fixes 168: label all container with org.opencontainers.image.source

smithy-security · May 6, 2024 · b111ac8 · b111ac8
1 parent 35ee8a4
commit b111ac8
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 2 deletions.
diff --git a/Makefile b/Makefile
@@ -10,6 +10,7 @@ commits_since_latest_tag=$(shell git log --oneline $(latest_tag)..HEAD | wc -l)
 
 GO_TEST_PACKAGES=$(shell go list ./... | grep -v /vendor/)
 CONTAINER_REPO=ghcr.io/ocurity/dracon
+SOURCE_CODE_REPO=https://github.com/ocurity/dracon
 DRACON_VERSION=$(shell echo $(latest_tag)$$([ $(commits_since_latest_tag) -eq 0 ] || echo "-$$(git log -n 1 --pretty='format:%h')" )$$([ -z "$$(git status --porcelain=v1 2>/dev/null)" ] || echo "-dirty" ))
 TEKTON_VERSION=0.44.0
 TEKTON_DASHBOARD_VERSION=0.29.2
@@ -51,7 +52,9 @@ cmd/draconctl/bin:
 	CGO_ENABLED=0 go build -o bin/cmd/draconctl cmd/draconctl/main.go
 
 draconctl-image: cmd/draconctl/bin
-	$(DOCKER) build -t "${CONTAINER_REPO}/draconctl:${DRACON_VERSION}" -f containers/Dockerfile.draconctl .
+	$(DOCKER) build -t "${CONTAINER_REPO}/draconctl:${DRACON_VERSION}" \
+		$$([ "${SOURCE_CODE_REPO}" != "" ] && echo "--label=org.opencontainers.image.source=${SOURCE_CODE_REPO}" ) \
+		-f containers/Dockerfile.draconctl .
 
 draconctl-image-publish: draconctl-image
 	$(DOCKER) push "${CONTAINER_REPO}/draconctl:${DRACON_VERSION}"

diff --git a/components/producers/aggregator/Makefile b/components/producers/aggregator/Makefile
@@ -2,13 +2,15 @@
 
 CONTAINER_REPO=
 DRACON_VERSION=
+SOURCE_CODE_REPO=
 PRODUCER_AGGREGATOR_BASE_IMAGE=$(shell test -e .custom_image && cat .custom_image || echo "scratch")
 
 DOCKER=docker
 
 container:
 	$(DOCKER) build --tag $(CONTAINER_REPO)/components/producers/tagger:$(DRACON_VERSION) \
 					--file Dockerfile \
+					$$([ "${SOURCE_CODE_REPO}" != "" ] && echo "--label=org.opencontainers.image.source=${SOURCE_CODE_REPO}" ) \
 					--build-arg PRODUCER_AGGREGATOR_BASE_IMAGE=$(PRODUCER_AGGREGATOR_BASE_IMAGE) ../../../bin 1>&2
 
 publish:

diff --git a/components/producers/ossf-scorecard/Makefile b/components/producers/ossf-scorecard/Makefile
@@ -9,6 +9,7 @@ DOCKER=docker
 extras:
 	$(DOCKER) build --tag $(CONTAINER_REPO)/components/producers/ossf-scorecard:$(DRACON_VERSION) \
 					--file Dockerfile \
+					$$([ "${SOURCE_CODE_REPO}" != "" ] && echo "--label=org.opencontainers.image.source=${SOURCE_CODE_REPO}" ) \
 					--build-arg OSSF_SCORECARD_SAFETY_BASE_IMAGE=$(OSSF_SCORECARD_SAFETY_BASE_IMAGE) ../../.. 1>&2
 
 publish-extras:

diff --git a/components/producers/typescript-eslint/eslint-wrapper/Makefile b/components/producers/typescript-eslint/eslint-wrapper/Makefile
@@ -9,4 +9,5 @@ DOCKER=docker
 container:
 	$(DOCKER) build --tag $(CONTAINER_REPO)/components/producers/typescript-eslint/eslint-wrapper:$(DRACON_VERSION) \
 					--file Dockerfile \
+					$$([ "${SOURCE_CODE_REPO}" != "" ] && echo "--label=org.opencontainers.image.source=${SOURCE_CODE_REPO}" ) \
 					--build-arg ESLINT_WRAPPER_BASE_IMAGE=$(ESLINT_WRAPPER_BASE_IMAGE) ../../../.. 1>&2
diff --git a/scripts/build_component_container.sh b/scripts/build_component_container.sh
@@ -30,7 +30,9 @@ else
     "
     dockerfile_path=$(mktemp)
     printf "${dockerfile_template}" > "${dockerfile_path}"
-    docker build -t "${CONTAINER_REPO}/${executable_src_path}:${DRACON_VERSION}" -f "${dockerfile_path}" ./bin
+    docker build -t "${CONTAINER_REPO}/${executable_src_path}:${DRACON_VERSION}" \
+        $([ "${SOURCE_CODE_REPO}" != "" ] && echo "--label=org.opencontainers.image.source=${SOURCE_CODE_REPO}" ) \
+        -f "${dockerfile_path}" ./bin
 fi
 
 if make -C "${executable_src_path}" --no-print-directory --dry-run extras >/dev/null 2>&1