From a5efbf54a52416f8032db00c98a2b206f8e20295 Mon Sep 17 00:00:00 2001 From: Sanjeev Rohila Date: Tue, 8 Sep 2026 17:23:10 +0530 Subject: [PATCH] DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar PR URL: https://www.github.com/delphix/linux-pkg/pull/417 --- .github/scripts/verify-sbom-scan-flag.sh | 24 ++ .github/workflows/main.yml | 5 + buildpkg.sh | 3 + ...6-09-08-sbom-per-package-sidecar-design.md | 279 ++++++++++++++++++ lib/common.sh | 61 ++++ packages/bcc/config.sh | 1 + packages/challenge-response/config.sh | 1 + packages/cloud-init/config.sh | 1 + packages/connstat/config.sh | 1 + packages/containerized-masking/config.sh | 2 + packages/crash-python/config.sh | 1 + packages/crypt-blowfish/config.sh | 1 + packages/cyclonedx-cli/config.sh | 1 + packages/delphix-go/config.sh | 1 + packages/delphix-kernel/config.sh | 1 + packages/delphix-platform/config.sh | 1 + packages/delphix-rust/config.sh | 2 + packages/delphix-sso-app/config.sh | 2 + packages/docker-python-image/config.sh | 1 + packages/drgn/config.sh | 1 + packages/dwarves/config.sh | 1 + packages/fluentd-gems/config.sh | 1 + packages/gdb-python/config.sh | 1 + packages/grub2/config.sh | 1 + packages/host-jdks/config.sh | 1 + packages/libkdumpfile/config.sh | 1 + packages/linux-kernel-aws/config.sh | 3 + packages/linux-kernel-azure/config.sh | 3 + packages/linux-kernel-gcp/config.sh | 3 + packages/linux-kernel-generic/config.sh | 3 + packages/linux-kernel-oracle/config.sh | 3 + packages/makedumpfile/config.sh | 1 + packages/masking/config.sh | 2 + packages/misc-debs/config.sh | 1 + packages/nfs-utils/config.sh | 1 + packages/performance-diagnostics/config.sh | 1 + packages/ptools/config.sh | 2 + packages/python-rtslib-fb/config.sh | 1 + packages/savedump/config.sh | 1 + packages/sdb/config.sh | 1 + packages/syft/config.sh | 1 + packages/targetcli-fb/config.sh | 1 + packages/virtualization/config.sh | 2 + packages/windows-connector/config.sh | 2 + packages/zfs/config.sh | 2 + query-packages.sh | 3 +- 46 files changed, 432 insertions(+), 1 deletion(-) create mode 100755 .github/scripts/verify-sbom-scan-flag.sh create mode 100644 docs/specs/2026-09-08-sbom-per-package-sidecar-design.md diff --git a/.github/scripts/verify-sbom-scan-flag.sh b/.github/scripts/verify-sbom-scan-flag.sh new file mode 100755 index 00000000..94691ddd --- /dev/null +++ b/.github/scripts/verify-sbom-scan-flag.sh @@ -0,0 +1,24 @@ +#!/bin/bash -ex + +set -o pipefail + +cd "$(git rev-parse --show-toplevel)" + +# +# Every package must explicitly set SBOM_DEEP_SCAN to "true" or "false" in +# its config.sh -- see docs on generate_sbom() in lib/common.sh. There is +# no default: a package that hasn't been classified yet must fail CI +# rather than silently ship without a CycloneDX sidecar or without an +# explicit decision that it doesn't need one. +# +unclassified=$(./query-packages.sh list -o name,sbom-deep-scan all | + awk -F'\t' '$2 == "none" { print $1 }') + +if [[ -n "$unclassified" ]]; then + echo "The following packages have not set SBOM_DEEP_SCAN (\"true\" or" \ + "\"false\") in their config.sh:" + echo "$unclassified" + exit 1 +fi + +echo "All packages have classified SBOM_DEEP_SCAN" diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e527d7c7..f46f4fe8 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -29,3 +29,8 @@ jobs: steps: - uses: actions/checkout@v1 - run: ./.github/scripts/verify-query-packages.sh + verify-sbom-scan-flag: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - run: ./.github/scripts/verify-sbom-scan-flag.sh diff --git a/buildpkg.sh b/buildpkg.sh index 891afb2a..57d184d1 100755 --- a/buildpkg.sh +++ b/buildpkg.sh @@ -137,6 +137,9 @@ stage build logmust cd "$WORKDIR" stage store_build_info +logmust cd "$WORKDIR" +stage generate_sbom + logmust cd "$WORKDIR" stage post_build_checks diff --git a/docs/specs/2026-09-08-sbom-per-package-sidecar-design.md b/docs/specs/2026-09-08-sbom-per-package-sidecar-design.md new file mode 100644 index 00000000..05349555 --- /dev/null +++ b/docs/specs/2026-09-08-sbom-per-package-sidecar-design.md @@ -0,0 +1,279 @@ +# SBOM Per-Package Sidecar Generation — Design + +- **Date:** 2026-09-08 +- **Jira:** [DLPX-98872](https://perforce.atlassian.net/browse/DLPX-98872) +- **Epic:** [CP-13455](https://perforce.atlassian.net/browse/CP-13455) — CycloneDX