Skip to content

feat(publish-image): Restore top-level metadata in converted SPDX SBOM #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dervoeti merged 1 commit into from
Jun 30, 2026
Merged

feat(publish-image): Restore top-level metadata in converted SPDX SBOM #115

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions publish-image/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,14 +199,33 @@ runs:
# same merged, deduplicated inventory.
syft convert sbom.merged.json --output spdx-json=sbom.spdx.raw.json

# Normalise deprecated SPDX license identifiers that strict validators and
# some consumers reject. syft still emits the deprecated standalone form
# "GPL-2.0-with-classpath-exception"; rewrite it to the valid WITH
# expression. Extend the `fix` chain if further deprecated ids show up.
jq '
# Post-process the converted SPDX SBOM:
# 1. Normalise deprecated SPDX license identifiers that strict
# validators reject. syft still emits the deprecated standalone form
# "GPL-2.0-with-classpath-exception"; rewrite it to the valid WITH
# expression. Extend the `fix` chain if further deprecated ids show up.
# 2. Restore top-level metadata that the CycloneDX -> SPDX conversion
# drops: credit Stackable as an SBOM creator, and set the name,
# version, originator, supplier and purl of the root container
# package.
jq --arg source_name "$SOURCE_NAME" --arg version "$IMAGE_MANIFEST_TAG" --arg purl "$PURL" '
def fix: gsub("GPL-2.0-with-classpath-exception"; "GPL-2.0-only WITH Classpath-exception-2.0");
(.. | .licenseDeclared? // empty) |= (if type == "string" then fix else . end)
| (.. | .licenseConcluded? // empty) |= (if type == "string" then fix else . end)
| .creationInfo.creators += ["Organization: Stackable GmbH"]
| (first(.relationships[]? | select(.relationshipType == "DESCRIBES") | .relatedSpdxElement)) as $root
| .packages |= map(
if .SPDXID == $root then
.name = $source_name
| .versionInfo = $version
| .supplier = "Organization: Stackable GmbH"
| .originator = "Organization: Stackable GmbH"
| .externalRefs = ((.externalRefs // []) + [{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": $purl
}])
else . end)
' sbom.spdx.raw.json > sbom.spdx.json

# Attest the SPDX SBOM to the image
Expand Down