vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Publish a bill of materials with each release

122a697b5045b301622783515fb85b1e6508b36d · Keenan Nemetz · 10d ago · parent 95425af7

Publish a bill of materials with each release

The release attached binaries, packages and checksums but nothing that lists what
went into them. An SBOM answers the question a download raises: does this binary
contain the module version the advisory names.

cyclonedx-gomod is pinned the way nfpm and govulncheck are, so a local run and a
release run name the same components. It reads the module graph, so it needs no
compiled binary. The only field it takes from the clock is metadata.timestamp,
which the step rewrites from the tag's commit time; one tag now produces one set
of bytes.

Checksums move to their own step so they cover the SBOM too.

Closes #93.

.vole/workflows/release.yaml +40−4

@@ -1,5 +1,5 @@
	1		# Builds the release binaries and packages them as .deb and .rpm, then attaches
	2		# everything to the tag's release.
		1	# Builds the release binaries, packages them as .deb and .rpm, writes a bill of
		2	# materials, then attaches everything to the tag's release.
	3	3	#
	4	4	# A tag push is the trigger, so the release must be an annotated tag with notes
	5	5	# (git tag -a v0.2.0 -F notes.md). Every file below lands on that release page
@@ -64,11 +64,47 @@ jobs:
	64	64	go run github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.48.0 package -f packaging/nfpm.yaml -p "$format" -t dist
	65	65	done
	66	66	done
	67		# Checksums last, so they cover every file attached beside them.
	68		( cd dist && sha256sum vole-linux-* .deb .rpm > SHA256SUMS )
	69	67	ls -l dist
	70	68	timeout: 30m
		69	# What went into the build, for whoever is matching an advisory against
		70	# what they downloaded. The tool is pinned for the same reason nfpm is: a
		71	# local run and a release run name the same components. It reads the module
		72	# graph, so it does not need a compiled binary or either cross compiler.
		73	- name: sbom
		74	run: \|
		75	set -eu
		76	VERSION="$(git describe --tags --exact-match 2>/dev/null \|\| true)"
		77	VERSION="${VERSION#v}"
		78	if [ -z "$VERSION" ]; then
		79	echo "HEAD is not a tag; a release workflow runs on a tag" >&2
		80	exit 1
		81	fi
		82	export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
		83	out="dist/vole-$VERSION.sbom.cdx.json"
		84	go run github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.9.0 \
		85	app -json -noserial -std -licenses -main cmd/vole -output "$out" .
		86	# The tool stamps the build clock into metadata.timestamp. The tag's
		87	# commit time is what the rest of the release uses, so both builds of
		88	# one tag produce the same file; nothing else in it comes from the clock.
		89	stamp="$(date -u -d "@$SOURCE_DATE_EPOCH" +%Y-%m-%dT%H:%M:%SZ)"
		90	sed -i "s/\"timestamp\": \"[^\"]*\"/\"timestamp\": \"$stamp\"/" "$out"
		91	# A substitution that matched nothing would leave the clock in the file.
		92	grep -q "\"timestamp\": \"$stamp\"" "$out"
		93	grep -q '"bomFormat": "CycloneDX"' "$out"
		94	grep -q 'github.com/mattn/go-sqlite3' "$out"
		95	ls -l "$out"
		96	timeout: 20m
		97	# Checksums last, so they cover every file attached beside them, including
		98	# the bill of materials.
		99	- name: checksums
		100	run: \|
		101	set -eu
		102	( cd dist && sha256sum vole-linux-* .deb .rpm *.sbom.cdx.json > SHA256SUMS )
		103	cat dist/SHA256SUMS
		104	timeout: 5m
	71	105	artifacts:
		106	- path: dist/*.sbom.cdx.json
		107	release: true
	72	108	- path: dist/vole-linux-*
	73	109	release: true
	74	110	- path: dist/*.deb