Hello,
I would like to create a couple of OCI images embedding their own SBOM.
The idea is to show that when creating an OCI image with Nix, it is easy to extract its SBOM (in any format, text or SPDX).
I tried to use bombon (GitHub - nikstur/bombon: Nix CycloneDX Software Bills of Materials (SBOMs) thanks @nikstur !) but the resulting file is:
{
"bomFormat": "CycloneDX",
"specVersion": "1.3",
"version": 1,
"serialNumber": "urn:uuid:23ca648e-7e18-47ae-a80c-0f1098d1dbfa",
"metadata": {
"tools": [
{
"vendor": "nikstur",
"name": "bombon",
"version": "c42b8aa9a666db7d61c9e6d4b5a5ed41b6215054"
}
],
"component": {
"type": "application",
"bom-ref": "urn:uuid:734d35e1-cd4f-43f3-bf09-589d456b2c7c",
"name": "php-web.tar.gz",
"version": "",
"purl": "pkg:nix/php-web.tar.gz@"
}
},
"components": []
}
We can clearly see that the OCI image is opaque, it’s just a .tar.gz file, and not information is extracted out of it. I wish I could have information about caddy, php and all the transitive dependencies embedded in the image.
Find the flake here:
{
description = "Nix, OCI and SBOM";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
bombon.url = "github:nikstur/bombon";
bombon.inputs.nixpkgs.follows = "nixpkgs";
systems.url = "github:nix-systems/default";
};
outputs = inputs@{ self, flake-parts, systems, bombon, ... }: flake-parts.lib.mkFlake { inherit inputs; } {
systems = import systems;
perSystem = { config, self', inputs', pkgs, system, lib, ... }: {
packages = {
oci-image-sbom = bombon.lib.${system}.buildBom config.packages.oci-image { };
oci-image = pkgs.dockerTools.buildLayeredImage {
name = "php-web";
tag = "latest";
contents = [
pkgs.php81
pkgs.caddy
pkgs.dockerTools.caCertificates
pkgs.fakeNss
(pkgs.writeScriptBin "start-server" ''
#!${pkgs.runtimeShell}
php-fpm -D -y /etc/php-fpm.d/www.conf.default
caddy run --adapter caddyfile --config ${./Caddyfile}
'')
];
extraCommands = ''
mkdir -p tmp
chmod 1777 tmp
'';
config = {
Cmd = [ "start-server" ];
ExposedPorts = {
"80/tcp" = {};
"443/tcp" = {};
};
};
};
};
};
};
}
Thanks!