Skip to content

Conversation

@onprema
Copy link

@onprema onprema commented Apr 30, 2025

As I was looking into apko I noticed some of the docs are a bit dusty. There are some deeper changes that probably should be done, but this PR updates some of the low-hanging fruit.

There are a few references to apko build creating an SBOM, but it doesn't appear that it does anymore. For example, in README.md, the apko build output is:

...
2022/04/08 13:22:31 apko (aarch64): generating SBOM
2022/04/08 13:22:31 building OCI image from layer '/tmp/apko-3027985148.tar.gz'
2022/04/08 13:22:31 OCI layer digest: sha256:ba034c07d0945abf6caa46fe05268d2375e4209e169ff7fdd34d40cf4e5f2dd6
2022/04/08 13:22:31 OCI layer diffID: sha256:9b4ab6bb8831352b25c4bd21ee8259d1f3b2776deec573733291d71a390157bb
2022/04/08 13:22:31 output OCI image file to apko-alpine.tar

Today it looks like this:

$ apko build examples/alpine-base.yaml apko-alpine:test apko-alpine-test.tar
...
2025/04/30 13:11:20 INFO installing alpine-base (3.22.0_alpha20250108-r1) arch=x86_64
2025/04/30 13:11:20 INFO layer digest: sha256:85d2074c46fc98c87ab1cd4a90c5d534b181386b390855a408f2402b56e195a3 arch=x86_64
2025/04/30 13:11:20 INFO layer diffID: sha256:6320ab11777096f805b5cfa778f95827755566dcebccfaf03081892f624c2e86 arch=x86_64
2025/04/30 13:11:20 INFO built index file as /var/folders/zb/vd7x6wlj13vbrw_0hn3n0k680000gn/T/apko-temp-126259869/index.json

I'd be happy to update these docs to remove references of the SBOM creation during apko build if my understanding is correct about it not creating an SBOM.

Thanks for taking a look!
Lee

@onprema onprema force-pushed the main branch 4 times, most recently from 24518e7 to 63931e0 Compare April 30, 2025 22:17
Signed-off-by: Lee Gaines <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant