Skip to content

Produce a BUILD directory snapshot for SBOM generators #1611

@praiskup

Description

@praiskup

If I got the report right (please correct me @azhuzhu), the syft source code analysis (producing SBOM data) needs the RPM sources after executing %prep/%generate_buildrequires, the closest existing thing to this requirement is the rpmbuild/BUILD directory that we already have in every Mock build.

Running the syft analysis as a part of the Mock build is not an optimal way to go, first the tool is not available in Fedora yet and it may take non-trivial time to run, slowing the overall mock build down. For the KONFLUX builds, the idea was that we could output the BUILD directory snapshot as an additional Mock output artifact (in resultdir, snapshot done at the tight time, when dynamic deps become calculated) and let an external task to do finish syft run (in parallel with the hermetic part of build).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions