feat(ubuntu-cpc): sbom generation everywhere

patch create_manifest to produce an sbom when called by an ubuntu-cpc
project. Patch all the ubuntu-cpc hooks and series files to include the
newly generated manifests, filelists, and sboms. Generates a number of
new artifacts in the builds. the snap utilized, cpc-sbom, is an open
source repo and a provided via a hidden snap. there is no intention of
publisizing the snap or how we generate sboms, however partners require
the ability to audit if required.

defensively checks if the snap is already installed, in the case of
multiple hooks being called in a single build (thus sharing a build
host), and only if called in an ubuntu-cpc project.

(cherry picked from commit 7c7b7df89dc96169db1f255d6bba901ebb63a43c)
ubuntu/jammy
John Chittum 4 months ago
parent fd817a8775
commit 2db8a8fce8
No known key found for this signature in database
GPG Key ID: 475060D72BBF8501

@ -37,6 +37,10 @@ create_empty_disk_image() {
create_manifest() { create_manifest() {
local chroot_root=${1} local chroot_root=${1}
local target_file=${2} local target_file=${2}
local base_default_sbom_name="ubuntu-cloud-image-$(grep "VERSION_ID" $chroot_root/etc/os-release | cut --delimiter "=" --field 2 | tr -d '"')-${ARCH}-$(date +%Y%m%dT%H:%M:%S)"
local sbom_file_name=${3:-"${base_default_sbom_name}.spdx"}
local sbom_document_name=${4:-"${base_default_sbom_name}"}
local sbom_log=${sbom_document_name}.log
echo "create_manifest chroot_root: ${chroot_root}" echo "create_manifest chroot_root: ${chroot_root}"
dpkg-query --show --admindir="${chroot_root}/var/lib/dpkg" > ${target_file} dpkg-query --show --admindir="${chroot_root}/var/lib/dpkg" > ${target_file}
echo "create_manifest call to dpkg-query finished." echo "create_manifest call to dpkg-query finished."
@ -45,7 +49,23 @@ create_manifest() {
if [ "$PROJECT" = ubuntu-cpc ]; then if [ "$PROJECT" = ubuntu-cpc ]; then
echo "create_manifest creating file listing." echo "create_manifest creating file listing."
local target_filelist=${2%.manifest}.filelist local target_filelist=${2%.manifest}.filelist
(cd "${chroot_root}" && find -xdev) > "${target_filelist}" (cd "${chroot_root}" && find -xdev) | sort > "${target_filelist}"
# only creating sboms for CPC project at this time
if [[ ! $(which cpc-sbom) ]]; then
# ensure the tool is installed
sudo snap install --classic --edge cpc-sbom
fi
# generate the SBOM
cpc-sbom --rootdir ${chroot_root} --ignore-copyright-parsing-errors --ignore-copyright-file-not-found-errors --document-name ${sbom_document_name} >"${sbom_file_name}" 2>"${sbom_log}"
SBOM_GENERATION_EXIT_CODE=$?
if [[ ${SBOM_GENERATION_EXIT_CODE} != "0" ]]; then
# check for failure and print log
echo "ERROR: SBOM generation failed. See ${sbom_log}"
cat "$sbom_log"
exit 1
else
echo "SBOM generation succeeded. see ${sbom_log} for details"
fi
fi fi
echo "create_manifest finished" echo "create_manifest finished"
} }

@ -24,6 +24,6 @@ rm -rf $rootfs_dir/boot/grub
# Keep this as some derivatives mount a tempfs here # Keep this as some derivatives mount a tempfs here
mkdir -p $rootfs_dir/lib/modules mkdir -p $rootfs_dir/lib/modules
teardown_mountpoint $rootfs_dir create_manifest $rootfs_dir "livecd.ubuntu-cpc.rootfs.manifest" "livecd.ubuntu-cpc.rootfs.spdx" "cloud-image-rootfs-$ARCH-$(date +%Y%m%dT%H:%M:%S)"
create_manifest "${rootfs_dir}" "${rootfs_dir}.manifest" teardown_mountpoint $rootfs_dir

@ -75,6 +75,10 @@ make_ext4_partition "${rootfs_dev_mapper}"
mkdir mountpoint mkdir mountpoint
mount "${rootfs_dev_mapper}" mountpoint mount "${rootfs_dev_mapper}" mountpoint
cp -a chroot/* mountpoint/ cp -a chroot/* mountpoint/
# the image has been modified from its disk-image-uefi base so the manifest and filelist should be regenerated
create_manifest "mountpoint/" "$PWD/livecd.ubuntu-cpc.disk-image.manifest" "$PWD/livecd.ubuntu-cpc.disk-image.spdx" "cloud-image-$ARCH-$(date +Y%m%dT%H:%M:%S)"
umount mountpoint umount mountpoint
rmdir mountpoint rmdir mountpoint

@ -452,6 +452,11 @@ EOF
rm mountpoint/tmp/device.map rm mountpoint/tmp/device.map
umount mountpoint/boot/efi umount mountpoint/boot/efi
mount mount
# create sorted filelist as the very last step before unmounting
# explicitly generate manifest and sbom
create_manifest "mountpoint/" "$PWD/livecd.ubuntu-cpc.disk-uefi.manifest" "$PWD/livecd.ubuntu-cpc.disk-uefi.spdx" "cloud-image-$ARCH-$(date +%Y%m%dT%H:%M:%S)"
umount_partition mountpoint umount_partition mountpoint
rmdir mountpoint rmdir mountpoint
} }
@ -467,6 +472,7 @@ make_ext4_partition "${rootfs_dev_mapper}"
mkdir mountpoint mkdir mountpoint
mount "${rootfs_dev_mapper}" mountpoint mount "${rootfs_dev_mapper}" mountpoint
cp -a chroot/* mountpoint/ cp -a chroot/* mountpoint/
umount mountpoint umount mountpoint
rmdir mountpoint rmdir mountpoint

@ -179,6 +179,8 @@ EOF
$ZIPL_EXTRA_PARAMS $ZIPL_EXTRA_PARAMS
fi fi
create_manifest "mountpoint/" "$PWD/livecd.ubuntu-cpc.disk-image.manifest" "$PWD/livecd.ubuntu-cpc.disk-image.spdx" "cloud-image-$ARCH-$(date +%Y%m%dT%H:%M:%S)"
if [ -n "$BOOT_MOUNTPOINT" ]; then if [ -n "$BOOT_MOUNTPOINT" ]; then
umount "mountpoint/$BOOT_MOUNTPOINT" umount "mountpoint/$BOOT_MOUNTPOINT"
fi fi

@ -2,8 +2,17 @@
. config/functions . config/functions
qcow_file=${PWD}/livecd.ubuntu-cpc.qcow
if [ -f binary/boot/disk-uefi.ext4 ]; then if [ -f binary/boot/disk-uefi.ext4 ]; then
convert_to_qcow2 binary/boot/disk-uefi.ext4 livecd.ubuntu-cpc.img convert_to_qcow2 binary/boot/disk-uefi.ext4 livecd.ubuntu-cpc.img
uefi_file="livecd.ubuntu-cpc.disk-uefi"
cp ${uefi_file}.manifest ${qcow_file}.manifest
cp ${uefi_file}.filelist ${qcow_file}.filelist
cp ${uefi_file}.spdx ${qcow_file}.spdx
elif [ -f binary/boot/disk.ext4 ]; then elif [ -f binary/boot/disk.ext4 ]; then
convert_to_qcow2 binary/boot/disk.ext4 livecd.ubuntu-cpc.img convert_to_qcow2 binary/boot/disk.ext4 livecd.ubuntu-cpc.img
disk_file="livecd.ubuntu-cpc.disk-image"
cp ${disk_file}.manifest ${qcow_file}.manifest
cp ${disk_file}.filelist ${qcow_file}.filelist
cp ${disk_file}.spdx ${qcow_file}.spdx
fi fi

@ -15,8 +15,11 @@ rootfs_dir=rootfs.dir
squashfs_f="$PWD/livecd.ubuntu-cpc.squashfs" squashfs_f="$PWD/livecd.ubuntu-cpc.squashfs"
cp $rootfs_dir.manifest $squashfs_f.manifest cp livecd.ubuntu-cpc.rootfs.manifest ${squashfs_f}.manifest
cp livecd.ubuntu-cpc.rootfs.filelist ${squashfs_f}.filelist
cp livecd.ubuntu-cpc.rootfs.spdx ${squashfs_f}.spdx
# fstab is omitted from the squashfs # fstab is omitted from the squashfs
grep -v '^/etc/fstab$' $rootfs_dir.filelist >$squashfs_f.filelist grep -v '^/etc/fstab$' livecd.ubuntu-cpc.rootfs.filelist >$squashfs_f.filelist
create_squashfs $rootfs_dir $squashfs_f create_squashfs $rootfs_dir $squashfs_f

@ -11,6 +11,4 @@ fi
# This is the directory created by create-root-dir.binary # This is the directory created by create-root-dir.binary
rootfs_dir=rootfs.dir rootfs_dir=rootfs.dir
cp $rootfs_dir.manifest livecd.ubuntu-cpc.rootfs.manifest
cp $rootfs_dir.filelist livecd.ubuntu-cpc.rootfs.filelist
(cd $rootfs_dir/ && tar -c --sort=name --xattrs *) | xz > livecd.ubuntu-cpc.rootfs.tar.xz (cd $rootfs_dir/ && tar -c --sort=name --xattrs *) | xz > livecd.ubuntu-cpc.rootfs.tar.xz

@ -8,3 +8,6 @@ provides livecd.ubuntu-cpc.kernel-generic
provides livecd.ubuntu-cpc.kernel-generic-lpae provides livecd.ubuntu-cpc.kernel-generic-lpae
provides livecd.ubuntu-cpc.manifest provides livecd.ubuntu-cpc.manifest
provides livecd.ubuntu-cpc.filelist provides livecd.ubuntu-cpc.filelist
provides livecd.ubuntu-cpc.disk-image.manifest
provides livecd.ubuntu-cpc.disk-image.filelist
provides livecd.ubuntu-cpc.disk-image.spdx

