generated from amazon-archives/__template_Custom
-
Notifications
You must be signed in to change notification settings - Fork 38
Open
Description
I'd like for the twoliter script to merge all of the SBOM's generated by the sbomtool generate command into image-spdx.json and image-cyclonedx.json files. It should also remove all of the SBOM packages after merging them into the final JSON's.
Currently, the SBOM packages are stored in /usr/share/sboms/, where each package in this directory has associated spdx and cyclonedx JSON SBOMs. Using the sbomtool merge command, these should be merged under a /usr/share/bottlerocket/sbom/ directory, into image-spdx.json and image-cyclonedx.json files, respectively. After merging, the SBOMs in /usr/share/sboms/ should also be removed.
Metadata
Metadata
Assignees
Labels
No labels