy/issues/292
2025-01-25 21:02:04 +01:00
Michael Stapelberg
5762235ac5 make ExtraFilePaths absolute earlier to fix sbom in relative parents
fixes https://github.com/gokrazy/gokrazy/issues/289
2025-01-22 21:49:32 +01:00
Michael Stapelberg
feda2a35da sbom: move too-late os.Chdir call earlier
This fixes errors such as:

2024/09/11 08:41:50 Error: build directory
"/home/michael/gokrazy/router7/builddir/github.com/stapelberg/prober7/cmd/probe"
does not exist in
"/home/michael/gokrazy/router7/builddir/github.com/gokrazy/serial-busybox"
2024-09-11 08:47:35 +02:00
Michael Stapelberg
a2dd9b9a09 sbom: move os.Chdir into 'gok sbom' (but not gokr-packer)
fixes #51
2024-09-09 17:20:07 +02:00
oliverpool
e53ba4e609 Satisfy staticcheck (#74)
* remove deprecated ioutil usage

* use more suitable functions

* add missing error handling

* remove unused variables

* select{} instead of for{}
2024-07-04 17:35:15 +02:00
Damiano Donati
1c3069c7e6 fix sbom generation inconsistency, take 2 (#66) 2023-10-25 08:39:46 +02:00
Damiano Donati
84c24f75e1 fix sbom generation inconsistency (#61)
prior to this commit SBOMs would have inconsistency in their hashing on
the configuration file.

The representation of the config file in fact would differ at certain
stages of the gok commands lifecycle, where at packer running time,
an extra InternalCompatibilityFlag, Sudo, would be added in memory
(while that not being the case at `gok sbom` time),
resulting in a differing config and as such differing SBOM hashes, same
goes for the differing pointer addresses that were skew the hashing
results.

This is now fixed by using the SudoOrDefault() accessor,
as well as converting the config into a string before computing the hash,
to avoid differing pointer problems.
2023-10-11 17:46:50 +02:00
Michael Stapelberg
7b9dd260c5 sbom: chdir to build directory to make relative replace paths work
fixes https://github.com/gokrazy/tools/issues/49
2023-03-11 11:14:30 +01:00
Michael Stapelberg
626d0c7d06 sbom: include replace directives
We do this by using the dirhash package, but filtering out any hidden
files (starting with .) and using hash/fnv because we are not interested in
cryptographically secure hashes of local directory contents, just whether the
contents changed.

fixes https://github.com/gokrazy/gokrazy/issues/171
2023-02-16 22:48:10 +01:00
Michael Stapelberg
2b269a6d8d correctly plumb through config struct to GenerateSBOM 2023-02-05 21:43:49 +01:00
Michael Stapelberg
20bd48bfb6 include SBOM as /etc/gokrazy/sbom.json
related to https://github.com/gokrazy/gokrazy/issues/167
2023-02-05 16:14:49 +01:00
Damiano Donati
db4f55e31a gok sbom: prefactor mv GenerateSBOM to internal/packer 2023-02-05 13:51:32 +01:00