@ -6,3 +6,6 @@ provides livecd.ubuntu-cpc.kernel-generic
provides livecd.ubuntu-cpc.kernel-generic-lpae provides livecd.ubuntu-cpc.kernel-generic-lpae
provides livecd.ubuntu-cpc.manifest provides livecd.ubuntu-cpc.manifest
provides livecd.ubuntu-cpc.filelist provides livecd.ubuntu-cpc.filelist
provides livecd.ubuntu-cpc.disk-uefi.manifest
provides livecd.ubuntu-cpc.disk-uefi.filelist
provides livecd.ubuntu-cpc.disk-uefi.spdx

@ -1,3 +1,6 @@
depends disk-image depends disk-image
base/qcow2-image.binary base/qcow2-image.binary
provides livecd.ubuntu-cpc.img provides livecd.ubuntu-cpc.img
provides livecd.ubuntu-cpc.qcow.manifest
provides livecd.ubuntu-cpc.qcow.filelist
provides livecd.ubuntu-cpc.qcow.spdx

@ -3,3 +3,4 @@ base/root-squashfs.binary
provides livecd.ubuntu-cpc.squashfs provides livecd.ubuntu-cpc.squashfs
provides livecd.ubuntu-cpc.squashfs.manifest provides livecd.ubuntu-cpc.squashfs.manifest
provides livecd.ubuntu-cpc.squashfs.filelist provides livecd.ubuntu-cpc.squashfs.filelist
provides livecd.ubuntu-cpc.squashfs.spdx

@ -3,3 +3,4 @@ base/root-xz.binary
provides livecd.ubuntu-cpc.rootfs.tar.xz provides livecd.ubuntu-cpc.rootfs.tar.xz
provides livecd.ubuntu-cpc.rootfs.manifest provides livecd.ubuntu-cpc.rootfs.manifest
provides livecd.ubuntu-cpc.rootfs.filelist provides livecd.ubuntu-cpc.rootfs.filelist
provides livecd.ubuntu-cpc.rootfs.spdx

@ -1,3 +1,6 @@
depends disk-image depends disk-image
base/vagrant.binary base/vagrant.binary
provides livecd.ubuntu-cpc.vagrant.box provides livecd.ubuntu-cpc.vagrant.box
provides livecd.ubuntu-cpc.vagrant.manifest
provides livecd.ubuntu-cpc.vagrant.filelist
provides livecd.ubuntu-cpc.vagrant.spdx

@ -3,3 +3,6 @@ base/vmdk-image.binary
base/vmdk-ova-image.binary base/vmdk-ova-image.binary
provides livecd.ubuntu-cpc.vmdk provides livecd.ubuntu-cpc.vmdk
provides livecd.ubuntu-cpc.ova provides livecd.ubuntu-cpc.ova
provides livecd.ubuntu-cpc.vmdk.manifest
provides livecd.ubuntu-cpc.vmdk.filelist
provides livecd.ubuntu-cpc.vmdk.spdx

@ -80,6 +80,8 @@ EOF
chroot ${mount_d} chown -R vagrant:vagrant /home/vagrant/.ssh chroot ${mount_d} chown -R vagrant:vagrant /home/vagrant/.ssh
chroot ${mount_d} chmod 700 /home/vagrant/.ssh chroot ${mount_d} chmod 700 /home/vagrant/.ssh
create_manifest $mount_d "livecd.ubuntu-cpc.vagrant.manifest" "livecd.ubuntu-cpc.vagrant.spdx" "cloud-image-vagrant-$ARCH-$(date +%Y%m%dT%H:%M:%S)"
umount_disk_image "$mount_d" umount_disk_image "$mount_d"
rmdir "$mount_d" rmdir "$mount_d"

@ -20,8 +20,18 @@ esac
. config/functions . config/functions
vmdk_file="$PWD/livecd.ubuntu-cpc.vmdk"
if [ -e binary/boot/disk-uefi.ext4 ]; then if [ -e binary/boot/disk-uefi.ext4 ]; then
create_vmdk binary/boot/disk-uefi.ext4 livecd.ubuntu-cpc.vmdk create_vmdk binary/boot/disk-uefi.ext4 livecd.ubuntu-cpc.vmdk
uefi_file="livecd.ubuntu-cpc.disk-uefi"
cp ${uefi_file}.manifest ${vmdk_file}.manifest
cp ${uefi_file}.filelist ${vmdk_file}.filelist
cp ${uefi_file}.spdx ${vmdk_file}.spdx
elif [ -f binary/boot/disk.ext4 ]; then elif [ -f binary/boot/disk.ext4 ]; then
create_vmdk binary/boot/disk.ext4 livecd.ubuntu-cpc.vmdk create_vmdk binary/boot/disk.ext4 livecd.ubuntu-cpc.vmdk
disk_file="livecd.ubuntu-cpc.disk-image"
cp ${disk_file}.manifest ${vmdk_file}.manifest
cp ${disk_file}.filelist ${vmdk_file}.filelist
cp ${disk_file}.spdx ${vmdk_file}.spdx
fi fi

Loading…
Cancel
Save