[Bug 2077105] Re: cloud-images do not produce sboms

[John Chittum]

test and verified jammy

1. didn't need to clone, thank you git-ubuntu :)
2. git checkout ubuntu/noble-proposed
3. utilized ubuntu-old-fashioned/bartender to run a build:
bartender --livecd-rootfs-dir /home/jchittum/dev01/troubleshooting/packages/livecd-rootfs/livecd-rootfs --hook-extras-dir /home/jchittum/dev01/cloudware/cpc_packaging.extra --build-provider aws -- --series jammy --project ubuntu-cpc --image-target disk-image --image-target qcow2 --image-target vmdk
4. ensured that the sbom was made for the vmdk and qcow

ls ../downloads/build.output/
binary.log                             livecd.ubuntu-cpc.img             livecd.ubuntu-cpc.qcow.filelist  livecd.ubuntu-cpc.vmdk.manifest
livecd.ubuntu-cpc.disk-image.filelist  livecd.ubuntu-cpc.initrd-generic  livecd.ubuntu-cpc.qcow.manifest  livecd.ubuntu-cpc.vmdk.spdx
livecd.ubuntu-cpc.disk-image.manifest  livecd.ubuntu-cpc.kernel-generic  livecd.ubuntu-cpc.qcow.spdx
livecd.ubuntu-cpc.disk-image.spdx      livecd.ubuntu-cpc.manifest        livecd.ubuntu-cpc.vmdk
livecd.ubuntu-cpc.ext4                 livecd.ubuntu-cpc.ova             livecd.ubuntu-cpc.vmdk.filelist

5. verified via log that cpc-sbom was installed and used to generate

6. run a cloud-partner build

bartender --livecd-rootfs-dir
/home/jchittum/dev01/troubleshooting/packages/livecd-rootfs/livecd-
rootfs --hook-extras-dir
/home/jchittum/dev01/cloudware/cpc_packaging.extra --build-provider aws
--hook-extras-release-notes-tools-repo https://git.launchpad.net/~cloud-
images/cloud-images/+git/cpc-release-notes-tools --hook-extras-release-
notes-tools-branch main --hook-extras-sbom-tools-repo
git+ssh://git@github.com/canonical/cpc-sbom.git --hook-extras-sbom-
tools-subdir cpc_sbom -- --series jammy --project ubuntu-cpc --image-
target gce --image-target ec2

7. image builds succeeded
8. saw that the GCE image continue to generate an sbom
9. checked log to see that cpc-sbom was used to generate an SBOM _however_ as cpc_packaging.extra series files are not patched for consuming the SBOM, they remained on the system and not downloaded.

** Tags removed: verification-needed-jammy
** Tags added: verification-done-jammy

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2077105

Title:
  cloud-images do not produce sboms

Status in cloud-images:
  In Progress
Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Focal:
  Fix Committed
Status in livecd-rootfs source package in Jammy:
  Fix Committed
Status in livecd-rootfs source package in Noble:
  Fix Committed

Bug description:
  cloud images are not currently producing spdx formatted SBOMs equally.
  Some builds do produce sboms continuously.

  all cloud images must produce SBOMs, across all Suites and products.

  # REQUIREMENTS #

  * Current calls to create_manifest in livecd-rootfs/live-build/functions must not break
  * sbom generation must only be done for ubuntu-cpc project.

  # IMPACT #

  * will only affect `ubuntu-cpc` project
  * will add the creation of a new file
  * the SBOM requirement is part of Canonical's SSDLC efforts as well as partner contracts (multiple partners are requiring SBOMs for each generated artifact)

  # TEST PLAN #
  * test all the ubuntu-cpc livecd-rootfs only hooks and series. ensure that an spdx formatted sbom, manifest, and filelist is generated and saved
  * test non-ubuntu-cpc hook and make sure that nothing is generated (check for calls of create_manifest. if they aren't even calling it, then it's safe)
  * test private ubuntu-cpc hooks. ensure that current calls to create_manifest are not broken
  * test buildd builds to ensure no manifest is generated and no error is raised.

  # POSSIBLE REGRESSIONS / WHERE PROBLEMS COULD OCCUR #
  * any hook calling create_manifest is at risk if there is an issue with create_manifest
      * outside CPC specific hooks, the only build calling create_manifest is `buildd`. however this is not in the `ubuntu-cpc` project so it should skip the sbom generation.
  * any build where access to the snapstore is restricted, as this requires a snap
      * NOTE: launchpad livefs builds have access to the snapstore

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/2077105/+subscriptions