Optionally skip SBOM generation #1507
Conversation
arewm
force-pushed
the
skip-sbom
branch
2 times, most recently
from
8913530 to
b37c8c5
Compare
arewm
changed the title
|
I just need to wait for the Tekton change so that we can increase the size of buildah-remote. :) |
|
This cannot be merged until the version of Tekton is updated. I think that is planned on Monday with redhat-appstudio/infra-deployments#5201 |
|
Hello @arewm. FYI version 0.3 of |
|
Thanks for letting me know. I just pushed the changes. |
Since we can require SBOMs to be present with EC policies, we can enable users to optionally speed up their builds by not analyzing repositories to generate build-time SBOMs. While we may have a partial SBOM from the prefetched data, we should just not upload an SBOM at all in order to simplify decisions (i.e. removing the need to decide if the SBOM is full or partial). Signed-off-by: arewm <[email protected]>
|
Looks good to me. Do we have a procedure for deprecating older versions of the buildah task though? I'm fine with updating 0.2 too, just wondering. |
|
The 0.2 task can be deprecated whenever we determine that it is best to do it. Since it is not currently deprecated, I think it makes most sense to apply this change to both. |
Since we can require SBOMs to be present with EC policies, we can enable
users to optionally speed up their builds by not analyzing repositories
to generate build-time SBOMs.
While we may have a partial SBOM from the prefetched data, we should
just not upload an SBOM at all in order to simplify decisions (i.e.
removing the need to decide if the SBOM is full or partial).