feat: expose sbom generation tools - #4795
Conversation
✅ Deploy Preview for zarf-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
🚀 New features to boost your workflow:
|
Signed-off-by: Allen Conlon <software@conlon.dev>
Signed-off-by: Allen Conlon <software@conlon.dev>
125ccb9 to
9e00b02
Compare
|
A little unsure about the comments for the functions that I exposed, so if someone can double check them please and thank you. |
Signed-off-by: Allen Conlon <allen@conlon.dev>
brandtkeller
left a comment
brandtkeller
left a comment
There was a problem hiding this comment.
Slight changes to the doccomments.
I have some reservations:
Things like the signatures. They were okay as non-exported functions but some of the behaviors as public API's are a little "leaky" IMO.
I would also question the package origin. Do these really make quality exported functions for the layout package?
Not inherently against making these public but do want to play devils advocate. Any additional surfaces we expose get locked in during v1.0.0 and create more surface areas for vulnerabilities.
Tagging @zarf-dev/maintainers to weigh in as well.
| } | ||
|
|
||
| func getChecksum(dirPath string) (string, string, error) { | ||
| // GetChecksum takes a directory then creates a sha256 check sum for each files in the |
There was a problem hiding this comment.
a small improvement might be explicitly mentioning the return values.
| } | ||
|
|
||
| func createImageSBOM(ctx context.Context, cachePath, outputPath string, img v1.Image, src string) ([]byte, error) { | ||
| // CreateImageSBOM is used to generate a syft SBOM for a provided image reference. |
There was a problem hiding this comment.
This function is a bit "leaky" with regards to how it operates - returning both the bytes AND writing the file to the filesystem. Acceptable perhaps as a private function but supported in our public API's....
Nonetheless we should doccomment the behaviors.
2 participants
Description
Exposes a handful of useful generic functions from
github.com/zarf-dev/zarf/src/pkg/packager/layoutRelated Issue
Fixes #4794
Checklist before merging