feat: publish final-payload SBOMs for extension images - #61
Open
ardentperf wants to merge 68 commits into
Open
ardentperf wants to merge 68 commits into
ardentperf wants to merge 68 commits into
Conversation
Generate the published SBOM from the post-install builder stage so it contains the PostgreSQL base image and extension dependency package inventory. Disable scanning of the final scratch stage and document the resulting scope.
Compose the full builder package inventory with the final scratch image file subjects, then attach the platform-specific SPDX predicate after the image build. Keep promoted production images supplied with the corrected SBOM.
Retain final-file package owners and referenced dependencies while using builder attestation subjects for the final file inventory.
Compose directly from the builder attestation and inject the stage selector only into the temporary metadata-build Dockerfile.
Match the current in-toto v1 and SPDX 2.3 metadata while rejecting registry image subjects that are not local final-file subjects.
Keep only packages that own files shipped in the final image and update the documentation and labels to match.
Include the extension name in synthetic package names and keep the SBOM documentation concise.
Use extension-artifacts instead of extension-payload for unowned final files.
Shorten the explanatory comments in the SBOM workflow.
Fail the SBOM workflow when the generated predicate is not the expected builder-stage SPDX document.
Move composer unit tests to the general test workflow instead of repeating them for every extension build.
The GitHub runner is ephemeral, so the temporary Dockerfile does not need explicit trap cleanup.
Generate the stage-selected Dockerfile with one redirecting sed command.
Remove the redundant path variable from the SBOM metadata build.
Remove the single-use composed SBOM path variable from the attachment loop.
Match the guard to the sbom-builder predicate emitted by the local BuildKit exporter.
Embed per-platform composition provenance in the signed SPDX SBOM attestation. Generate and validate manifests in the extension workflow while retaining BuildKit image provenance as a separate attestation.
Document the beta status and future schema compatibility expectations for SBOMs and SBOM/provenance annotations.
Use a repository-qualified namespace for SBOM composition annotations to avoid upstream naming collisions.
Document interim license-inventory and security-scanner goals while standards and build toolchains mature.
Generate the readable manifest with a heredoc and fail if its JSON is invalid.
Declare the supported amd64 and arm64 matrix once instead of rebuilding the same fixed list in the loop.
Keep the unrelated smoke-test matrix run block in its prior form and avoid inlining PREVIOUS_RELEASE.
Accept repeated builder SBOM and platform pairs, compose each platform in memory, and aggregate the results before writing the final SPDX document. Remove the temporary per-platform predicate pass and inline its single-use path variables.
Record and execute the same compose_args array so the provenance command cannot diverge from the invocation.
Use the existing manifest field check to validate JSON syntax and remove the redundant final SPDX annotation assertion.
Remove Cosign, which signs images separately, and the duplicate Python version from the SBOM composition manifest.
Restore the OIDC permission required by the production image copy/sign action, simplify invariant and duplicate JSON validation, make SBOM tests execute the same aggregate CLI used in CI, and correct the README provenance and tagging guidance.
Move aggregate SBOM composition and annotation logic into an executable script to keep the reusable workflow readable. Include the script in the focused test path filter and run a shell syntax check.
Restore the Naming & Tagging Convention section to the upstream version to avoid unrelated merge burden.
Document the working image-index verification and BuildKit provenance retrieval commands without unsupported terminology or tool guidance.
Keep the permissions comment identical to ext-main to avoid unrelated merge burden.
Keep the CNPG release matrix command formatted exactly as in ext-main.
Log in to GHCR in each isolated SBOM-attestation job before pushing the attestation artifact.
Scan shipped license files with a pinned ScanCode release and merge its SPDX expressions into file and package inventory fields. Preserve package-declared and concluded license values, retain custom license references, document the provisional behavior, and cover the workflow invocation with tests.
Populate package licenseDeclared with a conservative AND projection of file-derived license findings while retaining the detailed SPDX file fields and leaving licenseConcluded unchanged. Document that BuildKit's Syft SBOM can omit Debian package licenses and link the related upstream issues.
Scan copyright files by License stanzas, retain preambles, and only use file-derived licenses as a package fallback when no package declaration exists.