SBOM for Delphix engine product images +- **Implements:** Phase 2 (CP-13465) of `appliance-build`'s + `docs/specs/2026-06-23-sbom-generation-implementation-plan.md` +- **Companion to (in the `appliance-build` repo):** `docs/specs/2026-06-15-sbom-generation-design.md` + (CP-13456, the overall design) and `docs/specs/2026-08-13-syft-cyclonedx-cli-provisioning-design.md` + (CP-13600, how `syft`/`cyclonedx-cli` get onto a build host) +- **Implemented in:** this change (DLPX-98872) — see *Implementation* below. + +## Builds on: Phase 1 (already implemented) + +Phase 1 — the `appliance-build` per-image base scan (CP-13464) — and its `syft`/ +`cyclonedx-cli` provisioning prerequisite (CP-13600) are implemented, each with an open PR: + +| Repo | PR | What it does | +|---|---|---| +| `syft` | [#1](https://github.com/delphix/syft/pull/1) | Packaging repo for `delphix-syft` (fetches the pinned upstream release binary) | +| `cyclonedx-cli` | [#1](https://github.com/delphix/cyclonedx-cli/pull/1) | Packaging repo for `delphix-cyclonedx-cli` (same pattern) | +| `linux-pkg` | [#414](https://github.com/delphix/linux-pkg/pull/414) | Adds `packages/syft/`, `packages/cyclonedx-cli/`, listed in `package-lists/build/main.pkgs` (this branch is rebased on top of it) | +| `appliance-build` | [#892](https://github.com/delphix/appliance-build/pull/892) | Installs both `.deb`s onto the build host in `build-ancillary-repository.sh`; new `95-generate-sbom.binary` hook runs `syft scan dir:binary --select-catalogers dpkg` + `cyclonedx-cli validate` to emit `-.cdx.json` | +| `devops-gate` | [#4717](https://github.com/delphix/devops-gate/pull/4717) | `appliance_build_stage0.groovy` best-effort-fetches and archives the per-image `.cdx.json` | + +Net effect: `syft` and `cyclonedx-cli` are already real, buildable `linux-pkg` packages, +already on every build host's `PATH` (build-host-only tooling — never shipped in the image), +and every image already gets a flat, dpkg-only base SBOM. **Phase 2 has no new tooling +dependency to add** — it only needs to *invoke* `syft`, which is already available. + +## Problem + +The Phase 1 base scan lists every installed `.deb` as a flat `pkg:deb` component. That is +correct and sufficient for 3rd-party Debian packages, but wrong for Delphix's own +first-party packages: `masking`, `virtualization`, `delphix-sso-app`, `containerized-masking`, +`windows-connector`, `zfs`, `ptools`, and `delphix-rust` all bundle third-party components +across ecosystems (jars, npm, wheels, Rust crates) that `dpkg` cannot see — dpkg only knows +the files *it* placed, not what's vendored inside a jar or statically linked into a Rust +binary. Those components are invisible to a vulnerability scanner today. + +Per the original design's key decision, this composition must be captured **upstream, in +`linux-pkg`**, at build time, where the package's own build artifacts are present — not +reconstructed later from a stripped, compiled `.deb`. + +## Design and implementation + +All of the following is implemented in this change, entirely within `linux-pkg` — no other +repo needs to change for Phase 2 (see *S3 upload* below for why). + +### 1. `SBOM_DEEP_SCAN` — per-package opt-in flag + +Mirrors the existing `MEND_SCAN_APPLICABLE` convention: a plain variable set in a package's +`config.sh`. Unlike `MEND_SCAN_APPLICABLE` (opt-in only, unset elsewhere), this flag is a real +tri-state — "must deep-scan" / "explicitly doesn't need it" / "nobody has classified this +yet" — enforced by the CI lint in §3, so **every** package's `config.sh` now has an explicit +`SBOM_DEEP_SCAN="true"` or `SBOM_DEEP_SCAN="false"` (see §5). + +```bash +# packages//config.sh +SBOM_DEEP_SCAN="true" +``` + +### 2. `query-packages.sh` — surface the field + +`query-packages.sh` has a closed, hardcoded field enum — no generic "query any config.sh +variable" mechanism exists. Two edits: + +- `ALL_OUTPUT_FIELDS`: appended `sbom-deep-scan`. +- `print_package()`'s `case "$field"` block, alongside the `mend-scan)` arm: + ```bash + sbom-deep-scan) outarray+=("${SBOM_DEEP_SCAN:-none}") ;; + ``` + +`-o`'s comma-delimited parsing and validation against `ALL_OUTPUT_FIELDS` then works for the +new field automatically. `./query-packages.sh list -o name,sbom-deep-scan all` is the +mechanism