Skip to content

Commit 31e20eb

Browse files
prabhuprabhu
committed
Linux musl builds
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
1 parent b2e464d commit 31e20eb

File tree

22 files changed

+193
-5
lines changed

22 files changed

+193
-5
lines changed

‎.github/workflows/native-builds.yml

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,24 +43,45 @@ jobs:
4343
- name: Build
4444
run: |
4545
bash thirdparty/sourcekitten/build.sh
46+
ls -al thirdparty/sourcekitten/SourceKitten/.build
4647
ls -l thirdparty/sourcekitten/SourceKitten/.build/release
4748
echo $GITHUB_TOKEN | oras login ghcr.io -u $GITHUB_USERNAME --password-stdin
4849
env:
4950
GITHUB_USERNAME: ${{ github.actor }}
5051
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5152
- name: Upload linux amd64
5253
run: |
53-
cd thirdparty/sourcekitten/SourceKitten/.build/release/
54-
oras push ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-amd64 \
54+
pushd thirdparty/trivy
55+
make build/linuxmusl_amd64
56+
popd
57+
sudo chown -R $USER:$USER thirdparty/trivy/build/
58+
mkdir -p uploads
59+
cp thirdparty/trivy/build/trivy* uploads/
60+
cp thirdparty/sourcekitten/SourceKitten/.build/release/sourcekitten uploads/
61+
cp thirdparty/sourcekitten/SourceKitten/.build/release/sourcekitten.sha256 uploads/
62+
cd uploads
63+
oras push --verbose --disable-path-validation ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-amd64 \
5564
--artifact-type application/vnd.oras.config.v1+json \
65+
./trivy-cdxgen-linuxmusl-amd64:application/vnd.cyclonedx.plugins.layer.v1+tar \
66+
./trivy-cdxgen-linuxmusl-amd64.sha256:application/vnd.cyclonedx.plugins.layer.v1+tar \
5667
./sourcekitten:application/vnd.cyclonedx.plugins.layer.v1+tar \
5768
./sourcekitten.sha256:application/vnd.cyclonedx.plugins.layer.v1+tar
5869
if: matrix.os == 'ubuntu-24.04'
5970
- name: Upload linux arm64
6071
run: |
61-
cd thirdparty/sourcekitten/SourceKitten/.build/release/
62-
oras push ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-arm64 \
72+
pushd thirdparty/trivy
73+
make build/linuxmusl_arm64
74+
popd
75+
sudo chown -R $USER:$USER thirdparty/trivy/build/
76+
mkdir -p uploads
77+
cp thirdparty/trivy/build/trivy* uploads/
78+
cp thirdparty/sourcekitten/SourceKitten/.build/release/sourcekitten uploads/
79+
cp thirdparty/sourcekitten/SourceKitten/.build/release/sourcekitten.sha256 uploads/
80+
cd uploads
81+
oras push --verbose --disable-path-validation ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-arm64 \
6382
--artifact-type application/vnd.oras.config.v1+json \
83+
./trivy-cdxgen-linuxmusl-arm64:application/vnd.cyclonedx.plugins.layer.v1+tar \
84+
./trivy-cdxgen-linuxmusl-arm64.sha256:application/vnd.cyclonedx.plugins.layer.v1+tar \
6485
./sourcekitten:application/vnd.cyclonedx.plugins.layer.v1+tar \
6586
./sourcekitten.sha256:application/vnd.cyclonedx.plugins.layer.v1+tar
6687
if: matrix.os == 'ubuntu-24.04-arm'

