From 30ca4c7bc0abe95d77d67eb091a5659db6535a4a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 2 Jun 2026 21:08:22 +0200 Subject: sbom: T8542: change result filenames to match ISO image filename --- scripts/image-build/build-vyos-image | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'scripts') diff --git a/scripts/image-build/build-vyos-image b/scripts/image-build/build-vyos-image index 2b52061f..79431eb1 100755 --- a/scripts/image-build/build-vyos-image +++ b/scripts/image-build/build-vyos-image @@ -729,23 +729,25 @@ Pin-Priority: 600 # Now create SBOM syft_target_dir = 'chroot' syft_base_path = os.getcwd() + f'/{syft_target_dir}' + base_filename = iso_file.rstrip('.iso') cmd = [['syft', syft_target_dir, '--source-name', 'VyOS', '--source-version', version, - '-o', f'cyclonedx-json=vyos-{version}.cdx.json', - '-o', f'spdx-json=vyos-{version}.spdx.json']] + '-o', f'cyclonedx-json={base_filename}.cdx.json', + '-o', f'spdx-json={base_filename}.spdx.json']] # syft bug for CycloneDX https://github.com/anchore/syft/issues/4592#issuecomment-4567247328 - cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'vyos-{version}.cdx.json']) - cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'vyos-{version}.spdx.json']) + cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@@g', f'{base_filename}.cdx.json']) + cmd.append(['sed', '-i', '-e', f's@{syft_base_path}@//@g', f'{base_filename}.spdx.json']) for c in cmd: - print(c) with subprocess.Popen(c, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1) as p: for line in p.stdout: sys.stdout.write(line) sys.stdout.flush() p.wait() + print("I: Finished SBOM generation") + # If the flavor has `image_format = "iso"`, then the work is done. # If not, build additional flavors from the ISO. -- cgit v1.2.3 From 819e3c634743173762f4f2c0e3f5cbc19a2b39a6 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 2 Jun 2026 21:06:01 +0200 Subject: oci: T8602: use xorriso to unpack squashfs instead of mounting ISO filesystem --- docker/Dockerfile | 3 +- scripts/iso-to-oci | 101 ++++++++++++++++++++++++++++++----------------------- 2 files changed, 60 insertions(+), 44 deletions(-) (limited to 'scripts') diff --git a/docker/Dockerfile b/docker/Dockerfile index 46658eb4..7f40092f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -110,7 +110,8 @@ RUN apt-get update && apt-get install -y \ gdisk \ sbsigntool \ dosfstools \ - kpartx + kpartx \ + xorriso # Packages for TPM test RUN apt-get update && apt-get install -y swtpm diff --git a/scripts/iso-to-oci b/scripts/iso-to-oci index 421a94ee..87d1474a 100755 --- a/scripts/iso-to-oci +++ b/scripts/iso-to-oci @@ -1,74 +1,89 @@ #!/bin/bash -function cleanup() { - if [[ -d $ROOTFS ]]; then - rm -rf $ROOTFS - fi - if [[ -d $UNSQUASHFS ]]; then - rm -rf $UNSQUASHFS +set -euo pipefail + +cleanup() { + if [[ -n "${WORKDIR:-}" && -d "${WORKDIR:-}" ]]; then + rm -rf "${WORKDIR}" fi } -if [[ $(/usr/bin/id -u) -ne 0 ]]; then - echo "Not running as root" - exit 1 -fi - -if [ "$#" -ne 1 ]; then - echo "Illegal number of parameters" - exit 1 +if [[ "$#" -ne 1 ]]; then + echo "Usage: $0 " + exit 2 fi ISO=$1 -ROOTFS=rootfs -UNSQUASHFS=unsquashfs - -if [ ! -f "$ISO" ]; then - echo "E: Unable to find VyOS ISO image \"$ISO\" required for conversion" - exit 1 +if [[ ! -f "$ISO" ]]; then + echo "E: ISO file not found: $ISO" + exit 2 fi # ensure clean working directory cleanup -mkdir $ROOTFS $UNSQUASHFS -echo "I: mount ISO $ISO" -mount -t iso9660 -o loop $ISO $ROOTFS/ >/dev/null 2>&1 +if ! command -v xorriso >/dev/null 2>&1; then + echo "E: missing dependency: xorriso" + echo " Install xorriso (recommended) or run inside the vyos-build container." + exit 2 +fi + +if ! command -v unsquashfs >/dev/null 2>&1; then + echo "E: missing dependency: unsquashfs" + echo " Install squashfs-tools or run inside the vyos-build container." + exit 2 +fi + +if ! command -v jq >/dev/null 2>&1; then + echo "E: missing dependency: jq" + echo " Install jq or run inside the vyos-build container." + exit 2 +fi + +WORKDIR="$(mktemp -d -t iso-to-oci.XXXXXXXXXX)" +trap cleanup EXIT + +ROOTFS="${WORKDIR}/iso" +UNSQUASHFS="${WORKDIR}/unsquashfs" +mkdir -p "${ROOTFS}/live" "${UNSQUASHFS}" + +echo "I: extracting ISO metadata" +xorriso -osirrox on -indev "${ISO}" -extract /version.json "${ROOTFS}/version.json" >/dev/null 2>&1 + +echo "I: extracting squashfs image" +xorriso -osirrox on -indev "${ISO}" -extract /live/filesystem.squashfs "${ROOTFS}/live/filesystem.squashfs" >/dev/null 2>&1 # create directory, unpack squashfs filesystem, get ISO version -# and unmount ISO echo "I: extracting squashfs content" -unsquashfs -follow -dest $UNSQUASHFS/ $ROOTFS/live/filesystem.squashfs >/dev/null 2>&1 -VERSION=$(jq --raw-output .version $ROOTFS/version.json) -umount $ROOTFS/ +unsquashfs -follow -dest "${UNSQUASHFS}/" "${ROOTFS}/live/filesystem.squashfs" >/dev/null 2>&1 +VERSION="$(jq --raw-output .version "${ROOTFS}/version.json")" # fix locales for correct system configuration loading -sed -i 's/^LANG=.*$/LANG=C.UTF-8/' $UNSQUASHFS/etc/default/locale +sed -i 's/^LANG=.*$/LANG=C.UTF-8/' "${UNSQUASHFS}/etc/default/locale" # optional step: Decrease docker image size by deleting not necessary files for container -rm -rf $UNSQUASHFS/boot/*.img -rm -rf $UNSQUASHFS/boot/*vyos* -rm -rf $UNSQUASHFS/boot/vmlinuz -rm -rf $UNSQUASHFS/lib/firmware/ -rm -rf $UNSQUASHFS/usr/lib/x86_64-linux-gnu/libwireshark.so* -rm -rf $UNSQUASHFS/lib/modules/*amd64-vyos -rm -rf $UNSQUASHFS/root/.gnupg +rm -rf "${UNSQUASHFS}/boot" +rm -rf "${UNSQUASHFS}/lib/firmware/" +rm -rf "${UNSQUASHFS}/usr/lib/x86_64-linux-gnu/libwireshark.so*" +rm -rf "${UNSQUASHFS}/lib/modules/*-vyos" +rm -rf "${UNSQUASHFS}/root/.gnupg" # delete features not supported in container - only remove the node.def files, # this is sufficient to not make the feature pop up on the CLI -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/container -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/system/option/kernel -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/system/option/startup-beep -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/system/option/root-partition-auto-resize -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/system/option/reboot-on-panic -rm -rf $UNSQUASHFS/opt/vyatta/share/vyatta-cfg/templates/system/option/performance +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/container" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/console" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/kernel" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/startup-beep" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/root-partition-auto-resize" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/reboot-on-panic" +rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/performance" # create a symbolic link to the configuration -ln -s /opt/vyatta/etc/config $UNSQUASHFS/config +ln -s /opt/vyatta/etc/config "${UNSQUASHFS}/config" # create docker image echo "I: generate OCI container image vyos-$VERSION.tar" -tar -C unsquashfs -c . -f vyos-$VERSION.tar +tar -C "${UNSQUASHFS}" -c . -f "vyos-${VERSION}.tar" echo "I: to import the previously generated OCI image to your local images run:" echo "" -- cgit v1.2.3