Added attestation from intermediate multi-stage build steps

docker-library · Sep 25, 2023 · a84b199 · a84b199
1 parent 81ad274
commit a84b199
Show file tree

Hide file tree

Showing 12 changed files with 60 additions and 0 deletions.
diff --git a/3.10/alpine/Dockerfile b/3.10/alpine/Dockerfile
diff --git a/3.10/ubuntu/Dockerfile b/3.10/ubuntu/Dockerfile
diff --git a/3.11/alpine/Dockerfile b/3.11/alpine/Dockerfile
diff --git a/3.11/ubuntu/Dockerfile b/3.11/ubuntu/Dockerfile
diff --git a/3.12/alpine/Dockerfile b/3.12/alpine/Dockerfile
diff --git a/3.12/ubuntu/Dockerfile b/3.12/ubuntu/Dockerfile
diff --git a/3.13-rc/alpine/Dockerfile b/3.13-rc/alpine/Dockerfile
diff --git a/3.13-rc/ubuntu/Dockerfile b/3.13-rc/ubuntu/Dockerfile
diff --git a/3.9/alpine/Dockerfile b/3.9/alpine/Dockerfile
diff --git a/3.9/ubuntu/Dockerfile b/3.9/ubuntu/Dockerfile
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
@@ -12,6 +12,8 @@ RUN apk add --no-cache \
 
 FROM build-base as openssl-builder
 
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
 # Default to a PGP keyserver that pgp-happy-eyeballs recognizes, but allow for substitutions locally
 ARG PGP_KEYSERVER=keyserver.ubuntu.com
 # If you are building this image locally and are getting `gpg: keyserver receive failed: No data` errors,
@@ -145,6 +147,8 @@ RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
 
 FROM openssl-builder as erlang-builder
 
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
 RUN set -eux; \
 # /usr/local/src doesn't exist in Alpine by default
 	mkdir -p /usr/local/src; \

diff --git a/Dockerfile-ubuntu.template b/Dockerfile-ubuntu.template
@@ -2,6 +2,8 @@
 # especially for the enterprises that we, the RabbitMQ team, have to deal with
 FROM ubuntu:{{ .ubuntu.version }} as build-base
 
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
 RUN set -eux; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
@@ -13,6 +15,8 @@ RUN set -eux; \
 
 FROM build-base as openssl-builder
 
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
 # Default to a PGP keyserver that pgp-happy-eyeballs recognizes, but allow for substitutions locally
 ARG PGP_KEYSERVER=keyserver.ubuntu.com
 # If you are building this image locally and are getting `gpg: keyserver receive failed: No data` errors,
@@ -145,6 +149,8 @@ RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
 
 FROM openssl-builder as erlang-builder
 
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
 RUN set -eux; \
 	OTP_SOURCE_URL="https://github.com/erlang/otp/releases/download/OTP-$OTP_VERSION/otp_src_$OTP_VERSION.tar.gz"; \
 	OTP_PATH="/usr/local/src/otp-$OTP_VERSION"; \