vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Publish a bill of materials with each release

122a697b5045b301622783515fb85b1e6508b36d · Keenan Nemetz · 10d ago · parent 95425af7

Publish a bill of materials with each release

The release attached binaries, packages and checksums but nothing that lists what
went into them. An SBOM answers the question a download raises: does this binary
contain the module version the advisory names.

cyclonedx-gomod is pinned the way nfpm and govulncheck are, so a local run and a
release run name the same components. It reads the module graph, so it needs no
compiled binary. The only field it takes from the clock is metadata.timestamp,
which the step rewrites from the tag's commit time; one tag now produces one set
of bytes.

Checksums move to their own step so they cover the SBOM too.

Closes #93.

docs/releases.md +33

@@ -95,3 +95,36 @@ artifacts:
	95	95	The run records the same pointers that `vole release attach` writes, so the
	96	96	release page, download behavior, and immutability rules stay the same. See
	97	97	[Workflows § Build a release](workflows.md#build-a-release).
		98
		99	## A bill of materials for each release
		100
		101	A release built by the workflow carries an SBOM: `vole-<version>.sbom.cdx.json`,
		102	in CycloneDX JSON, listed on the release page beside the packages and covered by
		103	`SHA256SUMS`.
		104
		105	It names every Go module the application links, with the version and hash that
		106	`go.sum` pins, the Go toolchain, and each module's licence as detected evidence
		107	rather than an asserted conclusion. That is what makes it useful for the question
		108	it exists to answer: an advisory names a module version, and the SBOM says whether
		109	the binary you downloaded contains it.
		110
		111	Two limits, stated so nobody reads more into it than is there:
		112
		113	- One file covers both architectures. The module graph is the same for
		114	`amd64` and `arm64`; only the compiled files differ. Check it with
		115	`GOOS=linux GOARCH=arm64 go list -deps ./cmd/vole`.
		116	- The system SQLite library is not a Go module. The SBOM names
		117	`github.com/mattn/go-sqlite3`, the binding the build links, not the
		118	`libsqlite3-0` version underneath it. That one comes from the package you
		119	installed: `dpkg -s vole` or `rpm -q --requires vole`.
		120
		121	To regenerate it for a tag you already have:
		122
		123	```sh
		124	go run github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.9.0 \
		125	app -json -noserial -std -licenses -main cmd/vole -output SBOM.cdx.json .
		126	```
		127
		128	The only field the tool takes from the clock is `metadata.timestamp`; the workflow
		129	replaces it with the tag's commit time, so building one tag twice produces the
		130	same file.