both the CI lint (§3) and `appliance-build`'s future Phase 3 consumer use to find +flagged packages. + +### 3. CI lint — every package must be classified + +No existing precedent to extend — `MEND_SCAN_APPLICABLE` is opt-in with zero enforcement +anywhere in `linux-pkg`. New script `.github/scripts/verify-sbom-scan-flag.sh`, wired as a +`verify-sbom-scan-flag` job in `.github/workflows/main.yml` alongside the existing +`verify-query-packages*` jobs: + +```bash +unclassified=$(./query-packages.sh list -o name,sbom-deep-scan all | + awk -F'\t' '$2 == "none" { print $1 }') +if [[ -n "$unclassified" ]]; then + echo "The following packages have not set SBOM_DEEP_SCAN (\"true\" or" \ + "\"false\") in their config.sh:" + echo "$unclassified" + exit 1 +fi +``` + +The one-time classification of all 40 packages (§5) lands in the same change, so this lint +never lands red. + +### 4. `generate_sbom()` — sidecar generation + +Modeled on `store_build_info()` — a default stage function in `lib/common.sh` that packages +don't need to override, gated on the new flag: + +```bash +# lib/common.sh +function generate_sbom() { + if [[ "$SBOM_DEEP_SCAN" != "true" ]]; then + return 0 + fi + + local debs=("$WORKDIR/artifacts/"*.deb) + if [[ ! -e "${debs[0]}" ]]; then + die "SBOM_DEEP_SCAN is set but no .deb was found in" \ + "'$WORKDIR/artifacts'" + fi + + local sbom_file="$WORKDIR/artifacts/$PACKAGE.cdx.json" + local sbom_scratch_dir + sbom_scratch_dir="$(logmust mktemp -d)" + + # A package can emit more than one .deb from a single build (e.g. + # "zfs" splits into zfs-dkms, zfsutils-linux, etc.) -- scan each one + # into its own document, then merge into a single sidecar so there's + # exactly one .cdx.json per package, matching how + # appliance-build associates a sidecar to a package via COMPONENTS. + local deb sbom_parts=() + for deb in "${debs[@]}"; do + local part + part="$sbom_scratch_dir/$(basename "$deb").cdx.json" + logmust syft scan "$deb" \ + --source-name "$PACKAGE" \ + --source-version "$PACKAGE_VERSION" \ + -o "cyclonedx-json@1.6=$part" + sbom_parts+=("$part") + done + + if [[ ${#sbom_parts[@]} -eq 1 ]]; then + logmust cp "${sbom_parts[0]}" "$sbom_file" + else + logmust cyclonedx-cli merge \ + --input-files "${sbom_parts[@]}" \ + --output-format json \ + --output-file "$sbom_file" + fi + logmust rm -rf "$sbom_scratch_dir" + + logmust cyclonedx-cli validate \ + --input-file "$sbom_file" \ + --input-format json \ + --input-version v1_6 \ + --fail-on-errors +} +``` + +Wired into `buildpkg.sh` as a new stage between the two that already bracket this point: + +```bash +logmust cd "$WORKDIR" +stage store_build_info +logmust cd "$WORKDIR" +stage generate_sbom # <-- new +logmust cd "$WORKDIR" +stage post_build_checks +``` + +`stage` silently skips undefined hooks, so this is inert for every package until +`generate_sbom` is defined — defining it once in `lib/common.sh`, gated internally on the +flag, means no package needs its own override for the baseline case (only per-ecosystem +overrides, out of scope for Phase 2, would override the function in a package's `config.sh`, +the same way packages already override `build()`). + +**Resolved — multiple `.deb`s per package:** handled above via per-deb scan + `cyclonedx-cli +merge` into one sidecar. Verify against a real `zfs` build before merging (see *Follow-ups*). + +**Open — Syft's `.deb`-scan support:** not yet verified against the real `syft`/ +`cyclonedx-cli` binaries in this environment (neither is installed here). Confirm the pinned +`delphix-syft` version (`SYFT_VERSION` in the `syft` packaging repo) supports scanning a +standalone `.deb` file as a source (Phase 1 only exercises Syft against a directory/rootfs, +not a single `.deb`). If unsupported, fall back to extracting the `.deb`'s `data.tar.