‎.github/workflows/release.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ jobs:
2525
if: matrix.os == 'ubuntu-latest'
2626
with:
2727
swift-version: '6.0'
28+
- name: Set up QEMU
29+
uses: docker/setup-qemu-action@v3
30+
- name: Set up Docker Buildx
31+
uses: docker/setup-buildx-action@v3
2832
- uses: oras-project/setup-oras@v1
2933
- run: oras version
3034
- name: Trim CI agent
@@ -66,6 +70,20 @@ jobs:
6670
npm publish --access=public --@cyclonedx:registry='https://registry.npmjs.org'
6771
popd
6872
73+
pushd packages/linuxmusl-amd64
74+
echo "cyclonedx:registry=https://npm.pkg.github.com" > ~/.npmrc
75+
npm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'
76+
echo "cyclonedx:registry=https://registry.npmjs.org" > ~/.npmrc
77+
npm publish --access=public --@cyclonedx:registry='https://registry.npmjs.org'
78+
popd
79+
80+
pushd packages/linuxmusl-arm64
81+
echo "cyclonedx:registry=https://npm.pkg.github.com" > ~/.npmrc
82+
npm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'
83+
echo "cyclonedx:registry=https://registry.npmjs.org" > ~/.npmrc
84+
npm publish --access=public --@cyclonedx:registry='https://registry.npmjs.org'
85+
popd
86+
6987
pushd packages/linux-riscv64
7088
echo "cyclonedx:registry=https://npm.pkg.github.com" > ~/.npmrc
7189
npm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'

‎.github/workflows/test.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ jobs:
2929
if: matrix.os == 'ubuntu-latest'
3030
with:
3131
swift-version: '6.0'
32+
- name: Set up QEMU
33+
uses: docker/setup-qemu-action@v3
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v3
3236
- uses: oras-project/setup-oras@v1
3337
- run: oras version
3438
- name: Trim CI agent
@@ -54,6 +58,12 @@ jobs:
5458
pushd packages/linux-arm64
5559
npm publish --dry-run
5660
popd
61+
pushd packages/linuxmusl-amd64
62+
npm publish --dry-run
63+
popd
64+
pushd packages/linuxmusl-arm64
65+
npm publish --dry-run
66+
popd
5767
pushd packages/linux-riscv64
5868
npm publish --dry-run
5969
popd

‎build.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ done
2121
upx -9 --lzma ./plugins/trivy/trivy-cdxgen-linux-amd64
2222
./plugins/trivy/trivy-cdxgen-linux-amd64 -v
2323

24-
for flavours in windows-amd64 linux-amd64 linux-arm64 linux-riscv64 linux-arm windows-arm64 darwin-arm64 darwin-amd64 ppc64
24+
for flavours in windows-amd64 linux-amd64 linux-arm64 linuxmusl-amd64 linuxmusl-arm64 linux-riscv64 linux-arm windows-arm64 darwin-arm64 darwin-amd64 ppc64
2525
do
2626
chmod +x packages/$flavours/build-$flavours.sh
2727
pushd packages/$flavours

‎packages/linux-amd64/build-linux-amd64.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ mkdir -p plugins/trivy plugins/osquery plugins/sourcekitten plugins/dosai
77

88
oras pull ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-amd64 -o plugins/sourcekitten/
99
sha256sum plugins/sourcekitten/sourcekitten > plugins/sourcekitten/sourcekitten.sha256
10+
rm -f plugins/sourcekitten/trivy-cdxgen-*
11+
ls -l plugins/sourcekitten/
1012

1113
wget https://github.com/osquery/osquery/releases/download/5.17.0/osquery-5.17.0_1.linux_x86_64.tar.gz
1214
tar -xf osquery-5.17.0_1.linux_x86_64.tar.gz

‎packages/linux-amd64/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"os": [
2929
"linux"
3030
],
31+
"libc": "glibc",
3132
"cpu": [
3233
"x64"
3334
]

‎packages/linux-arm/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"os": [
2929
"linux"
3030
],
31+
"libc": "glibc",
3132
"cpu": [
3233
"arm"
3334
]

‎packages/linux-arm64/build-linux-arm64.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ rm -rf plugins/sourcekitten
99
mkdir -p plugins/osquery plugins/dosai plugins/sourcekitten
1010

