add sbom diff functionality #10343
Open
add sbom diff functionality #10343
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
compare Erlang/OTP SBOMs. this functionality is useful to compare if the Github Erlang/OTP generated SBOM matches one produced manually, or that mimics all the steps from the Github scripts.
kikofernandez
added
team:VM
Contributor
CT Test Results 1 files 11 suites 3m 13s ⏱️ Results for commit 10a60ac. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts// Erlang/OTP Github Action Bot |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds simple tool to compare Erlang/OTP SBOMs.
This functionality is mostly to be used internally, simply to check that the Github generated SBOM is exactly the same one that one can produce internally, i.e., taking all Github integrations and moving them in-house, running those scripts.
Produces information about:
In some cases, the ouput will be written to a json file for ease of parsing (if there are many differences in files, it would be tedious to read from standard output). In other cases, the diff will be shown in standard output, mentioning the package and fields affected.