feat: expose sbom generation tools

src/pkg/packager/layout/assemble.go

@@ -191,7 +191,7 @@ func AssemblePackage(ctx context.Context, pkg v1alpha1.ZarfPackage, packagePath
 		return nil, err
 	}
 
-	checksumContent, checksumSha, err := getChecksum(buildPath)
+	checksumContent, checksumSha, err := GetChecksum(buildPath)
 	if err != nil {
 		return nil, err
 	}
@@ -265,7 +265,7 @@ func AssembleSkeleton(ctx context.Context, pkg v1alpha1.ZarfPackage, packagePath
 		}
 	}
 
-	checksumContent, checksumSha, err := getChecksum(buildPath)
+	checksumContent, checksumSha, err := GetChecksum(buildPath)
 	if err != nil {
 		return nil, err
 	}
@@ -844,7 +844,9 @@ func recordPackageMetadata(pkg v1alpha1.ZarfPackage, flavor string, registryOver
 	return pkg
 }
 
-func getChecksum(dirPath string) (string, string, error) {
+// GetChecksum takes a directory then creates a sha256 check sum for each files in the
+// directory recursively, then creates a global checksum for all the files together.
+func GetChecksum(dirPath string) (string, string, error) {
 	checksumData := []string{}
 	err := filepath.Walk(dirPath, func(path string, info fs.FileInfo, err error) error {
 		if err != nil {
@@ -877,7 +879,10 @@ func getChecksum(dirPath string) (string, string, error) {
 	return checksumContent, hex.EncodeToString(sha[:]), nil
 }
 
-func createReproducibleTarballFromDir(dirPath, dirPrefix, tarballPath string, overrideMode bool) (err error) {
+// createReproducibleTarballFromDir takes a directory then walks thru every file in that directory and adds it
+// to a tar ball; the reproducible part comes from changing all the file user and group to 0, and settings the
+// file creation, access, and mod time to midnight on January 1st 1970, UTC.
+func createReproducibleTarballFromDir(dirPath string, dirPrefix string, tarballPath string, overrideMode bool) (err error) {
 	tb, err := os.Create(tarballPath)
 	if err != nil {
 		return fmt.Errorf("error creating tarball: %w", err)

src/pkg/packager/layout/assemble_test.go

@@ -31,7 +31,7 @@ func TestGetChecksum(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	checksumContent, checksumHash, err := getChecksum(tmpDir)
+	checksumContent, checksumHash, err := GetChecksum(tmpDir)
 	require.NoError(t, err)
 
 	expectedContent := `233562de1a0288b139c4fa40b7d189f806e906eeb048517aeb67f34ac0e2faf1 nested/directory/file.md

src/pkg/packager/layout/sbom.go

@@ -73,7 +73,7 @@ func generateSBOM(ctx context.Context, pkg v1alpha1.ZarfPackage, buildPath strin
 			return fmt.Errorf("failed to load OCI image: %w", err)
 		}
 		l.Info("creating image SBOM", "reference", refInfo.Reference)
-		b, err := createImageSBOM(ctx, cachePath, outputPath, img, refInfo.Reference)
+		b, err := CreateImageSBOM(ctx, cachePath, outputPath, img, refInfo.Reference)
 		if err != nil {
 			return fmt.Errorf("failed to create image sbom: %w", err)
 		}
@@ -112,7 +112,8 @@ func generateSBOM(ctx context.Context, pkg v1alpha1.ZarfPackage, buildPath strin
 	return nil
 }
 
-func createImageSBOM(ctx context.Context, cachePath, outputPath string, img v1.Image, src string) ([]byte, error) {
+// CreateImageSBOM is used to generate a syft SBOM for a provided image reference.
+func CreateImageSBOM(ctx context.Context, cachePath, outputPath string, img v1.Image, src string) ([]byte, error) {
 	imageCachePath := filepath.Join(cachePath, ImagesDir)
 
 	// This is a write cache
@@ -270,11 +271,15 @@ func createFileSBOM(ctx context.Context, component v1alpha1.ZarfComponent, outpu
 	return jsonData, nil
 }
 
+// createSBOMViewerAsset creates an offline software bill of material html webpage that
+// that can be used to viewed before installing any packages into a cluster.
 func createSBOMViewerAsset(outputDir, identifier string, jsonData, jsonList []byte) error {
 	filename := fmt.Sprintf("sbom-viewer-%s.html", getNormalizedFileName(identifier))
 	return createSBOMHTML(outputDir, filename, "viewer/template.gohtml", jsonData, jsonList)
 }
 
+// createSBOMCompareAsset creates an offline html webpage used to to compare the all the
+// images and files associated with a package.
 func createSBOMCompareAsset(outputDir string) error {
 	return createSBOMHTML(outputDir, "compare.html", "viewer/compare.gohtml", nil, nil)
 }

src/pkg/packager/layout/sbom_test.go

@@ -20,7 +20,7 @@ func TestCreateImageSBOM(t *testing.T) {
 
 	outputPath := t.TempDir()
 	img := empty.Image
-	b, err := createImageSBOM(ctx, t.TempDir(), outputPath, img, "docker.io/foo/bar:latest")
+	b, err := CreateImageSBOM(ctx, t.TempDir(), outputPath, img, "docker.io/foo/bar:latest")
 	require.NoError(t, err)
 	require.NotEmpty(t, b)
 
@@ -38,7 +38,7 @@ func TestCreateImageSBOMNonExistentCachePath(t *testing.T) {
 	// Cache path that doesn't exist yet
 	cachePath := filepath.Join(t.TempDir(), "non-existent-cache")
 	img := empty.Image
-	b, err := createImageSBOM(ctx, cachePath, outputPath, img, "docker.io/foo/bar:latest")
+	b, err := CreateImageSBOM(ctx, cachePath, outputPath, img, "docker.io/foo/bar:latest")
 	require.NoError(t, err)
 	require.NotEmpty(t, b)
 }