Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ec03341

Browse files
shjalaclaude
authored and
eriknordmark
committed
pkg: register source-built packages in APK DB for SBOM coverage
For every pkg whose Dockerfile compiles or downloads an external artifact that ends up in the EVE rootfs, call register-sbom-pkg.sh after the build step so syft's apk-db-cataloger picks it up. Stages whose final image is FROM scratch and does not COPY /out/ wholesale also explicitly copy /lib/apk/db/installed so the entries reach the final image. The pillar collector concatenates each contributing pkg's apk DB into one merged installed file to avoid the Docker COPY overwrite that previously kept only whichever pkg was copied last. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> Signed-off-by: Shahriyar Jalayeri <[email protected]>
1 parent df30df3 commit ec03341

44 files changed

Lines changed: 287 additions & 52 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎eve-tools/bpftrace-compiler/root/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ FROM ${EVE_KERNEL} AS kernel
77

88
FROM lfedge/eve-bpftrace:03c26b968615b09b491f71e61e35d3f2675835ef AS eve-bpftrace
99

10-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS bpftrace
10+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS bpftrace
1111

1212
# hadolint ignore=DL3018
1313
RUN apk add --no-cache --initdb binutils make gcc g++ git perl musl-dev cmake zlib-dev bcc-dev libbpf-dev cereal flex bison llvm17-libs llvm17-dev llvm17-static clang17-dev clang17-static pahole gtest-dev bash

‎pkg/apparmor/Dockerfile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# Copyright (c) 2023 Zededa, Inc.
44
# SPDX-License-Identifier: Apache-2.0
55

6-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build
6+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build
77
ENV BUILD_PKGS linux-headers musl-dev musl-utils musl-libintl git gcc g++ \
88
autoconf autoconf-archive automake libtool make flex bison \
99
bash sed gettext
@@ -20,6 +20,9 @@ WORKDIR /apparmor/parser
2020
RUN ../common/list_af_names.sh > base_af_names.h
2121
RUN make CFLAGS="-Os"
2222

23+
# Register apparmor in the APK DB, mandatory for it to be included in the SBOM.
24+
RUN register-sbom-pkg.sh -n apparmor -v 4.1.3 -l GPL-2.0-only -u https://gitlab.com/apparmor/apparmor.git
25+
2326
#Pull a selected set of artifacts into the final stage.
2427
FROM scratch
2528
COPY --from=build /out/ /

‎pkg/bpftrace/Dockerfile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# Copyright (c) 2024 Zededa, Inc.
44
# SPDX-License-Identifier: Apache-2.0
5-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build
5+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build
66

77
ENV BUILD_PKGS libbpf-dev make gcc g++ git perl linux-headers musl-dev cmake elfutils-dev llvm17-libs llvm17-dev llvm17-gtest llvm17-static cereal flex bison clang17-extra-tools clang17-dev clang17-static pahole gtest-dev bash py3-setuptools zip zlib-dev
88

@@ -23,6 +23,8 @@ RUN cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_CXX_COMPILER=clang++-17 -DCMA
2323
RUN make -j "$(getconf _NPROCESSORS_ONLN)"
2424
RUN make install
2525

26+
# Register bcc in the APK DB, mandatory for it to be included in the SBOM.
27+
RUN register-sbom-pkg.sh -n bcc -v 0.27.0 -l Apache-2.0 -u https://github.com/iovisor/bcc.git
2628

2729
RUN mkdir -p /usr/src
2830
ADD https://github.com/bpftrace/bpftrace.git#v0.20.3 /usr/src/bpftrace
@@ -35,6 +37,9 @@ RUN cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_CXX_COMPILER=clang++-17 -DCMA
3537
RUN make -j "$(getconf _NPROCESSORS_ONLN)"
3638
RUN make install
3739

40+
# Register bpftrace in the APK DB, mandatory for it to be included in the SBOM.
41+
RUN register-sbom-pkg.sh -n bpftrace -v 0.20.3 -l Apache-2.0 -u https://github.com/bpftrace/bpftrace.git
42+
3843
# portability analyser is disabled, therefore skip those tests
3944
# skip file exist test - probably broken because of container
4045
# unfortunately /proc/cpuinfo on docker on M1 mac is not telling much, so let's use the bogomips
@@ -52,6 +57,7 @@ RUN if [ "$TARGETARCH" = "$BUILDARCH" ]; then \
5257
fi
5358

5459
FROM scratch AS bin
60+
COPY --from=build /out/lib/apk/db/installed /lib/apk/db/installed
5561
COPY --from=build /usr/bin/bpftrace /bpftrace/usr/bin/bpftrace
5662
COPY --from=build /usr/bin/bpftrace-aotrt /bpftrace-aotrt/usr/bin/bpftrace-aotrt
5763

