github/troubleshoot
1
0
Fork 0
mirror of https://github.com/replicatedhq/troubleshoot.git synced 2026-08-27 00:37:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix SBOM generation (#2109)

Browse Source
This commit is contained in:
Dmitriy Ivolgin
2026-08-17 12:48:56 -07:00
committed by GitHub
parent e828c21545
commit 1f1a21b3cf
3 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yaml
+2
View File
@@ -29,6 +29,8 @@ jobs:
- name: Install Cosign
uses: sigstore/cosign-installer@v4.1.2
with:
cosign-release: 'v3.1.3'
- name: Generate and sign SBOM
run: make sbom
Makefile
+2 -1
View File
@@ -246,7 +246,8 @@ sbom: sbom/assets/troubleshoot-sbom.tgz
--tlog-upload \
--yes \
--rekor-url=https://rekor.sigstore.dev \
sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
--bundle sbom/assets/troubleshoot-sbom.tgz.bundle \
sbom/assets/troubleshoot-sbom.tgz
cosign public-key --key cosign.key --outfile sbom/assets/key.pub
.PHONY: get-govulncheck
README.md
+3 -10
View File
@@ -56,19 +56,12 @@ For questions about using Troubleshoot, how to contribute and engaging with the
# Software Bill of Materials
A signed SBOM that includes Troubleshoot dependencies is included in each release.
- **troubleshoot-sbom.tgz** contains a software bill of materials for Troubleshoot.
- **troubleshoot-sbom.tgz.sig** is the digital signature for troubleshoot-sbom.tgz
- **troubleshoot-sbom.tgz.bundle** contains the signature and transparency log material used by Cosign.
- **key.pub** is the public key from the key pair used to sign troubleshoot-sbom.tgz
The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has
not been tampered with.
not been tampered with. Install [Cosign v3](https://github.com/sigstore/cosign/releases).
```sh
$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz
Verified OK
```
If you were to get an error similar to the one below, it means you are verifying an SBOM signed using cosign `v1` using a newer `v2` of the binary. This version introduced [breaking changes](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md#breaking-changes) which require an additional flag `--insecure-ignore-tlog=true` to successfully verify SBOMs like so.
```sh
$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz --insecure-ignore-tlog=true
WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the blob.
$ cosign verify-blob --key key.pub --bundle troubleshoot-sbom.tgz.bundle troubleshoot-sbom.tgz
Verified OK
```