1111
oras pull ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-arm64 -o plugins/sourcekitten/
12+
rm -f plugins/sourcekitten/trivy-cdxgen-*
13+
ls -l plugins/sourcekitten/
1214

1315
wget https://github.com/osquery/osquery/releases/download/5.17.0/osquery-5.17.0_1.linux_aarch64.tar.gz
1416
tar -xf osquery-5.17.0_1.linux_aarch64.tar.gz

‎packages/linux-arm64/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"os": [
2929
"linux"
3030
],
31+
"libc": "glibc",
3132
"cpu": [
3233
"arm64"
3334
]

‎packages/linuxmusl-amd64/build-linuxmusl-amd64.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
set -e # Exit on error
3+
4+
# Remove old plugin directories to ensure a clean build
5+
rm -rf plugins/trivy plugins/dosai
6+
mkdir -p plugins/trivy plugins/dosai
7+
8+
# Download the Dosai binary
9+
curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai-linux-musl-x64 -o plugins/dosai/dosai
10+
chmod +x plugins/dosai/dosai
11+
sha256sum plugins/dosai/dosai > plugins/dosai/dosai.sha256
12+
13+
oras pull ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-amd64 -o plugins/trivy/
14+
rm -f plugins/trivy/sourcekitten*
15+
ls -l plugins/trivy/

‎packages/linuxmusl-amd64/index.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
console.log('Linux AMD64 package initialized.');

‎packages/linuxmusl-amd64/package.json

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"name": "@cyclonedx/cdxgen-plugins-bin-linuxmusl-amd64",
3+
"version": "1.6.12",
4+
"description": "Linux musl amd64 binary plugins to supercharge @cyclonedx/cdxgen npm package",
5+
"main": "index.js",
6+
"repository": {
7+
"type": "git",
8+
"url": "git+https://github.com/cyclonedx/cdxgen-plugins-bin.git"
9+
},
10+
"keywords": [
11+
"cdxgen",
12+
"sbom",
13+
"bom",
14+
"plugins",
15+
"dependency",
16+
"appsec"
17+
],
18+
"author": "Prabhu Subramanian <prabhu@appthreat.com>",
19+
"license": "Apache-2.0",
20+
"bugs": {
21+
"url": "https://github.com/cyclonedx/cdxgen-plugins-bin/issues"
22+
},
23+
"homepage": "https://github.com/cyclonedx/cdxgen-plugins-bin#readme",
24+
"files": [
25+
"*.js",
26+
"plugins/"
27+
],
28+
"os": [
29+
"linux"
30+
],
31+
"libc": "musl",
32+
"cpu": [
33+
"x64"
34+
]
35+
}

‎packages/linuxmusl-amd64/plugins/.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
goversion/
2+
trivy/
3+
cargo-auditable/
4+
osquery/
5+
dosai/
6+
sourcekitten/

‎packages/linuxmusl-amd64/plugins/.gitkeep

Whitespace-only changes.

‎packages/linuxmusl-amd64/plugins/.npmignore

Whitespace-only changes.

‎packages/linuxmusl-arm64/build-linuxmusl-arm64.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
set -e # Exit on error
3+
4+
# Remove old plugin directories to ensure a clean build
5+
rm -rf plugins/trivy plugins/dosai
6+
mkdir -p plugins/trivy plugins/dosai
7+
8+
# Download the Dosai binary
9+
curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai-linux-musl-arm64 -o plugins/dosai/dosai
10+
chmod +x plugins/dosai/dosai
11+
sha256sum plugins/dosai/dosai > plugins/dosai/dosai.sha256
12+
13+
oras pull ghcr.io/cyclonedx/cdxgen-plugins-bin:linux-arm64 -o plugins/trivy/
14+
rm -f plugins/trivy/sourcekitten*
15+
ls -l plugins/trivy/

