fix(merge): preserve dependency graphs so the merged BOM stays conformant#164
Merged
Conversation
…mant --merge dropped the per-layer `dependencies` trees, so a merged server BOM had zero dependency edges and failed the mandatory "transitive dependencies" check in validate-sbom.sh — the same check SKT runs. The per-layer SBOMs passed, but the merged single BOM that DT/TRUSCA expects did not, which defeated the point of merging. Merge the per-layer dependency graphs too: collect each input's `.dependencies`, union edges by ref (ARG_MAX-safe temp files), and emit them in the merged BOM. Cross-ecosystem bom-refs rarely collide; identical refs have their dependsOn lists unioned. Verified end-to-end with an overlay image: a real UBI9 rootfs OS layer (326 edges) + an application layer (3 edges) now merge to 329 edges, and validate-sbom.sh reports result=pass on all seven mandatory checks (previously transitive=fail). Update the server-delivery guide wording, which had described the merge as dropping dependencies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
문제
--merge가 층별dependencies트리를 버려, 병합된 서버 BOM은 dependency 엣지가 0이 되어validate-sbom.sh(=SKT가 돌리는 적합성 검증)의 필수 항목 transitive(전이 의존성) 에서 실패했습니다. 층별 SBOM은 통과하지만, DT/TRUSCA가 요구하는 병합 단일 BOM이 떨어져 병합의 의미가 사라집니다.수정
병합 시 각 층의 의존성 그래프도 합칩니다(입력별
.dependencies수집 → ref 기준 엣지 union, ARG_MAX 안전한 임시 파일 사용). 생태계가 달라 bom-ref 충돌은 드물고, 같은 ref는 dependsOn을 합칩니다.검증 (실측)
오버레이 이미지로 end-to-end: 실제 UBI9 rootfs OS층(326 엣지) + 앱층(3 엣지) → 병합 329 엣지,
validate-sbom.shresult=pass(7개 필수 전부, 이전엔 transitive=fail). server-delivery 가이드의 '병합은 dependencies를 버린다' 문구도 갱신.