Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Keep reading SBOM until encoding is found #259

Merged
merged 2 commits into from
Apr 1, 2023

Conversation

puerco
Copy link
Member

@puerco puerco commented Mar 31, 2023

What type of PR is this?

/kind bug
/kind cleanup

What this PR does / why we need it:

This PR modifies the encoding detection function to read
the as much of the SBOM as required to detect the encoding.

Some tools (notably Microsoft's sbom-tool) put the document
creation data at the end of the document and we could not detect it by reading just a few bytes from the top.

I pushed another commit removing some debugging output I accidentally checked in.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

Does this PR introduce a user-facing change?

- bom will now read the SBOM until it detects the SBOM encoding data, enabling it to parse SBOMs with the document data defined at the end of the file.
- When trying to ingest a CycloneDX document, bom will now print a more useful warning 

@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 31, 2023
@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 31, 2023
@puerco puerco force-pushed the full-parse branch 2 times, most recently from 0af9d89 to 4e7be20 Compare March 31, 2023 23:47
This commit modifies the encoding detection function to read
the as much of the SBOM as required to deetect the encoding.

Some tools (notably Microsoft's sbom-tool) put the document
creation data at the end of the document and we could not
detect the encoding by reading a few bytes from the top.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
This commit removes some debugging messages which were accidentaly checked in
into the outlining code.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
@puerco puerco changed the title Full parse Keep reading SBOM until encoding is found Apr 1, 2023
Copy link
Member

@cpanato cpanato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 1, 2023
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cpanato, puerco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot merged commit 7902c8a into kubernetes-sigs:main Apr 1, 2023
2 checks passed
@puerco puerco deleted the full-parse branch April 1, 2023 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants