Conversation
# Issue
`mbt sbom-gen` only produces BOMs for known builders (maven/npm). Our Go
services use `builder: custom`, which it skips ("mbt is not support it by
now"), so the Go dependency graph is absent from the merged MTA SBOM — today
it covers only the two Java modules (`dbtasks`, `scheduler`).
# Fix
Wire a `go-sbom` Makefile target (`cyclonedx-gomod`, CycloneDX 1.4) into the
apiserver module's `sbom-create-commands` in mta.tpl.yaml. mbt runs it with its
`${sbom-file-name}` placeholder, collects the output, and merges it into the
aggregate SBOM (`--sbom-file-path`) alongside the Java BOMs. Add
`cyclonedx-gomod` and `cyclonedx-cli` (mbt's merge shells out to `cyclonedx`)
to devbox, and drop the dead local `cloud-mta-build-tool` nix definition —
devbox already sources mbt from the joergdw/prspkgs flake.
`sbom-create-commands` is only on mbt master; verified empirically that both
1.2.47 and 1.2.49 still skip the module and never run `make go-sbom`. This
takes effect once devbox pulls an mbt release > 1.2.49 via the joergdw/prspkgs
flake, at which point a build should log three module SBOMs.
silvestre
force-pushed
the
feat/go-sbom-devbox-makefile
branch
from
July 30, 2026 17:02
d2d59c2 to
b474d94
Compare
|
joergdw
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
mbt sbom-genonly produces BOMs for known builders (maven/npm). Our Goservices use
builder: custom, which it skips ("mbt is not support it bynow"), so the Go dependency graph is absent from the merged MTA SBOM — today
it covers only the two Java modules (
dbtasks,scheduler).Fix
Wire a
go-sbomMakefile target (cyclonedx-gomod, CycloneDX 1.4) into theapiserver module's
sbom-create-commandsin mta.tpl.yaml. mbt runs it with its${sbom-file-name}placeholder, collects the output, and merges it into theaggregate SBOM (
--sbom-file-path) alongside the Java BOMs. Addcyclonedx-gomodandcyclonedx-cli(mbt's merge shells out tocyclonedx)to devbox, and drop the dead local
cloud-mta-build-toolnix definition —devbox already sources mbt from the joergdw/prspkgs flake.
sbom-create-commandsis only on mbt master; verified empirically that both1.2.47 and 1.2.49 still skip the module and never run
make go-sbom. Thistakes effect once devbox pulls an mbt release > 1.2.49 via the joergdw/prspkgs
flake, at which point a build should log three module SBOMs.