Allow passing the sbomDir to KO #5679
Replies: 2 comments 3 replies
-
|
Hi! Is the idea to then upload the sbom to the release? If so, we should probably do it automatically when SBOM is enabled 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
No, KO is uploading the SBOM automatically, but if you build a prerelease or snapshot, the SBOM is only published to the local Docker registry. We mainly use KO to get rid of Docker. So the prerelease/snapshot SBOM is lost. That's why I need this feature. Having the SBOM in the filesystem would be totally sufficient to use tools like Grype to analyze it and show it in the pipeline stats. I would like to contribute - but have to do some paperwork internally until I am allowed to contribute this feature. |
Beta Was this translation helpful? Give feedback.
-
|
nice, yeah, sounds good! let me know when you able to work on it, and I'll convert this to an issue then! thanks for this btw, and for the interest in contributing as well 🙏 |
Beta Was this translation helpful? Give feedback.
-
|
Paperwork Done. I am allowed to contribute! |
Beta Was this translation helpful? Give feedback.
-
|
opened issue #5689 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello,
I would like to request support for passing the sbomDir flag to KO. This flag was introduced three years ago (reference: ko-build/ko#728) and enables publishing SBOMs (Software Bill of Materials) to the filesystem.
Implementing this feature would be highly beneficial for use cases that require managing SBOMs alongside publishing artifacts. It would provide users with more flexibility and alignment with workflows that require such build metadata for compliance, security, or auditing purposes.
Could you please consider adding support for this flag? Let me know if further clarification or assistance is needed for this feature request.
Thank you for your consideration!
Beta Was this translation helpful? Give feedback.
All reactions