@@ -48,9 +48,10 @@ docker-publish:
48
48
# Uses the keyless signing flow with Github Actions as identity provider\
49
49
cosign sign -y " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
50
50
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
51
- syft scan --output cyclonedx-json=sbom.json --select-catalogers " -cargo-auditable-binary-cataloger" --scope all-layers --source-name " ${OPERATOR_NAME} " --source-version " ${VERSION} " " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
51
+ syft scan --output cyclonedx-json=sbom.json --select-catalogers " -cargo-auditable-binary-cataloger" --scope all-layers --source-name " ${OPERATOR_NAME} " --source-version " ${VERSION} - ${ARCH} " " ${DOCKER_REPO} /${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE" ; \
52
52
# Determine the PURL for the container image\
53
- PURL=" pkg:docker/${ORGANIZATION} /${OPERATOR_NAME} @$$ REPO_DIGEST_OF_IMAGE?repository_url=${DOCKER_REPO} " ; \
53
+ URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g' ) ; \
54
+ PURL=" pkg:oci/${OPERATOR_NAME} @$$ URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH} &repository_url=${DOCKER_REPO} %2F${ORGANIZATION} %2F${OPERATOR_NAME} " ; \
54
55
# Get metadata from the image\
55
56
IMAGE_DESCRIPTION=$$(docker inspect --format='{{.Config.Labels.description}}' "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}" ) ; \
56
57
IMAGE_NAME=$$(docker inspect --format='{{.Config.Labels.name}}' "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}" ) ; \
@@ -73,9 +74,10 @@ docker-publish:
73
74
# Uses the keyless signing flow with Github Actions as identity provider\
74
75
cosign sign -y "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
75
76
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
76
- syft scan --output cyclonedx-json=sbom.json --select-catalogers "-cargo-auditable-binary-cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}" "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
77
+ syft scan --output cyclonedx-json=sbom.json --select-catalogers "-cargo-auditable-binary-cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}-${ARCH} " "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
77
78
# Determine the PURL for the container image\
78
- PURL="pkg:docker/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE?repository_url=${OCI_REGISTRY_HOSTNAME}";\
79
+ URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g');\
80
+ PURL="pkg:oci/${OPERATOR_NAME}@$$URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH}&repository_url=${OCI_REGISTRY_HOSTNAME}%2F${OCI_REGISTRY_PROJECT_IMAGES}%2F${OPERATOR_NAME}";\
79
81
# Get metadata from the image\
80
82
IMAGE_DESCRIPTION=$$(docker inspect --format='{{.Config.Labels.description}}' "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
81
83
IMAGE_NAME=$$(docker inspect --format='{{.Config.Labels.name}}' "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
0 commit comments