Documentation
¶
Overview ¶
Package main builds the SPDX SBOM for a Talos build artifact.
It wraps syft's library API to scan a directory and emit SPDX JSON, then post-processes the typed *spdx.Document to:
Add two synthetic SPDX packages as siblings of the directory-root package syft emits, both linked via CONTAINS relationships: - `Package-os-talos` (PrimaryPackagePurpose=OPERATING-SYSTEM) with PURL `pkg:generic/talos@<tag>` (VEX product correlation for `generate-vex`) and CPE `cpe:2.3:o:siderolabs:talos_linux:<ver>:*…` (NVD-keyed advisories like CVE-2022-36103). - `Package-go-siderolabs-talos` (PrimaryPackagePurpose=LIBRARY) with PURL `pkg:golang/github.com/siderolabs/talos@<tag>` for the GHSAs GitHub publishes against the talos Go-module path (GHSA-g5p6-327m-3fxx, GHSA-jr8j-2jhp-m67v, GHSA-m38g-vww2-mvgx). GHSAs can't carry CPEs, so these are otherwise invisible to grype on a talos SBOM.
Two packages rather than one because syft's SPDX importer assigns a single PURL per pkg.Package (multiple `purl` externalRefs collapse to the first), so the golang PURL needs its own SPDX package to survive import and get classified as pkg.Type=go-module.
The SBOM root package can't host these identifiers either: syft's SPDX importer strips the root and turns it into the SBOM's source metadata (https://github.com/anchore/syft/blob/v1.44.0/syft/format/common/spdxhelpers/to_syft_model.go#L128), so any externalRefs on it never reach the vulnerability matcher.
Enrich the Go-module packages syft catalogs: per-module license discovery is enabled against the local module cache (GOMODCACHE), and each go-module package gets its PackageDownloadLocation (module proxy zip) and PackageHomePage (pkg.go.dev) filled in, both derived from the module path and version. syft leaves these as NOASSERTION otherwise.
Provide deterministic output (RFC3339 CreationInfo.Created derived from SOURCE_DATE_EPOCH, plus a UUIDv5 documentNamespace hashed from a stable digest of the cataloged packages). This replaces the prior fork-only env vars while https://github.com/anchore/syft/pull/3932 remains open.
Once that upstream PR merges and the syft pin moves past it, the determinism shim can be removed; the OS-package injection stays.
Source Files