‎pkg/bsp-imx/Dockerfile‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
ARG BUILD_PKGS_BASE="bash binutils-dev build-base bc bison flex openssl-dev util-linux-dev swig gnutls-dev perl python3 python3-dev py3-setuptools py3-pycryptodome py3-elftools"
55

66
# we use the same image in several places
7-
ARG EVE_ALPINE_IMAGE=lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3
7+
ARG EVE_ALPINE_IMAGE=lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1
88

99
# OPTEE-OS images
1010
FROM lfedge/eve-optee-os:3c441f553d0037cbd49689e35b695632c2c8a9b4 AS optee-os
@@ -197,8 +197,16 @@ RUN for target in ${UBOOT_TARGETS}; do \
197197
[ -f "$udtb" ] && cp $udtb /bsp/ ;\
198198
done
199199

200+
# Register imx-atf, firmware-imx and uboot-imx in the APK DB, mandatory for them to be included in the SBOM.
201+
RUN if [ "$EVE_TARGET_ARCH" = "aarch64" ]; then \
202+
register-sbom-pkg.sh -n imx-atf -v "${ATF_COMMIT_imx8mp_pollux:0:8}" -l BSD-3-Clause -u https://github.com/nxp-imx/imx-atf && \
203+
register-sbom-pkg.sh -n firmware-imx -v "${FIRMWARE_VER}" -l proprietary -u https://www.nxp.com && \
204+
register-sbom-pkg.sh -n uboot-imx -v "${UBOOT_VERSION}" -l GPL-2.0-only -u https://github.com/nxp-imx/uboot-imx; \
205+
fi
206+
200207
FROM scratch
201208
ENTRYPOINT []
202209
CMD []
203210
COPY --from=build /bsp /bsp-imx
211+
COPY --from=build /out/lib/apk/db/installed /lib/apk/db/installed
204212

‎pkg/debug/Dockerfile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
# into the package: see abuild/etc/abuild.conf.
1111
FROM lfedge/eve-recovertpm:478513dfbf4681b19f11a9afdede6194cceea301 AS recovertpm
1212
FROM lfedge/eve-bpftrace:03c26b968615b09b491f71e61e35d3f2675835ef AS bpftrace
13-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build
13+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build
1414
ENV BUILD_PKGS="abuild curl tar make linux-headers patch g++ git gcc gpg gettext gettext-static ncurses-dev jq autoconf openssl-dev zlib-dev zlib-static gpg-agent"
1515
# Feel free to add additional packages here, but be aware that
1616
# EVE's rootfs image can be no larger than 300Mb (and don't
@@ -58,6 +58,9 @@ RUN for patch in *.patch; do \
5858
make -j$(nproc) -C src VERSION=B.${LSHW_VERSION} NO_VERSION_CHECK=1 RPM_OPT_FLAGS=-DNONLS ZLIB=1 GZIP="busybox gzip -n9" static && \
5959
cp src/lshw-static /out/usr/bin/lshw && strip /out/usr/bin/lshw
6060

61+
# Register lshw in the APK DB, mandatory for it to be included in the SBOM.
62+
RUN register-sbom-pkg.sh -n lshw -v "B.${LSHW_VERSION}" -l GPL-2.0-only -u https://www.ezix.org/software/files/lshw
63+
6164
# building hexedit
6265
WORKDIR /tmp/hexedit/hexedit-1.5
6366
# hadolint ignore=DL4006
@@ -66,6 +69,9 @@ RUN tar -C .. -xzvf ../1.5.tar.gz
6669
# hadolint ignore=SC2046
6770
RUN ./autogen.sh && ./configure && make -j$(nproc) && make DESTDIR=/out install
6871

72+
# Register hexedit in the APK DB, mandatory for it to be included in the SBOM.
73+
RUN register-sbom-pkg.sh -n hexedit -v 1.5 -l GPL-2.0-only -u https://github.com/pixel/hexedit
74+
6975
# tweaking various bit
7076
WORKDIR /out
7177
COPY debug-services.sh ssh-service.sh edgeview-collectinfo.sh spec.sh scripts/ ./usr/bin/

‎pkg/dnsmasq/Dockerfile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (c) 2025 Zededa, Inc.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build
4+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build
55
ENV BUILD_PKGS gcc make patch libc-dev linux-headers tar xz coreutils
66
RUN eve-alpine-deploy.sh
77

@@ -25,6 +25,9 @@ RUN rm -rf /out
2525
RUN make -j "$(getconf _NPROCESSORS_ONLN)"
2626
RUN make install DESTDIR=/out PREFIX=/usr
2727

28+
# Register dnsmasq in the APK DB, mandatory for it to be included in the SBOM.
29+
RUN register-sbom-pkg.sh -n dnsmasq -v "${DNSMASQ_VERSION}" -l GPL-2.0-only -u https://thekelleys.org.uk/dnsmasq
30+
2831
FROM build AS test
2932

