Skip to content

Commit 9e5caa9

Browse files
author
Natalie Arellano
committed
Formatting
Signed-off-by: Natalie Arellano <narellano@vmware.com>
1 parent d26bd2e commit 9e5caa9

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

text/0000-refactor-sbom.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ The layer-scoped files are restored on future builds so that buildpacks can use
2828

2929
**image signature** - allows for cryptographically verifying the digest of an OCI image
3030

31-
**[cosign](https://github.com/sigstore/cosign/tree/main#cosign)** - tooling for generating image signatures
31+
**[cosign](https://github.com/sigstore/cosign/tree/main#cosign)** - tooling for generating image signatures and attestations
3232

3333
**OCI v1.1** - pending new releases to the OCI image and distribution specs, as described [here](https://opencontainers.org/posts/blog/2023-07-07-summary-of-upcoming-changes-in-oci-image-and-distribution-specs-v-1-1/)
3434

@@ -79,8 +79,8 @@ We should make it possible to invoke the `signer` separate from other phases.
7979
Buildpacks should continue to output SBOM files as before. We won't need to bother buildpack authors with this change.
8080

8181
The `exporter` will accept a new optional flag `-omit-sbom` that defaults to `false`.
82-
If `-omit-sbom=false` the exporter will behave as today, and include the SBOM layer containing the `<layers>/sbom/launch/` directory in the application image.
83-
If `-omit-sbom=true` the exporter will not create the SBOM layer, but `<layers>/sbom/launch/` will remain on the filesystem and be available to the `signer`.
82+
* If `-omit-sbom=false` the exporter will behave as today, and include the SBOM layer containing the `<layers>/sbom/launch/` directory in the application image.
83+
* If `-omit-sbom=true` the exporter will not create the SBOM layer, but `<layers>/sbom/launch/` will remain on the filesystem and be available to the `signer`.
8484

8585
The exporter will additionally generate configuration for the `signer` irrespective of the value of `-omit-sbom`.
8686

@@ -95,7 +95,7 @@ The `signer` will accept configuration that will allow it to attach attestations
9595

9696
```toml
9797
[image]
98-
reference = <image digest>
98+
reference = "<image digest>"
9999

100100
[[attestations]]
101101
type = "<media type>"
@@ -190,6 +190,7 @@ It should optionally accept configuration for new attestations to describe the n
190190

191191
During `analyze`, the lifecyle should verify attestations for the previous application image, and download the SBOM data as files in `<layers>/sbom/launch/`
192192
so that the `restorer` can behave just as it does today when recreating `<layers>/<buildpack-id>/<layer>.sbom.<ext>` files for buildpacks.
193+
193194
The lifecycle should fall back to pulling the SBOM layer from the image if no attestations exist (this will be necessary to keep compatibility with daemon images).
194195

195196
# Migration

0 commit comments

Comments
 (0)