Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
79 lines
2.7 KiB
Bash
79 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
|
|
IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
|
|
ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
|
|
KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
|
|
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
|
|
ARCHIVE_CREATED=false
|
|
PARTIAL_ARCHIVE=""
|
|
|
|
cleanup() {
|
|
if [ -n "$PARTIAL_ARCHIVE" ]; then
|
|
rm -f -- "$PARTIAL_ARCHIVE"
|
|
fi
|
|
if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
|
|
rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
|
|
case "$candidate" in
|
|
/*|*..*)
|
|
echo "SBOM paths must be repository-relative and may not contain '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
|
|
test -n "$IMAGE_ID"
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
|
|
|
|
ARCHIVE_ID=""
|
|
if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
|
|
ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
|
|
fi
|
|
if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
|
|
rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
|
|
PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
|
|
docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
|
|
mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
|
|
PARTIAL_ARCHIVE=""
|
|
printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
|
|
ARCHIVE_CREATED=true
|
|
fi
|
|
|
|
WORKDIR="/workspace"
|
|
WORKSPACE_ARGS=(-v "$ROOT:/workspace")
|
|
if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
|
|
# The Gitea job runs against TCP DinD. Reusing its workspace mounts keeps
|
|
# the archive inside the job boundary and avoids a privileged Docker API hop.
|
|
WORKDIR="$ROOT"
|
|
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
|
|
fi
|
|
|
|
# CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
|
|
# heap below the isolated runner's 8 GiB limit and collect garbage proactively;
|
|
# otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
|
|
# worker. Authoritative dpkg, Python, npm and other installed-package catalogers
|
|
# remain enabled; Trivy still scans the complete immutable archive independently.
|
|
docker run --rm \
|
|
--user 0:0 \
|
|
-e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
|
|
-e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
|
|
-e "GOGC=${SYFT_GOGC:-25}" \
|
|
"${WORKSPACE_ARGS[@]}" \
|
|
-w "$WORKDIR" \
|
|
"$SYFT_IMAGE" \
|
|
"docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
|
|
--select-catalogers=-binary \
|
|
-o "spdx-json=$OUTPUT"
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "SBOM written to $OUTPUT for $IMAGE_ID"
|