*` into +a temp dir first and scanning that directory instead. + +### 5. Package classification + +Per the original design's "does this package bundle third-party composition" criterion (not +strictly "is it 1st-party" — see the `zfs` case), `SBOM_DEEP_SCAN="true"` is set for: + +| Package | Why | +|---|---| +| `masking` | Java/Gradle app bundling jars + npm frontend | +| `virtualization` | Java/Gradle app bundling jars + npm frontend | +| `delphix-sso-app` | Java/Gradle app | +| `containerized-masking` | Java/Gradle app | +| `windows-connector` | Java/Gradle app | +| `zfs` | OpenZFS fork bundling Delphix's Rust object agent (crates invisible to dpkg) | +| `ptools` | Rust | +| `delphix-rust` | Rust | + +The remaining 32 packages (kernel packages, `misc-debs`, `syft`/`cyclonedx-cli` themselves, +etc.) get `SBOM_DEEP_SCAN="false"` — plain 3rd-party forks or single-ecosystem tools already +fully represented by the Phase 1 flat `pkg:deb` component. `delphix-go` is a judgment call: +the top-level design's Tooling section separately calls out a possible Go override +(`cyclonedx-gomod`); defaulted to `"false"` here (baseline Syft-on-deb has a Go +binary-build-info cataloger that may already cover it) — revisit under Phase 4's evaluation +if gaps are found. + +### S3 upload — no new plumbing needed + +Confirmed by reading `devops-gate/jenkins/jobs/pipelines/linux_pkg_build_package.groovy`'s +`Publish` stage: it runs `aws s3 sync --delete --only-show-errors . ${env.S3_PACKAGE_PATH}` +from inside `dir("linux-pkg/workdir/artifacts")` — i.e., it uploads **the entire artifacts +directory verbatim**, whatever stages before it dropped there (`store_build_info`'s +`GIT_HASH`/`BUILD_INFO` files, the built `.deb`(s), etc.). `generate_sbom()` writing +`.cdx.json` into that same directory is automatically picked up by this existing +sync — **no `devops-gate` change required for Phase 2**, unlike Phase 1 which needed a new +fetch step in `appliance_build_stage0.groovy` because that pipeline wasn't already pulling +per-package artifact directories at all. + +## Architecture diagram + +``` ++---------------------------------------------------------------------------+ +| linux-pkg package build (buildpkg.sh) | +| | +| stage build --> $WORKDIR/artifacts/*.deb | +| stage store_build_info --> GIT_HASH, BUILD_INFO, ... | +| stage generate_sbom --> [only if SBOM_DEEP_SCAN="true"] | +| syft scan -o cyclonedx-json@1.6 | +| (merge via cyclonedx-cli if >1 .deb) | +| --> $WORKDIR/artifacts/.cdx.json | +| cyclonedx-cli validate --fail-on-errors | +| stage post_build_checks | ++------------------------------------+--------------------------------------+ + | + | devops-gate Publish stage: + | aws s3 sync (whole artifacts/ dir, + | unmodified from Phase 1) + v ++---------------------------------------------------------------------------+ +| S3: combined-packages/packages// | +| *.deb | +| .cdx.json <-- NEW: sidecar, sits beside the deb(s) | +| GIT_HASH, BUILD_INFO, ... (unchanged) | ++---------------------------------------------------------------------------+ + | + | (Phase 3, not in scope here: + | appliance-build fetches + merges + | this sidecar into the Phase 1 base) + v + [out of scope for Phase 2] +``` + +## Out of scope for Phase 2 + +- Per-ecosystem overrides (`cargo-cyclonedx` for Rust, `cyclonedx-gradle-plugin` for + Java) — Phase 4's evaluation decides if the Syft-on-deb baseline here is good enough + first. +- `appliance-build` fetching/merging these sidecars into the per-image document — that's + Phase 3 (CP-13466), which explicitly depends on this phase completing. +- DCT/Hyperscale sidecars — deferred in the top-level design, not filed as a story yet. +- The `devops-gate` publishing switch (CSV → CycloneDX) — unrelated to sidecar generation. + +## Implementation status + +- [x] `SBOM_DEEP_SCAN` classification added to all 40 packages' `config.sh` (§5). +- [x] `sbom-deep-scan` field added to `query-packages.sh` (§2). +- [x] `generate_sbom()` added to `lib/common.sh` and wired as `stage generate_sbom` in + `buildpkg.sh` (§4), including the multi-`.deb` merge case. +- [x] CI lint added (§3), landed in the same change as the classification pass. +- [x] Verified locally: `verify-sbom-scan-flag.sh` and the existing + `verify-query-packages.sh` both pass; `shellcheck`/`shfmt` clean on every touched file. + +## Follow-ups before merging + +1. Validate against a real `syft`/`cyclonedx-cli` build host: confirm `syft scan ` + works as expected (the open question in §4), and run an actual `zfs` build (multi-`.deb` + package) and `masking` build (single-`.deb`, Java+npm) end-to-end — confirm + `$WORKDIR/artifacts/.cdx.json` is produced, schema-valid, and lands in S3. +2. File as sub-tasks of DLPX-98872. diff --git a/lib/common.sh b/lib/common.sh index 1faab9c7..d4ed860c 100644 --- a/lib/common.sh +++ b/lib/common.sh @@ -1461,6 +1461,67 @@ function store_build_info() { fi } +# +# Generate a per-package CycloneDX SBOM sidecar by running Syft against +# this package's built .deb(s). Only packages that bundle third-party +# composition (jars, npm, wheels, Rust crates, ...) opt in via +# SBOM_DEEP_SCAN="true" in their config.sh -- everything else is left as +# a flat pkg:deb component by appliance-build's base chroot scan, so a +# deb scan here would add nothing. The resulting .cdx.json is +# dropped in $WORKDIR/artifacts/ alongside the .deb(s), where it's picked +# up by the same S3 sync as every other build artifact -- no separate +# upload path needed. +# +function generate_sbom() { + if [[ "$SBOM_DEEP_SCAN" != "true" ]]; then + return 0 + fi + + local debs=("$WORKDIR/artifacts/"*.deb) + if [[ ! -e "${debs[0]}" ]]; then + die "SBOM_DEEP_SCAN is set but no .deb was found in" \ + "'$WORKDIR/artifacts'" + fi + + local sbom_file="$WORKDIR/artifacts/$PACKAGE.cdx.json" + local sbom_scratch_dir + sbom_scratch_dir="$(logmust mktemp -d)" + + # + # A package can emit more than one .deb from a single build (e.g. + # "zfs" splits into zfs-dkms, zfsutils-linux, etc.) -- scan each one + # into its own document, then merge them into a single sidecar so + # there's exactly one .cdx.json per package, matching how + # appliance-build associates a sidecar to a package via COMPONENTS. + # + local deb sbom_parts=() + for deb in "${debs[@]}"; do + local part + part="$sbom_scratch_dir/$(basename "$deb").cdx.json" + logmust syft scan "$deb" \ + --source-name "$PACKAGE" \ + --source-version "$PACKAGE_VERSION" \ + -o "cyclonedx-json@1.6=$part" + sbom_parts+=("$part") + done + + if [[ ${#sbom_parts[@]} -eq 1 ]]; then + logmust cp "${sbom_parts[0]}" "$sbom_file" + else + logmust cyclonedx-cli merge \ + --input-files "${sbom_parts[@]}" \ + --output-format json \ + --output-file "$sbom_file" + fi + logmust rm -rf "$sbom_scratch_dir" + + logmust cyclonedx-cli validate \ + --input-file "$sbom_file" \ + --input-format json \ + --input-version v1_6 \ + --fail-on-errors +} + function set_secret_build_args() { _SECRET_BUILD_ARGS=() diff --git a/packages/bcc/config.sh b/packages/bcc/config.sh index 047b6922..1094b594 100644 --- a/packages/bcc/config.sh +++ b/packages/bcc/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/bcc.git" +SBOM_DEEP_SCAN="false" UPSTREAM_GIT_URL=https://github.com/iovisor/bcc.git UPSTREAM_GIT_BRANCH=master diff --git a/packages/challenge-response/config.sh b/packages/challenge-response/config.sh index 997f96f8..6c29a67d 100644 --- a/packages/challenge-response/config.sh +++ b/packages/challenge-response/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/challenge-response.git" +SBOM_DEEP_SCAN="false" function prepare() { install_build_deps_from_control_file diff --git a/packages/cloud-init/config.sh b/packages/cloud-init/config.sh index dd720656..aab2ad00 100644 --- a/packages/cloud-init/config.sh +++ b/packages/cloud-init/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/cloud-init.git" +SBOM_DEEP_SCAN="false" UPSTREAM_SOURCE_PACKAGE=cloud-init diff --git a/packages/connstat/config.sh b/packages/connstat/config.sh index 4e50e1b4..08ea16ed 100644 --- a/packages/connstat/config.sh +++ b/packages/connstat/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/connstat.git" +SBOM_DEEP_SCAN="false" PACKAGE_DEPENDENCIES="@linux-kernel dwarves" function prepare() { diff --git a/packages/containerized-masking/config.sh b/packages/containerized-masking/config.sh index 36b06aca..57435956 100644 --- a/packages/containerized-masking/config.sh +++ b/packages/containerized-masking/config.sh @@ -40,6 +40,8 @@ DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/dms-core-gate.git" # PACKAGE_NEEDS_DOCKER="true" MEND_SCAN_APPLICABLE="true" +# Java/Gradle app +SBOM_DEEP_SCAN="true" MEND_SCAN_IMAGES="'delphix-masking-proxy', 'delphix-masking-database', 'delphix-masking-app'" SKIP_COPYRIGHTS_CHECK=true diff --git a/packages/crash-python/config.sh b/packages/crash-python/config.sh index 495597fc..ac839c98 100644 --- a/packages/crash-python/config.sh +++ b/packages/crash-python/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/crash-python.git" +SBOM_DEEP_SCAN="false" function prepare() { logmust install_build_deps_from_control_file diff --git a/packages/crypt-blowfish/config.sh b/packages/crypt-blowfish/config.sh index 04244a4b..5d1c45e0 100644 --- a/packages/crypt-blowfish/config.sh +++ b/packages/crypt-blowfish/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/crypt-blowfish.git" +SBOM_DEEP_SCAN="false" SKIP_COPYRIGHTS_CHECK=true function build() { diff --git a/packages/cyclonedx-cli/config.sh b/packages/cyclonedx-cli/config.sh index 3ee39875..ed56ae59 100755 --- a/packages/cyclonedx-cli/config.sh +++ b/packages/cyclonedx-cli/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/cyclonedx-cli.git" +SBOM_DEEP_SCAN="false" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/delphix-go/config.sh b/packages/delphix-go/config.sh index f9926295..9dfc17d1 100755 --- a/packages/delphix-go/config.sh +++ b/packages/delphix-go/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/delphix-go.git" +SBOM_DEEP_SCAN="false" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/delphix-kernel/config.sh b/packages/delphix-kernel/config.sh index 125836ff..c556cc25 100644 --- a/packages/delphix-kernel/config.sh +++ b/packages/delphix-kernel/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/delphix-kernel.git" +SBOM_DEEP_SCAN="false" PACKAGE_DEPENDENCIES="@linux-kernel" function prepare() { diff --git a/packages/delphix-platform/config.sh b/packages/delphix-platform/config.sh index 42e4ff4c..c83aa809 100644 --- a/packages/delphix-platform/config.sh +++ b/packages/delphix-platform/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/delphix-platform.git" +SBOM_DEEP_SCAN="false" function prepare() { logmust cd "$WORKDIR/repo" diff --git a/packages/delphix-rust/config.sh b/packages/delphix-rust/config.sh index 4f1f06c0..bc3a8b4f 100755 --- a/packages/delphix-rust/config.sh +++ b/packages/delphix-rust/config.sh @@ -17,6 +17,8 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/delphix-rust.git" +# Rust +SBOM_DEEP_SCAN="true" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/delphix-sso-app/config.sh b/packages/delphix-sso-app/config.sh index 6d1a9c05..5bc33ffe 100644 --- a/packages/delphix-sso-app/config.sh +++ b/packages/delphix-sso-app/config.sh @@ -18,6 +18,8 @@ DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/saml-app.git" MEND_SCAN_APPLICABLE="true" +# Java/Gradle app +SBOM_DEEP_SCAN="true" MEND_SCAN_USING_SUDO="true" function prepare() { diff --git a/packages/docker-python-image/config.sh b/packages/docker-python-image/config.sh index b80e6172..eb186627 100644 --- a/packages/docker-python-image/config.sh +++ b/packages/docker-python-image/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/docker-python-image.git" +SBOM_DEEP_SCAN="false" # # debian/rules' override_dh_install runs 'docker pull' to fetch the python # image it repackages, so the build needs a docker daemon. The build container diff --git a/packages/drgn/config.sh b/packages/drgn/config.sh index 0387a3a7..3f29a512 100644 --- a/packages/drgn/config.sh +++ b/packages/drgn/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/drgn.git" +SBOM_DEEP_SCAN="false" PACKAGE_DEPENDENCIES="libkdumpfile" UPSTREAM_GIT_URL="https://github.com/osandov/drgn.git" diff --git a/packages/dwarves/config.sh b/packages/dwarves/config.sh index 46965c54..86cfcc66 100644 --- a/packages/dwarves/config.sh +++ b/packages/dwarves/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/dwarves.git" +SBOM_DEEP_SCAN="false" UPSTREAM_GIT_URL="https://github.com/acmel/dwarves.git" UPSTREAM_GIT_BRANCH="master" diff --git a/packages/fluentd-gems/config.sh b/packages/fluentd-gems/config.sh index b511f1bb..2110330b 100644 --- a/packages/fluentd-gems/config.sh +++ b/packages/fluentd-gems/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/fluentd-gems.git" +SBOM_DEEP_SCAN="false" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/gdb-python/config.sh b/packages/gdb-python/config.sh index 014215f0..c36d22dd 100644 --- a/packages/gdb-python/config.sh +++ b/packages/gdb-python/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/gdb-python.git" +SBOM_DEEP_SCAN="false" PACKAGE_DEPENDENCIES="libkdumpfile" function prepare() { diff --git a/packages/grub2/config.sh b/packages/grub2/config.sh index 82452184..e280c484 100644 --- a/packages/grub2/config.sh +++ b/packages/grub2/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL=none +SBOM_DEEP_SCAN="false" SKIP_COPYRIGHTS_CHECK=true URI="s3://release-de-images/internal-artifacts/2025.3.0.1/1.0.53/input-artifacts/combined-packages/packages/grub2" diff --git a/packages/host-jdks/config.sh b/packages/host-jdks/config.sh index 5aec9a30..d0b93c80 100755 --- a/packages/host-jdks/config.sh +++ b/packages/host-jdks/config.sh @@ -23,6 +23,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/host-jdks.git" +SBOM_DEEP_SCAN="false" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/libkdumpfile/config.sh b/packages/libkdumpfile/config.sh index d1dd6f52..91976030 100644 --- a/packages/libkdumpfile/config.sh +++ b/packages/libkdumpfile/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/libkdumpfile.git" +SBOM_DEEP_SCAN="false" UPSTREAM_GIT_URL="https://codeberg.org/ptesarik/libkdumpfile.git" UPSTREAM_GIT_BRANCH="tip" diff --git a/packages/linux-kernel-aws/config.sh b/packages/linux-kernel-aws/config.sh index b2596d2f..1f00b06c 100644 --- a/packages/linux-kernel-aws/config.sh +++ b/packages/linux-kernel-aws/config.sh @@ -31,3 +31,6 @@ default) die "invalid linux-kernel package source '$linux_package_source'" ;; esac + +# shellcheck disable=SC2034 +SBOM_DEEP_SCAN="false" diff --git a/packages/linux-kernel-azure/config.sh b/packages/linux-kernel-azure/config.sh index 713b9b26..376cbadf 100644 --- a/packages/linux-kernel-azure/config.sh +++ b/packages/linux-kernel-azure/config.sh @@ -31,3 +31,6 @@ default) die "invalid linux-kernel package source '$linux_package_source'" ;; esac + +# shellcheck disable=SC2034 +SBOM_DEEP_SCAN="false" diff --git a/packages/linux-kernel-gcp/config.sh b/packages/linux-kernel-gcp/config.sh index 713b9b26..376cbadf 100644 --- a/packages/linux-kernel-gcp/config.sh +++ b/packages/linux-kernel-gcp/config.sh @@ -31,3 +31,6 @@ default) die "invalid linux-kernel package source '$linux_package_source'" ;; esac + +# shellcheck disable=SC2034 +SBOM_DEEP_SCAN="false" diff --git a/packages/linux-kernel-generic/config.sh b/packages/linux-kernel-generic/config.sh index 713b9b26..376cbadf 100644 --- a/packages/linux-kernel-generic/config.sh +++ b/packages/linux-kernel-generic/config.sh @@ -31,3 +31,6 @@ default) die "invalid linux-kernel package source '$linux_package_source'" ;; esac + +# shellcheck disable=SC2034 +SBOM_DEEP_SCAN="false" diff --git a/packages/linux-kernel-oracle/config.sh b/packages/linux-kernel-oracle/config.sh index 713b9b26..376cbadf 100644 --- a/packages/linux-kernel-oracle/config.sh +++ b/packages/linux-kernel-oracle/config.sh @@ -31,3 +31,6 @@ default) die "invalid linux-kernel package source '$linux_package_source'" ;; esac + +# shellcheck disable=SC2034 +SBOM_DEEP_SCAN="false" diff --git a/packages/makedumpfile/config.sh b/packages/makedumpfile/config.sh index 8eb407a5..3ad8172d 100644 --- a/packages/makedumpfile/config.sh +++ b/packages/makedumpfile/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/makedumpfile.git" +SBOM_DEEP_SCAN="false" UPSTREAM_SOURCE_PACKAGE="makedumpfile" diff --git a/packages/masking/config.sh b/packages/masking/config.sh index 92163bdb..2b767b0d 100644 --- a/packages/masking/config.sh +++ b/packages/masking/config.sh @@ -20,6 +20,8 @@ source "$PWD/lib/common.sh" DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/dms-core-gate.git" MEND_SCAN_APPLICABLE="true" +# Java/Gradle app bundling jars + npm frontend +SBOM_DEEP_SCAN="true" function prepare() { logmust read_list "$WORKDIR/repo/packaging/build-dependencies" diff --git a/packages/misc-debs/config.sh b/packages/misc-debs/config.sh index 19fa7c7d..32bb43bd 100644 --- a/packages/misc-debs/config.sh +++ b/packages/misc-debs/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL=none +SBOM_DEEP_SCAN="false" SKIP_COPYRIGHTS_CHECK=true # diff --git a/packages/nfs-utils/config.sh b/packages/nfs-utils/config.sh index 15e3c725..639097d6 100644 --- a/packages/nfs-utils/config.sh +++ b/packages/nfs-utils/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/nfs-utils.git" +SBOM_DEEP_SCAN="false" UPSTREAM_SOURCE_PACKAGE=nfs-utils diff --git a/packages/performance-diagnostics/config.sh b/packages/performance-diagnostics/config.sh index 4733a8c9..6d666c36 100644 --- a/packages/performance-diagnostics/config.sh +++ b/packages/performance-diagnostics/config.sh @@ -18,6 +18,7 @@ # DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/performance-diagnostics.git" +SBOM_DEEP_SCAN="false" function prepare() { logmust install_build_deps_from_control_file diff --git a/packages/ptools/config.sh b/packages/ptools/config.sh index 459cc4ca..c37a0625 100644 --- a/packages/ptools/config.sh +++ b/packages/ptools/config.sh @@ -17,6 +17,8 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/ptools.git" +# Rust +SBOM_DEEP_SCAN="true" function prepare() { logmust install_pkgs cargo devscripts diff --git a/packages/python-rtslib-fb/config.sh b/packages/python-rtslib-fb/config.sh index 024c025e..99c334ef 100644 --- a/packages/python-rtslib-fb/config.sh +++ b/packages/python-rtslib-fb/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/python-rtslib-fb.git" +SBOM_DEEP_SCAN="false" UPSTREAM_SOURCE_PACKAGE=python-rtslib-fb diff --git a/packages/savedump/config.sh b/packages/savedump/config.sh index 1e9bdda2..ba291b44 100644 --- a/packages/savedump/config.sh +++ b/packages/savedump/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/savedump.git" +SBOM_DEEP_SCAN="false" function prepare() { logmust install_build_deps_from_control_file diff --git a/packages/sdb/config.sh b/packages/sdb/config.sh index 3b36fed4..119abc18 100644 --- a/packages/sdb/config.sh +++ b/packages/sdb/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/sdb.git" +SBOM_DEEP_SCAN="false" UPSTREAM_GIT_URL="https://github.com/sdimitro/sdb.git" UPSTREAM_GIT_BRANCH="develop" diff --git a/packages/syft/config.sh b/packages/syft/config.sh index 987ee8f6..d4d40573 100755 --- a/packages/syft/config.sh +++ b/packages/syft/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/syft.git" +SBOM_DEEP_SCAN="false" function build() { logmust mkdir -p "$WORKDIR/repo" diff --git a/packages/targetcli-fb/config.sh b/packages/targetcli-fb/config.sh index abdc2ea3..3841b56b 100644 --- a/packages/targetcli-fb/config.sh +++ b/packages/targetcli-fb/config.sh @@ -17,6 +17,7 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/targetcli-fb.git" +SBOM_DEEP_SCAN="false" PACKAGE_DEPENDENCIES="python-rtslib-fb" UPSTREAM_SOURCE_PACKAGE=targetcli-fb diff --git a/packages/virtualization/config.sh b/packages/virtualization/config.sh index e7fe6b3a..50011848 100644 --- a/packages/virtualization/config.sh +++ b/packages/virtualization/config.sh @@ -27,6 +27,8 @@ PACKAGE_DEPENDENCIES="crypt-blowfish host-jdks" # PACKAGE_NEEDS_DOCKER="true" MEND_SCAN_APPLICABLE="true" +# Java/Gradle app bundling jars + npm frontend +SBOM_DEEP_SCAN="true" function prepare() { logmust read_list "$WORKDIR/repo/appliance/packaging/build-dependencies" diff --git a/packages/windows-connector/config.sh b/packages/windows-connector/config.sh index 40479cd2..663ff762 100644 --- a/packages/windows-connector/config.sh +++ b/packages/windows-connector/config.sh @@ -24,6 +24,8 @@ # doesn't depend on this variable. # DEFAULT_PACKAGE_GIT_URL="none" +# Java/Gradle app +SBOM_DEEP_SCAN="true" SKIP_COPYRIGHTS_CHECK=true function fetch() { diff --git a/packages/zfs/config.sh b/packages/zfs/config.sh index bd1edce5..ff2cbc8a 100644 --- a/packages/zfs/config.sh +++ b/packages/zfs/config.sh @@ -17,6 +17,8 @@ # shellcheck disable=SC2034 DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/zfs.git" +# OpenZFS fork bundling Delphix's Rust object agent +SBOM_DEEP_SCAN="true" PACKAGE_DEPENDENCIES="@linux-kernel delphix-rust delphix-go dwarves" UPSTREAM_GIT_URL="https://github.com/openzfs/zfs.git" diff --git a/query-packages.sh b/query-packages.sh index d92c7c23..612f70ed 100755 --- a/query-packages.sh +++ b/query-packages.sh @@ -25,7 +25,7 @@ source "$TOP/lib/common.sh" # export LOGGING=false -ALL_OUTPUT_FIELDS=(name git-url dependencies can-update mend-scan mend-scan-images mend-scan-using-sudo) +ALL_OUTPUT_FIELDS=(name git-url dependencies can-update mend-scan mend-scan-images mend-scan-using-sudo sbom-deep-scan) function usage() { local output_fields="${ALL_OUTPUT_FIELDS[*]}" @@ -73,6 +73,7 @@ function print_package() { mend-scan) outarray+=("${MEND_SCAN_APPLICABLE:-none}") ;; mend-scan-images) outarray+=("${MEND_SCAN_IMAGES:-none}") ;; mend-scan-using-sudo) outarray+=("${MEND_SCAN_USING_SUDO:-none}") ;; + sbom-deep-scan) outarray+=("${SBOM_DEEP_SCAN:-none}") ;; dependencies) for dep in $PACKAGE_DEPENDENCIES; do check_package_exists "$dep"