oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Sign checksums file and add SBOMs on release (#2548)

Browse Source 
* with release signature of checksums file
* attach SBOMs to the release
* update acceptance tests
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2024-01-30 13:16:40 -05:00
committed by GitHub
parent b113391638
commit aa702a72b4
5 changed files with 70 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/install/1_download_snapshot_asset_test.sh
+21
View File
@@ -60,26 +60,44 @@ test_negative_snapshot_download_asset() {
rm -rf -- "$tmpdir"
}
test_sboms_have_packages() {
find "$(snapshot_dir)/" -name "*.sbom" -print0 | while IFS= read -r -d '' file; do
count=$(cat "$file" | jq ".artifacts | length")
if [ "$count" -gt 80 ]; then
echo "not enough packages found for file: $file"
exit 1
fi
done
}
worker_pid=$(setup_snapshot_server)
trap 'teardown_snapshot_server ${worker_pid}' EXIT
# exercise all possible assets
run_test_case test_positive_snapshot_download_asset "linux" "amd64" "sbom"
run_test_case test_positive_snapshot_download_asset "linux" "amd64" "tar.gz"
run_test_case test_positive_snapshot_download_asset "linux" "amd64" "rpm"
run_test_case test_positive_snapshot_download_asset "linux" "amd64" "deb"
run_test_case test_positive_snapshot_download_asset "linux" "arm64" "sbom"
run_test_case test_positive_snapshot_download_asset "linux" "arm64" "tar.gz"
run_test_case test_positive_snapshot_download_asset "linux" "arm64" "rpm"
run_test_case test_positive_snapshot_download_asset "linux" "arm64" "deb"
run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "sbom"
run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "tar.gz"
run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "rpm"
run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "deb"
run_test_case test_positive_snapshot_download_asset "linux" "s390x" "sbom"
run_test_case test_positive_snapshot_download_asset "linux" "s390x" "tar.gz"
run_test_case test_positive_snapshot_download_asset "linux" "s390x" "rpm"
run_test_case test_positive_snapshot_download_asset "linux" "s390x" "deb"
run_test_case test_positive_snapshot_download_asset "darwin" "amd64" "sbom"
run_test_case test_positive_snapshot_download_asset "darwin" "amd64" "tar.gz"
run_test_case test_positive_snapshot_download_asset "darwin" "arm64" "sbom"
run_test_case test_positive_snapshot_download_asset "darwin" "arm64" "tar.gz"
run_test_case test_positive_snapshot_download_asset "windows" "amd64" "sbom"
run_test_case test_positive_snapshot_download_asset "windows" "amd64" "zip"
# note: the mac signing process produces a dmg which is not part of the snapshot process (thus is not exercised here)
@@ -89,5 +107,8 @@ run_test_case test_download_snapshot_asset_exercised_all_assets
# make certain we handle missing assets alright
run_test_case test_negative_snapshot_download_asset "bogus" "amd64" "zip"
# given we've downloaded the SBOMs, sanity check that they have a reasonable number of packages
run_test_case test_sboms_have_packages
trap - EXIT
teardown_snapshot_server "${worker_pid}"
test/install/environments/Dockerfile-alpine-3.6
+1 -1
View File
@@ -1,2 +1,2 @@
FROM alpine:3.6@sha256:66790a2b79e1ea3e1dabac43990c54aca5d1ddf268d9a5a0285e4167c8b24475
RUN apk update && apk add python3 wget unzip make ca-certificates
RUN apk update && apk add python3 wget unzip make ca-certificates jq
test/install/environments/Dockerfile-ubuntu-20.04
+1 -1
View File
@@ -1,2 +1,2 @@
FROM ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
RUN apt update -y && apt install make python3 curl unzip -y
RUN apt update -y && apt install make python3 curl unzip jq -y