Skip to content

Merge SBOM packages #584

@cezar-r

Description

@cezar-r

I'd like for the twoliter script to merge all of the SBOM's generated by the sbomtool generate command into image-spdx.json and image-cyclonedx.json files. It should also remove all of the SBOM packages after merging them into the final JSON's.

Currently, the SBOM packages are stored in /usr/share/sboms/, where each package in this directory has associated spdx and cyclonedx JSON SBOMs. Using the sbomtool merge command, these should be merged under a /usr/share/bottlerocket/sbom/ directory, into image-spdx.json and image-cyclonedx.json files, respectively. After merging, the SBOMs in /usr/share/sboms/ should also be removed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions