NuklearRabbit
65f524d10b
Managed validation / full (pull_request) Successful in 49s
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Successful in 1m30s
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Failing after 2m27s
GeoIntel release gates / GIS image, SBOM and container scan (pull_request) Successful in 4m28s
44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
|
|
IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
|
|
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
|
|
|
|
case "$OUTPUT" in
|
|
/*|*..*)
|
|
echo "SBOM output must be a repository-relative path without '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
case "$IMAGE_ARCHIVE" in
|
|
/*|*..*)
|
|
echo "Image archive must be a repository-relative path without '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
docker image inspect "$TARGET_IMAGE" >/dev/null
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
|
|
if [[ ! -s "$ROOT/$IMAGE_ARCHIVE" ]]; then
|
|
mkdir -p "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
|
|
docker save "$TARGET_IMAGE" --output "$ROOT/$IMAGE_ARCHIVE"
|
|
fi
|
|
WORKDIR="/workspace"
|
|
WORKSPACE_ARGS=(-v "$ROOT:/workspace")
|
|
if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
|
|
WORKDIR="$ROOT"
|
|
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
|
|
fi
|
|
docker run --rm \
|
|
"${WORKSPACE_ARGS[@]}" \
|
|
-w "$WORKDIR" \
|
|
"$SYFT_IMAGE" \
|
|
"docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
|
|
-o "spdx-json=$OUTPUT"
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "SBOM written to $OUTPUT"
|