sbom: T8542: change result filenames to match ISO image filename

[c-po]

Change summary

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T8542

Related PR(s)

• Testsuite: T8602: add QEMU smoketest for add-system-image over HTTP (default + VRF) #1210

How to test / Smoketest result

Assemble ISO imag

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c9198f8c-8adc-4c20-a161-c835b872530f

📥 Commits

Reviewing files that changed from the base of the PR and between 8375be2 and 819e3c6.

📒 Files selected for processing (3)

• docker/Dockerfile
• scripts/image-build/build-vyos-image
• scripts/iso-to-oci

---

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• Refactor

  • SBOM generation now derives output filenames from the actual ISO file.
  • ISO-to-OCI conversion script improved with argument validation and error handling.
  • Build process now includes dependency checking and automatic cleanup.

• Chores

  • Docker build dependencies updated.

Walkthrough

Adds xorriso to the Docker build; derives SBOM filenames from the built ISO (strip .iso); refactors scripts/iso-to-oci to run in strict mode with a temp workdir, use xorriso+unsquashfs extraction, perform pruning under the temp dir, and emit a quoted, versioned tarball.

Changes

Image build and ISO→OCI changes

Layer / File(s)	Summary
Dockerfile: add xorriso docker/Dockerfile	xorriso added to apt install list (lines ~113-114).
Script strict mode, temp WORKDIR, cleanup scripts/iso-to-oci	Enable set -euo pipefail, create WORKDIR with mktemp, validate args/ISO existence, add dependency checks, and register cleanup() to remove temp dir (lines 3-45).
ISO extraction and version read scripts/iso-to-oci	Use xorriso to extract /version.json and /live/filesystem.squashfs to temp dir, run unsquashfs, and read .version with jq (lines 46-60).
Post-extraction pruning and locale fix scripts/iso-to-oci	Apply locale substitution in etc/default/locale, remove ${UNSQUASHFS}/boot, adjust lib/modules glob to *-vyos, and remove other unnecessary files (lines 61-70).
Template pruning and config symlink scripts/iso-to-oci	Remove container feature templates and additional system template paths (including console template), then create config symlink into ${UNSQUASHFS}/config (lines 71-83).
Tarball creation scripts/iso-to-oci	Create versioned OCI tarball from ${UNSQUASHFS} with quoted arguments producing vyos-${VERSION}.tar (lines 84-86).
SBOM filename derivation and command updates scripts/image-build/build-vyos-image	Derive base_filename from iso_file.rstrip('.iso'); use it for syft CycloneDX/SPDX outputs and sed rewrites; remove print(c) from subprocess loop (lines 732-750).

Possibly related PRs

• vyos/vyos-build#1198: Prior SBOM generation refactor in the same scripts/image-build/build-vyos-image.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description directly addresses the changeset: modifying SBOM result filenames to match ISO image filename, with clear task reference T8542.
Title check	✅ Passed	Title accurately describes the primary change: modifying SBOM result filenames to derive from ISO image filename instead of hardcoding.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

CI integration ❌ failed!

Details

CI logs

• Config tests ❌ failed