fix(sbom): enforce pm determinism again - #226
Merged
Merged
Conversation
nervgh
force-pushed
the
fix/sbom/revert-pm-lock-syntax
branch
from
August 6, 2026 09:09
3d101d9 to
ebbabd9
Compare
nervgh
changed the title
nervgh
force-pushed
the
fix/sbom/revert-pm-lock-syntax
branch
from
August 6, 2026 19:57
9c1fc5d to
8977618
Compare
Switch the active feature from `013-lang-pkg-env-vars` to `015-os-pm-file-syntax` and add the full specification, requirements checklist, and user stories for re-introducing file-based `pm.yaml`/`pm.lock` syntax as the only supported syntax for the `os-pm` package type.
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Clarify the impact of file-based os-pm packages on SBOM and command generation. Previously, the plan was ambiguous about whether the runtime index file was needed and whether the container factory version preamble could be removed. Refine the design documents to establish that: - The build context's pm.lock file replaces the runtime index file for SBOM parsing, rendering some runtime collection code dead. - The container factory version file write is preserved during build to retain the SBOM purl qualifier. - Existing pm.lock parser functions are reused rather than deleted. - Specific e2e test fixtures are identified for migration. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Previously, os-pm SBOM was collected by reading the pm index.json from the container image at build time. Now it is parsed directly from pm.lock stored in the git repository, using the new PMBOMPatcher. The patcher falls back gracefully when the lock file is absent and errors when only pm.yaml exists. Refactor config validation and defaults to support custom spec/lock paths for os-pm, add OSPMSpecPath helper, and skip os-pm entries in managedinput resolvers (delivery-kit handles them internally). Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Add T062-T065 e2e runs for migrated sbom fixtures and update phase dependencies to require Phase 7 completion before running them. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
pm.lock has a top-level "packages" key; previously the raw JSON was unmarshalled directly into the package map. GOST Upsert now runs after component patchers so patcher-added components get GOST properties. Also fix containerfactoryversion qualifier case and add VCS external ref from the lock file's originalRepo. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
version Update the fixture to include tini package and change jq version from 1.9.0 to 1.8.1. Adjust the test assertion to expect the new components. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
nervgh
force-pushed
the
fix/sbom/revert-pm-lock-syntax
branch
from
August 7, 2026 12:52
e40be2e to
a1ae538
Compare
Reorder patchers in convergeImageSbom so the external refs patcher runs after the PM BOMPatcher. Previously it ran first, so os-pm components from pm.lock were absent during PURL resolution and failures could not aggregate into a hierarchical error. Update FR-018 spec notes and add the purl_resolver_errors e2e fixture. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Update the pm-ok.lock test fixture to reflect the jq project's current repository URL and digest values. The previous fixture referenced the old GitHub repo and an outdated digest, causing test failures when validating against live upstream data. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.