SBOM does not get built for minirootfs

Open

#2,084 opened on Feb 22, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 45/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: go
Domain: build-system, cli

Research direction

Start in internal/cli/build-minirootfs.go at the --sbom-path option and follow how the argument is passed to BuildMinirootFSCmd. Confirm whether the minirootfs build uses it; done means --sbom-path produces an SBOM when running apko build-minirootfs.

Written by the indexing model from the issue text.

Description

I'm trying to explore using apko to build minirootfs images and I'm exploring SBOM generation as part of this.

When calling apko build-minirootfs --help I see:

      --sbom-path string                     generate an SBOM

Which does appear to come from build-minirootfs.go specifically:

https://github.com/chainguard-dev/apko/blob/dd5a700b95a67ea882e7b59bca6b913afb44954d/internal/cli/build-minirootfs.go#L59

https://github.com/chainguard-dev/apko/blob/dd5a700b95a67ea882e7b59bca6b913afb44954d/internal/cli/build-minirootfs.go#L69

But unless I'm missing something, I think that although that sbomPath argument does get passed into BuildMinirootFSCmd, I don't think the BuildMinirootFSCmd function actually does anything with it.

Am I missing something, or is the SBOM generation not actually fully hooked-up for minirootfs builds?

Dominant language: Go
Stars: 1.7k
Forks: 228
Avg merge: 1d 3h
Merged PRs (30d): 62

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[optimization:agents-md-curator] AGENTS.md: compress duplicated Debugging & Logging section and merge redundant autopilot rules Open

optimization optimization:agents-md-curator

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

githubnext/gh-aw-cao#13143 · Opened Sep 20, 2026
fix(ui/spend): normalize mnemonic before keystore reattach comparison Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

blinklabs-io/bursa#904 · Opened Sep 20, 2026
docs(parser): clarify State callback lifecycle Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

yanet-platform/ipfw-go#129 · Opened Sep 20, 2026
[confmap/provider/googlesecretmanagerprovider] Missing URI format validation for Google Secret Manager resource paths Open

bug confmap/provider/googlesecretmanagerprovider needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments · Opened Sep 20, 2026
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 90/100

coder/coder#29623 · 1 comment · Opened Sep 20, 2026

More Go issues