Skip to content

feat: native sbom generation for hcp#13566

Merged
anurag5sh merged 31 commits intomainfrom
anurag/native_sbom
Mar 25, 2026
Merged

feat: native sbom generation for hcp#13566
anurag5sh merged 31 commits intomainfrom
anurag/native_sbom

Conversation

@anurag5sh
Copy link
Copy Markdown
Collaborator

Description

This PR adds the native SBOM generation capability within Packer in the existing hcp-sbom provisioner.
Packer will automatically download syft binary for generating the sbom. This also supports using a custom binary of your choice to generate the sbom.

Relavant config options has been added to support this feature.

@anurag5sh anurag5sh requested a review from a team as a code owner March 17, 2026 06:07
Copy link
Copy Markdown

@galapas1 galapas1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the native SBOM generation feature. Summary of requested changes:

  • Docs: Clarify that source and auto_generate are mutually exclusive.
  • Validation: Consider allowing elevated_user/elevated_password when using source so users can toggle only auto_generate without clearing those fields.
  • Structure: Extract the retry callback into a named function for readability and testability.
  • Syft version: Consider pinning to a known version with Dependabot, or document the trade-off of using "latest".
  • Windows cleanup: Quote paths in del for paths with spaces.
  • Packer core: Consider delegating FlatConfig() to the inner provisioner for consistency.

@anurag5sh
Copy link
Copy Markdown
Collaborator Author

Thanks for the native SBOM generation feature. Summary of requested changes:

  • Docs: Clarify that source and auto_generate are mutually exclusive.
  • Validation: Consider allowing elevated_user/elevated_password when using source so users can toggle only auto_generate without clearing those fields.
  • Structure: Extract the retry callback into a named function for readability and testability.
  • Syft version: Consider pinning to a known version with Dependabot, or document the trade-off of using "latest".
  • Windows cleanup: Quote paths in del for paths with spaces.
  • Packer core: Consider delegating FlatConfig() to the inner provisioner for consistency.

I have made all the changes as requested, please take another look at it whenever possible. Thanks!
@galapas1 @tanmay-hc

@anurag5sh
Copy link
Copy Markdown
Collaborator Author

Oh and here's the docs for this, since we moved out to unified repo now - hashicorp/web-unified-docs#1999

@anurag5sh anurag5sh requested review from galapas1 and tanmay-hc March 23, 2026 05:17
tanmay-hc
tanmay-hc previously approved these changes Mar 23, 2026
galapas1
galapas1 previously approved these changes Mar 23, 2026
Copy link
Copy Markdown

@galapas1 galapas1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved with requested edits shared via slack.

@anurag5sh anurag5sh dismissed stale reviews from galapas1 and tanmay-hc via 9a254de March 24, 2026 06:36
@anurag5sh anurag5sh merged commit ea25de1 into main Mar 25, 2026
10 of 11 checks passed
@anurag5sh anurag5sh deleted the anurag/native_sbom branch March 25, 2026 06:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants