From cc9fe5eb73289df08811e58922d8bcfeefb126b4 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 24 May 2026 12:13:33 +0000 Subject: Revert "T8542: Add functionality to generate SBOM file from ISO image. Get Syft from the CDN to prevent a possible supply chain attack" This reverts commit a0f74b5a2565956ce405b7185842cbdd0b4f1768. --- scripts/check-qemu-install | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) (limited to 'scripts') diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index e6f7291f..da1e54c9 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -422,22 +422,10 @@ if args.sbom: subprocess.check_output(['mount', '-o', 'loop', transfer_disk_path, setup_mount]) try: log.info('Downloading syft to transfer disk') - if platform.machine() in ['amd64', 'x86_64']: - syft_tar_url = 'https://cdn.vyos.io/tools/syft_1.44.0_linux_amd64.tar.gz' - elif platform.machine() in ['arm64', 'aarch64']: - syft_tar_url = 'https://cdn.vyos.io/tools/syft_1.44.0_linux_arm64.tar.gz' - else: - raise ValueError(f'Unsupported architecture for syft download: {platform.machine()}') - import tarfile, tempfile - with tempfile.TemporaryDirectory() as tar_tmp: - tar_path = os.path.join(tar_tmp, 'syft.tar.gz') - subprocess.check_call(['curl', '-sSfL', '-o', tar_path, syft_tar_url]) - with tarfile.open(tar_path) as tf: - with tf.extractfile(tf.getmember('syft')) as src: - dest_path = os.path.join(setup_mount, 'syft') - with open(dest_path, 'wb') as dst: - dst.write(src.read()) - os.chmod(os.path.join(setup_mount, 'syft'), 0o755) + subprocess.check_call( + f'curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b {setup_mount}', + shell=True + ) log.info('Syft downloaded to transfer disk') finally: subprocess.check_output(['umount', setup_mount]) -- cgit v1.2.3