‎packages/linuxmusl-arm64/index.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// Debug mode flag
2+
const DEBUG_MODE =
3+
process.env.CDXGEN_DEBUG_MODE === "debug" ||
4+
process.env.NODE_ENV === "development";
5+
6+
if (DEBUG_MODE) {
7+
console.log("cdxgen plugins check");
8+
}

‎packages/linuxmusl-arm64/package.json

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"name": "@cyclonedx/cdxgen-plugins-bin-linuxmusl-arm64",
3+
"version": "1.6.12",
4+
"description": "Linux musl arm64 binary plugins to supercharge @cyclonedx/cdxgen npm package",
5+
"main": "index.js",
6+
"repository": {
7+
"type": "git",
8+
"url": "git+https://github.com/cyclonedx/cdxgen-plugins-bin.git"
9+
},
10+
"keywords": [
11+
"cdxgen",
12+
"sbom",
13+
"bom",
14+
"plugins",
15+
"dependency",
16+
"appsec"
17+
],
18+
"author": "Prabhu Subramanian <prabhu@appthreat.com>",
19+
"license": "Apache-2.0",
20+
"bugs": {
21+
"url": "https://github.com/cyclonedx/cdxgen-plugins-bin/issues"
22+
},
23+
"homepage": "https://github.com/cyclonedx/cdxgen-plugins-bin#readme",
24+
"files": [
25+
"*.js",
26+
"plugins/"
27+
],
28+
"os": [
29+
"linux"
30+
],
31+
"libc": "musl",
32+
"cpu": [
33+
"arm64"
34+
]
35+
}

‎packages/linuxmusl-arm64/plugins/.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
goversion/
2+
trivy/
3+
cargo-auditable/
4+
osquery/
5+
dosai/
6+
sourcekitten/

‎packages/linuxmusl-arm64/plugins/.gitkeep

Whitespace-only changes.

‎packages/linuxmusl-arm64/plugins/.npmignore

Whitespace-only changes.

‎thirdparty/trivy/Makefile

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
PATH := $(PATH):/usr/local/go/bin:$HOME/go/bin:
22
appname := trivy-cdxgen
33
sources := main.go
4+
docker_cmd := docker
45

56
build = CGO_ENABLED=0 GOOS=$(1) GOARCH=$(2) go build -ldflags "-s -w -extldflags=-Wl,-z,now,-z,relro" -o build/$(appname)-$(1)-$(2)$(3)
67
sha = cd build && sha256sum $(appname)-$(1)-$(2)$(3) > $(appname)-$(1)-$(2)$(3).sha256
@@ -14,6 +15,8 @@ clean: rm -rf build/
1415
##### LINUX BUILDS #####
1516
linux: build/linux_amd64 build/linux_arm64 build/linux_arm build/linux_ppc64le build/linux_riscv64
1617

18+
linuxmusl: build/linuxmusl_amd64 build/linuxmusl_arm64
19+
1720
build/linux_386: $(sources)
1821
$(call build,linux,386,)
1922
$(call sha,linux,386,)
@@ -30,6 +33,14 @@ build/linux_arm64: $(sources)
3033
$(call build,linux,arm64,)
3134
$(call sha,linux,arm64,)
3235

36+
build/linuxmusl_%: $(sources)
37+
$(docker_cmd) run --rm \
38+
--platform=linux/$* \
39+
-v "$(PWD)":/src \
40+
-w /src \
41+
golang:1.19-alpine \
42+
sh -c 'CGO_ENABLED=0 GOOS=linux GOARCH=$* go build -ldflags "-s -w -extldflags=-Wl,-z,now,-z,relro" -o build/$(appname)-linuxmusl-$* && cd build && sha256sum $(appname)-linuxmusl-$* > $(appname)-linuxmusl-$*.sha256'
43+
3344
build/linux_ppc64le: $(sources)
3445
$(call build,linux,ppc64le,)
3546
$(call sha,linux,ppc64le,)

0 commit comments

Comments
 (0)