Mark BOM entry as Launch

[dmikusa]

While Rust is not a launch dependency, it's version is important to know because it statically compiles binaries. Thus we are going to include its dependency into the launch BOM. This also works around an issue with buildpacks where the build BOM is not really visible. It's not included in pack inspect and the BOM label on the image.

Resolves #26

Had a quick think

[ForestEckhardt]

I think that there is something in the works for pack to allow a user to obtain the Build BOM. I think that would make more sense than having this kinda lie about when it is present in the container. I am willing to hear out more on this and maybe this is a good temporary measure but I would like to just tap the breaks really quickly on this!

[dmikusa]

@ForestEckhardt - Yes, I think you're referring to buildpacks/libcnb#77.

I do see this as a workaround, but I think you could also make a case that it should be included in the Launch layer. Rust is like Go in that it statically compiles things into the produced binaries. That means you need to know what tools did the compiling to know if your binaries are impacted by a CVE or bug. It's a little more pronounced in Go because Go compiles in a standard library, but the issue is the same with Rust or any other language tool set that makes use of static compilation.

I did look at the paketo-buildpacks/go-dist buildpack and it is, as far as I can tell, setting build and launch on its Go BOM entry.

[ForestEckhardt]

I did look at the paketo-buildpacks/go-dist buildpack and it is, as far as I can tell, setting build and launch on its Go BOM entry.

That is only true for the unit test during actual operation in a standard buildpack configuration the Go dependency only goes into the Build BOM.

As for the exposure of the Build BOM I am referencing this issue here buildpacks/pack#1221

[dmikusa]

Lol, that is the issue I meant to link to but copy and paste is hard. Sorry.

That is only true for the unit test during actual operation in a standard buildpack configuration the Go dependency only goes into the Build BOM.

OK, that's good to know. I guess then we should label this as a temporary workaround. I can adjust the comment to indicate it should be removed when the pack issue is resolved.

[ForestEckhardt]

That totally works for me!

[dmikusa]

Comment updated.