Initial public release

scripts/generate_container_sbom.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TARGET_IMAGE="${1:-geointel-ci:local}"
+OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
+ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
+KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
+SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
+ARCHIVE_CREATED=false
+PARTIAL_ARCHIVE=""
+
+cleanup() {
+  if [ -n "$PARTIAL_ARCHIVE" ]; then
+    rm -f -- "$PARTIAL_ARCHIVE"
+  fi
+  if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
+    rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  fi
+}
+trap cleanup EXIT
+
+for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
+  case "$candidate" in
+    /*|*..*)
+      echo "SBOM paths must be repository-relative and may not contain '..'." >&2
+      exit 1
+      ;;
+  esac
+done
+
+IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
+test -n "$IMAGE_ID"
+mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
+
+ARCHIVE_ID=""
+if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
+  ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
+fi
+if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
+  rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
+  docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
+  mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
+  PARTIAL_ARCHIVE=""
+  printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
+  ARCHIVE_CREATED=true
+fi
+
+WORKDIR="/workspace"
+WORKSPACE_ARGS=(-v "$ROOT:/workspace")
+if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
+  # The Gitea job runs against TCP DinD. Reusing its workspace mounts keeps
+  # the archive inside the job boundary and avoids a privileged Docker API hop.
+  WORKDIR="$ROOT"
+  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
+fi
+
+# CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
+# heap below the isolated runner's 8 GiB limit and collect garbage proactively;
+# otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
+# worker. Authoritative dpkg, Python, npm and other installed-package catalogers
+# remain enabled; Trivy still scans the complete immutable archive independently.
+docker run --rm \
+  --user 0:0 \
+  -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
+  -e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
+  -e "GOGC=${SYFT_GOGC:-25}" \
+  "${WORKSPACE_ARGS[@]}" \
+  -w "$WORKDIR" \
+  "$SYFT_IMAGE" \
+  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
+  --select-catalogers=-binary \
+  -o "spdx-json=$OUTPUT"
+
+test -s "$ROOT/$OUTPUT"
+echo "SBOM written to $OUTPUT for $IMAGE_ID"