Trivy SBOM scanning cannot inspect /etc/os-release and does not infer the OS from Debian PURL distro qualifiers in these Syft SPDX inputs. Add a synthetic Debian OS package with the version from the builder PURLs and DESCRIBES/CONTAINS relationships so SBOM-only scans can select Debian advisories without the distro override. Preserve the SPDXRef-OperatingSystem- prefix through multi-platform aggregation; platform prefixing would otherwise hide Trivy OS detection. Add regression coverage and document the compatibility metadata as provisional.
ardentperf-agent
Bot
force-pushed
the
x-ai/ardentperf/final-payload-sbom
branch
from
September 6, 2026 16:40
ec07019 to
74b11a7
Compare
Document the two-step retrieval and Trivy scan for MobilityDB Trixie and pgAgent Bookworm.
Place the pgAgent example before the MobilityDB example for easier comparison.
Run the reusable testbuild job locally with act against a host-local registry while keeping the normal GitHub path unchanged. Local mode routes BuildKit over host networking and skips GHCR login, cosign installation, and image signing. Document the invocation and artifact output in README.
Allow compose_sboms.sh to receive an alternate Buildx bake file while retaining docker-bake.hcl as the default. Pass the explicit default from the workflow so the supported invocation is visible at the call site.
ardentperf
force-pushed
the
x-ai/ardentperf/final-payload-sbom
branch
from
September 10, 2026 19:22
ee03ea0 to
7828a03
Compare
Add optional Debian distro and platform filters to bake_targets.yml while preserving the default multi-distro, multi-platform build. Thread the same filters through aggregate SBOM composition and document the faster local test path.
ardentperf-agent
Bot
force-pushed
the
x-ai/ardentperf/final-payload-sbom
branch
from
September 12, 2026 20:17
9fec1a7 to
7d087eb
Compare
Restore the Cosign-based aggregate SBOM attestation flow and its verification documentation.
ardentperf-agent
Bot
force-pushed
the
x-ai/ardentperf/final-payload-sbom
branch
2 times, most recently
from
September 12, 2026 23:31
6807d26 to
a359ad0
Compare
Reuse the upstream PostGIS ldd-based staging logic for extension images.
ardentperf-agent
Bot
force-pushed
the
x-ai/ardentperf/final-payload-sbom
branch
from
September 12, 2026 23:48
a359ad0 to
a0822b5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Publish a final-payload SPDX SBOM for each extension image and attach it as one signed, aggregate multi-platform attestation.
This PR:
linux/amd64andlinux/arm64.^License:stanzas while retaining each file's preamble to avoid timeouts onlarge copyright files.
populate a package
licenseDeclaredonly when the package has no existinglicense declaration, preserving package metadata supplied by Syft.
The SBOM composition manifest is embedded as a document-level SPDX
OTHERannotation. It records:The final SPDX document’s own hash is intentionally excluded from the manifest to avoid circular hashing. The signed attestation and immutable OCI subject digest bind the final content.
Provisional status
The SBOM and all SBOM/provenance annotations are a beta, provisional implementation. They are not a complete or final OpenSSF Baseline compliance claim. Their schema and fields may change or be removed as the project moves toward stronger and more complete OpenSSF compliance.
The interim goal is to make the provisional data useful for license inventory and consumption by security scanners while industry standards and build toolchains continue to mature.
Debian binary package control metadata does not provide a standard license field
that can be used as a fallback. The composition therefore uses the shipped
/usr/share/doc/<package>/copyrightfiles for the provisional ScanCode licenseinventory.
Verification and usage
See the README for instructions covering:
Validation
python3 scripts/test_compose_sbom.py— 11 tests passing.bash -n scripts/compose_sboms.shpython3 -m py_compile scripts/compose_sbom.py scripts/test_compose_sbom.pygit diff --checksucceeds.72.5 seconds with zero ScanCode errors; the unsplit file exceeded ScanCode's
120-second per-file timeout.
plrSBOM composition completed successfully.The GitHub-hosted workflow remains necessary to validate OIDC signing, GHCR authentication, and GitHub attestation publication.