3033
COPY dnstest /dnstest

‎pkg/dom0-ztools/Dockerfile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# Copyright (c) 2025 Zededa, Inc.
44
# SPDX-License-Identifier: Apache-2.0
55

6-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS zfs
6+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS zfs
77
ENV BUILD_PKGS="git patch ca-certificates util-linux build-base gettext-dev libtirpc-dev automake autoconf \
88
libtool linux-headers attr-dev e2fsprogs-dev glib-dev openssl-dev util-linux-dev coreutils"
99
ENV PKGS="ca-certificates util-linux libintl libuuid libtirpc libblkid libcrypto3 zlib"
@@ -43,6 +43,9 @@ RUN rm -rf /tmp/zfs-out/usr/share && rm -rf /tmp/zfs-out/usr/src && \
4343
RUN find /tmp/zfs-out -mindepth 1|sed 's@/tmp/zfs-out@@'>/out/etc/zfs-files
4444
RUN cp -r /tmp/zfs-out/* /out
4545

46+
# Register zfs in the APK DB, mandatory for it to be included in the SBOM.
47+
RUN register-sbom-pkg.sh -n zfs -v "${ZFS_VERSION}" -l CDDL-1.0 -u https://github.com/openzfs/zfs
48+
4649
# Add directory for CDI files
4750
RUN mkdir -p /out/etc/cdi
4851

‎pkg/edgeview/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
# hadolint ignore=DL3006
5-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS runtime
5+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS runtime
66
ENV PKGS alpine-baselayout musl-utils iproute2 iptables
77
RUN eve-alpine-deploy.sh
88

99
# hadolint ignore=DL3029
10-
FROM --platform=$BUILDPLATFORM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build
10+
FROM --platform=$BUILDPLATFORM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build
1111
ARG TARGETARCH
1212

1313
COPY src/ /edge-view/.

‎pkg/fscrypt/Dockerfile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# SPDX-License-Identifier: Apache-2.0
44

5-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build-base
5+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build-base
66

77
FROM build-base AS build-amd64
88
FROM build-base AS build-arm64
@@ -28,5 +28,9 @@ RUN set -e && for patch in *.patch; do \
2828

2929
RUN make -j "$(getconf _NPROCESSORS_ONLN)" && make DESTDIR="/out/opt/zededa" PREFIX="" install
3030

31+
# Register fscrypt in the APK DB, mandatory for it to be included in the SBOM.
32+
RUN register-sbom-pkg.sh -n fscrypt -v "${FSCRYPT_COMMIT}" -l Apache-2.0 -u https://github.com/google/fscrypt
33+
3134
FROM scratch
32-
COPY --from=build /out/opt/zededa/bin /opt/zededa/bin
35+
COPY --from=build /out/opt/zededa/bin /opt/zededa/bin
36+
COPY --from=build /out/lib/apk/db/installed /lib/apk/db/installed

‎pkg/fw/Dockerfile‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# syntax=docker/dockerfile-upstream:1.5.0-rc2-labs
22
ARG PLATFORM=generic
33

4-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS build-base
4+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS build-base
55

66
ARG TARGETARCH
77

@@ -100,10 +100,24 @@ ADD ${RPI_BT_FIRMWARE_URL}/${RPI_BT_FIRMWARE_VERSION}/broadcom/BCM4345C5.hcd .
100100
ENV HAILO_FW_VERSION=4.21.0
101101
ADD https://hailo-hailort.s3.eu-west-2.amazonaws.com/Hailo8/${HAILO_FW_VERSION}/FW/hailo8_fw.${HAILO_FW_VERSION}.bin /lib/firmware/hailo/hailo8_fw.bin
102102

103+
# Register firmware packages in the APK DB, mandatory for them to be included in the SBOM.
104+
RUN register-sbom-pkg.sh -n wireless-regdb -v "${WIRELESS_REGDB_VERSION}" -l ISC -u https://wireless.wiki.kernel.org/en/developers/regulatory/wireless-regdb -o /sbom-out
105+
RUN register-sbom-pkg.sh -n linux-firmware -v "${LINUX_FIRMWARE_VERSION}" -l GPL-2.0-only -u https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git -o /sbom-out
106+
RUN register-sbom-pkg.sh -n rtw88-firmware -v "${RTL8822_FW_VERSION:0:8}" -l GPL-2.0-only -u https://github.com/lwfinger/rtw88 -o /sbom-out
107+
RUN register-sbom-pkg.sh -n hailo8-firmware -v "${HAILO_FW_VERSION}" -l proprietary -u https://hailo.ai -o /sbom-out
108+
RUN register-sbom-pkg.sh -n nvidia-l4t-firmware -v "${NVIDIA_FW_TEGRA}" -l proprietary -u https://repo.download.nvidia.com/jetson -o /sbom-out
109+
RUN if [ "${TARGETARCH}" = "arm64" ]; then \
110+
register-sbom-pkg.sh -n rpi-firmware-nonfree -v "${RPI_FIRMWARE_VERSION:0:8}" -l proprietary -u https://github.com/RPi-Distro/firmware-nonfree -o /sbom-out && \
111+
register-sbom-pkg.sh -n rpi-bluez-firmware -v "${RPI_BT_FIRMWARE_VERSION:0:8}" -l proprietary -u https://github.com/RPi-Distro/bluez-firmware -o /sbom-out; \
112+
fi
113+
103114
# generate initrd for Intel's and AMD's microcode
104115
# it makes sense only for x86_64 platform
105-
FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS ucode-build-common
116+
FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS ucode-build-common
106117
RUN mkdir -p /boot /tmp/ucode/intel /tmp/ucode/amd /usr/share/licenses/ucode
118+
# Ensure /sbom-out/lib/apk/db/installed exists for all archs so the COPY in
119+
# compactor-common works even when no ucode registrations run (arm64/riscv64).
120+
RUN register-sbom-pkg.sh -o /sbom-out
107121

108122
FROM ucode-build-common AS ucode-build-amd64
109123
ENV BUILD_PKGS=iucode-tool
@@ -139,13 +153,22 @@ RUN cp /tmp/ucode/amd/linux-firmware/LICENSE.amd-ucode /usr/share/licenses/ucode
139153
# merge intel and amd microcode
140154
RUN cat /tmp/ucode/intel/intel-ucode.img /tmp/ucode/amd/amd-ucode.img >/boot/ucode.img
141155

156+
# Register intel-ucode and amd-ucode in the APK DB, mandatory for them to be included in the SBOM.
157+
RUN register-sbom-pkg.sh -n intel-ucode -v "${INTEL_UCODE_VERSION}" -l proprietary -u https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files -o /sbom-out
158+
RUN register-sbom-pkg.sh -n amd-ucode -v "${AMD_UCODE_VERSION}" -l proprietary -u https://www.amd.com -o /sbom-out
159+
142160
FROM ucode-build-common AS ucode-build-arm64
143161
FROM ucode-build-common AS ucode-build-riscv64
144162
FROM ucode-build-${TARGETARCH} AS ucode-build
145163

146-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS compactor-common
164+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS compactor-common
147165
ENTRYPOINT []
148166
WORKDIR /
167+
# Reset the APK DB so the final image only reports source-built/firmware packages
168+
RUN rm -f /lib/apk/db/installed && register-sbom-pkg.sh -o /
169+
COPY --from=build /sbom-out/lib/apk/db/installed /tmp/sbom-fw
170+
COPY --from=ucode-build /sbom-out/lib/apk/db/installed /tmp/sbom-ucode
171+
RUN cat /tmp/sbom-fw /tmp/sbom-ucode >> /lib/apk/db/installed && rm -f /tmp/sbom-fw /tmp/sbom-ucode
149172
COPY --from=build /lib/firmware/regulatory* /lib/firmware/
150173
COPY --from=build /lib/firmware/bnx2x/* /lib/firmware/bnx2x/
151174
COPY --from=build /lib/firmware/mrvl/*.bin /lib/firmware/mrvl/
@@ -222,7 +245,12 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then \
222245
fi
223246

224247

225-
FROM lfedge/eve-alpine:1f744180283ffb4eabcc3862531aeacf1de886b3 AS compactor-full
248+
FROM lfedge/eve-alpine:41f3648ded073c351d0dcd3432322f5816c9c7b1 AS compactor-full
249+
# Reset the APK DB so the final image only reports source-built/firmware packages
250+
RUN rm -f /lib/apk/db/installed && register-sbom-pkg.sh -o /
251+
COPY --from=build /sbom-out/lib/apk/db/installed /tmp/sbom-fw
252+
COPY --from=ucode-build /sbom-out/lib/apk/db/installed /tmp/sbom-ucode
253+
RUN cat /tmp/sbom-fw /tmp/sbom-ucode >> /lib/apk/db/installed && rm -f /tmp/sbom-fw /tmp/sbom-ucode
226254
# get all possible FW
227255
COPY --from=build /lib/firmware/ /lib/firmware/
228256

@@ -239,5 +267,6 @@ ENTRYPOINT []
239267
WORKDIR /
240268

241269
COPY --from=compactor /lib/firmware /lib/firmware
270+
COPY --from=compactor /lib/apk/db/installed /lib/apk/db/installed
242271
COPY --from=ucode-build /boot/ /boot/
243272
COPY --from=ucode-build /usr/share/licenses/ucode /usr/share/licenses/ucode

0 commit comments

Comments
 (0)