-
Notifications
You must be signed in to change notification settings - Fork 245
Description
If I got the report right (please correct me @azhuzhu), the syft source code analysis (producing SBOM data) needs the RPM sources after executing %prep/%generate_buildrequires, the closest existing thing to this requirement is the rpmbuild/BUILD
directory that we already have in every Mock build.
Running the syft
analysis as a part of the Mock build is not an optimal way to go, first the tool is not available in Fedora yet and it may take non-trivial time to run, slowing the overall mock build down. For the KONFLUX builds, the idea was that we could output the BUILD
directory snapshot as an additional Mock output artifact (in resultdir, snapshot done at the tight time, when dynamic deps become calculated) and let an external task to do finish syft run (in parallel with the hermetic part of build).