Add `--attest` and/or `--sbom`
blampe opened this issue · comments
Some users would like to scan every stage of their build pipelines for vulnerabilities. Current solutions are limited to either
- inspecting only the final/pushed image, which usually only includes built artifacts and not dependencies; or
- stitching together a non-trivial chain of builds -- e.g. output stages to a local directory; run a command to scan those stages; reload from disk and push if the command succeeds.
BuildKit natively supports generating software-bill-of-materials on the fly, and we can expose that functionality via an attest
(or sbom
-- shorthand for --attest=type=sbom
) option on Image
.
A hypothetical policy-as-code could then ensure --sbom
is applied to all images via a remediation policy. All images would then include a SBOM manifest appropriate for scanning.
Additional thoughts:
- Users may want to specify a different generator image, so we should at least support
attest
. - Unless a target includes BUILDKIT_SBOM_SCAN_STAGE it will not be scanned by default, which is easy to forget and therefore error-prone. The provider currently parses the Dockerfile and knows all of the stages it's going to build, and it would be feasible to automatically inject
BUILDKIT_SBOM_SCAN_STAGE
into all/some targets if it's not already present. How would we enable or configure that behavior?