spinframework / spinframework/spin
Generate and sign SBOM through spin
@michelleN is already working on this.
Since Sep 10, 2024.
- Dominant language
- Rust
- Stars
- 6.5k
- Forks
- 310
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 24
Description
Background
There is a general push for SBOMs in the software community, especially after the executive order back in 2021.
I have very limited knowledge about the WASM community, so I have no idea how hard this would be. But the Kubernetes community is working hard on making tooling around good security defaults better all the time.
If spin could make it easy to generate SBOM for both the generated WASM and the container, I know that will help the WASM community in the long run.
Solution
Preferably, it should be possible to generate SBOMs according to the two existing standards.
This could be a separate issue, but it would also be nice if to use sigstore to sign of the WASM binary, container image and the SBOM could be done easily through spin.
This is, for example, something that ko is doing by default.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.