Repository navigation
Publish the release SBOM as SPDX 3 and fix its source reference - #4562
Merged
kubernetes-prow[bot] merged 1 commit intoNov 3, 2026
Merged
Conversation
kubernetes-prow
Bot
added
release-note
kubernetes-prow
Bot
added
area/release-eng
saschagrunert
force-pushed
the
release-sbom-spdx3
branch
2 times, most recently
from
October 13, 2026 12:14
b824a4e to
2872666
Compare
saschagrunert
changed the title
saschagrunert
force-pushed
the
release-sbom-spdx3
branch
from
October 13, 2026 12:22
2872666 to
297c884
Compare
Member
Author
|
@kubernetes/release-engineering PTAL |
saschagrunert
force-pushed
the
release-sbom-spdx3
branch
from
October 16, 2026 06:28
297c884 to
3865c99
Compare
Closed
7 of 19 tasks
Member
Author
|
@kubernetes/release-engineering PTAL |
xmudrii
reviewed
Oct 30, 2026
xmudrii
left a comment
xmudrii
left a comment
Member
There was a problem hiding this comment.
There are some nits, but otherwise looks great to me. I would like to check something before we merge this though.
/hold
kubernetes-prow
Bot
added
do-not-merge/hold
saschagrunert
force-pushed
the
release-sbom-spdx3
branch
from
November 2, 2026 06:51
3865c99 to
c07e14a
Compare
kubernetes-prow
Bot
added
needs-rebase
The stage run writes the release artifacts SBOM as SPDX 3.0.1 JSON-LD next to the SPDX 2.3 tag-value document and stages it as kubernetes-release.spdx3.json; the source SBOM stays SPDX 2.3 only, since it would grow from 24 MB to 88 MB. The generated-from relationships of both documents pointed to SPDXRef-Package-kubernetes, which the source SBOM doesn't have; they now point to the package the source SBOM describes. bom's conversion drops relationships to other documents, so the SPDX 3 document gets that package as an element of its own, with the release version, a reference to the source SBOM carrying its checksums and one generates relationship, and its own IRI, the URL sbom.k8s.io would serve it under. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
saschagrunert
force-pushed
the
release-sbom-spdx3
branch
from
November 3, 2026 06:02
c07e14a to
8e801be
Compare
kubernetes-prow
Bot
removed
the
needs-rebase
Member
Author
|
@kubernetes/release-engineering PTAL |
kubernetes-prow
Bot
removed
the
do-not-merge/hold
kubernetes-prow
Bot
added
the
lgtm
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: saschagrunert, xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 of 13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind feature
/kind bug
What this PR does / why we need it:
spdx.ToProtobom,spdx.WriteSPDX3), and stages it askubernetes-release.spdx3.jsonnext tokubernetes-release.spdx. Like every staged file, it is published with the release to dl.k8s.io, gets a checksum and is a subject of the stage provenance. The source SBOM stays SPDX 2.3 only for now: converted, it grows from 24 MB to 88 MB per release.DocumentRef-kubernetes-<version>:SPDXRef-Package-kubernetes, but the source SBOM has no such element. The stage run now reads the package the source SBOM describes (its root element),k8s.io/kubernetes(for v1.37.1SPDXRef-Package-k8s.io-kubernetes-v1.37.1-1C438aaeb4e5), and points the relationships to it. Otherwise the SPDX 2.3 document is unchanged, sbom.k8s.io keeps serving it, and the release provenance takes its subjects from it.https://sbom.k8s.io/<version>/sourceand onegeneratesrelationship to all images and binaries built from it. It carries the release version andpkg:golang/k8s.io/kubernetes@<version>, since it describes the source code of the release; the source SBOM itself keeps the version bom derives for the module (v1.37.1-1+8aaeb4e5for v1.37.1).https://sbom.k8s.io/<version>/release.spdx3.jsoninstead of reusing the namespace of the SPDX 2.3 document. A matching redirect can follow in kubernetes/k8s.io.Which issue(s) this PR fixes:
None
Special notes for your reviewer:
Checked with the published v1.37.1 SBOMs: the rewritten SPDX 2.3 reference exists in the source SBOM, and the SPDX 3 document (1.5 MB, converted in about 30 ms) has one
generatesrelationship from the source package to the 24 images and passesspdx3-validatefor SPDX 3.0.1. The relationship comment of the SPDX 2.3 document can't be carried over, since protobom edges have no comment; the source element carries it instead. The SPDX 2.3 document pins the source SBOM by checksum; SPDX 3 would do that with anExternalMapandverifiedUsing, which protobom can't express yet, so the comment of the external reference carries the SHA1 and SHA256 checksums meanwhile.Does this PR introduce a user-facing change?