pnoltes commented on code in PR #845:
URL: https://github.com/apache/celix/pull/845#discussion_r3890016666
##########
.github/workflows/conan_create.yml:
##########
@@ -67,6 +67,17 @@ jobs:
CXX: ${{ matrix.compiler[1] }}
run: |
conan create . -c tools.cmake.cmaketoolchain:generator=Ninja -b
missing -o celix/*:build_all=True -o celix/*:enable_ccache=True -pr:b default
-pr:h default -s:h build_type=${{ matrix.type }} -o celix/*:celix_cxx17=True -o
celix/*:celix_install_deprecated_api=True -o mosquitto/*:broker=True -o
*:shared=True
+ - name: Generate CycloneDX SBOM
+ if: matrix.compiler[0] == 'gcc'
+ run: |
+ conan install . -o celix/*:build_all=True --deployer=cyclone_1.6
--deployer-folder=sbom -b missing -o *:shared=True
+ - name: Upload CycloneDX SBOM
+ if: matrix.compiler[0] == 'gcc'
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
# v4.6.2
Review Comment:
We can use the SBOM to scan the resolved dependencies for vulnerabilities,
as described in a separate follow-up ticket:
[[#825](https://github.com/apache/celix/issues/825)](https://github.com/apache/celix/issues/825).
Then we at least know which vulnerabilities exist in the dependencies
selected by the current default resolution. However, I am not sure how useful
this is without a `conan.lock` file. With a lockfile, the Celix sources would
include a reproducible, resolved dependency list.
Maybe we could generate the lockfile for a GCC Linux build on Ubuntu with
`build_all=True` and use it as our canonical dependency reference. It could
then serve as the basis for future vulnerability scans and help ensure more
reproducible builds. (and we should document the intended use for a the
lockfile and explain that celix is useable without a lockfile).
@PengZheng, maybe we should introduce such a lockfile. WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
