CDRIVER-5904 update scripts and release instructions for SilkBomb 2.0 #1882

eramongodb · 2025-02-20T19:31:20Z

Resolves CDRIVER-5904 for the master branch (EVG project: mongo-c-driver). Verified by this patch. Followup to #1875.

Applies similar changes to mongodb/mongo-cxx-driver#1344 but for the C Driver. Unlike the C++ Driver, the C Driver's sbom task only performs validate + augment and simply uploads the Augmented SBOM file (no diffs) so it may be examined and downloaded during release steps when needed.

Due to the current inability to download the Augmented SBOM outside of Evergreen with SilkBomb 2.0, the +sbom-download target and related commands, flags, and instructions are removed. In their place, a new release requirement is that etc/augmented-sbom.json is present when running +release-archive or +signed-release (this file does not need to be committed into the repo, it just needs to be present).

This file must be downloaded from a recent execution of the sbom task (a patch build is OK!) during the release process prior to executing +release-archive or +signed-release. If the Augmented SBOM is not present, the COPY command in +release-archive will fail with the following error (paraphrased for brevity):

prefix=[...] ref=HEAD
--> COPY etc/augmented-sbom.json cyclonedx.sbom.json
[no output]
ERROR Earthfile:202:4
      The command
          COPY etc/augmented-sbom.json cyclonedx.sbom.json
      failed: failed to walk [...]/etc: lstat [...]/etc: no such file or directory

The +sbom-update and the new +sbom-validate Earthly commands do not require being run inside Evergreen.

vector-of-bool

LGTM with minor tweaks. The failing tasks appear to be unrelated caused by flakiness in the docker hub gateway (sad).

vector-of-bool · 2025-02-20T20:19:22Z

Earthfile

@@ -269,7 +270,7 @@ signed-release:
    LET rel_tgz = "$rel_dir/$stem.tar.gz"
    LET rel_asc = "$rel_dir/$stem.tar.gz.asc"
    # Make the release archive:
-    COPY (+release-archive/ --branch=$sbom_branch --prefix=$stem --ref=$ref) $rel_dir/
+    COPY (+release-archive/ --prefix=$stem --ref=$ref) $rel_dir/


Can delete the ARG sbom_branch above since it is now unused.

vector-of-bool · 2025-02-20T20:20:35Z

Earthfile

-sbom-download:
+# sbom-validate:
+#   Validate the SBOM Lite for the given branch.
+sbom-validate:
    FROM artifactory.corp.mongodb.com/dockerhub/library/alpine:3.20


This FROM line can be deleted since the next line overrides it immediately. It looks like the duplicate FROM was present in the prior version. That was a mistake.

vector-of-bool · 2025-02-20T20:27:14Z

docs/dev/releasing.rst

-2. Set the Earthly secrets required for the :any:`+sign-file` and
-   :any:`+sbom-download` targets.
+2. Set the Earthly secrets required for the :any:`+sign-file` target.
+3. Download a recent augmented SBOM from Evergreen and save it to `etc/augmented-sbom.json`.


Suggested change

3. Download a recent augmented SBOM from Evergreen and save it to `etc/augmented-sbom.json`.

3. Download a recent augmented SBOM from Evergreen, created by the standalone `sbom` task in the "SBOM" variant, and save it to `etc/augmented-sbom.json`.

vector-of-bool · 2025-02-20T20:29:55Z

.evergreen/config_generator/components/misc.py

I assume that silk asset groups are no longer required with Silkbomb 2?

Correct. The --repo and --branch flags are now sufficient to associate uploaded/augmented SBOMs with a given project and branch. Asset group management is no longer necessary. 👏

vector-of-bool · 2025-02-20T20:32:14Z

.evergreen/scripts/sbom.sh

+command -v jq >/dev/null || {
+  echo "missing required program jq" 1>&2
+  exit 1
+}


Is jq actually required? It doesn't appear to be used.

It is not (used for diffs in the C++ Driver, which are not present here).

vector-of-bool · 2025-02-20T20:36:57Z

.evergreen/scripts/sbom.sh

This could be moved to an Earthfile task, but would require another step to auth podman/Docker with Artifactory. It's fine as a standalone script since it's fairly trivial.

eramongodb · 2025-02-21T16:00:31Z

Added the +sbom-generate-new-serial-number Earthly target, which may be used to generate a new unique serial number and reset the SBOM version to 1 following a release via the new SilkBomb 2.0 --generate-new-serial-number flag.

vector-of-bool · 2025-02-21T17:29:49Z

docs/dev/earthly.rst

+   Equivalent to `+sbom-generate` but uses the `--generate-new-serial-number`
+   flag to generate a new unique serial number and reset the SBOM version to 1.


I think this docs line may fail, requiring two backticks around --generate-new-serial-number. Recommend testing docs changes with make -C docs/dev serve.

Good catch and thank you for the tip. Testing doc generation caught additional obsolete references to the old +sbom-download target. Inspected the generated HTMLs and updated accordingly.

kevinAlbs · 2025-02-24T16:43:48Z

docs/dev/deps.rst

 The augmented SBOM is produced automatically and asynchronously as part of an
 external process that is not contained within the repository itself. The


Suggested change

The augmented SBOM is produced automatically and asynchronously as part of an

external process that is not contained within the repository itself. The

The augmented SBOM is produced as part of an

external process that is not contained within the repository itself. The

I expect producing the augmented SBOM is no longer asynchronous with the silkbomb augment command.

… generation

eramongodb added 5 commits February 20, 2025 13:25

Remove create-silk-asset-group and related references

61f36f2

Update Earthly sbom-generate for SilkBomb 2.0

038c6c2

Add Earthly sbom-validate

3cc9c0a

Remove Earthly sbom-download

43cd03c

Add SBOM task to EVG config

4d49baa

eramongodb requested review from kevinAlbs and vector-of-bool February 20, 2025 19:31

eramongodb self-assigned this Feb 20, 2025

eramongodb mentioned this pull request Feb 20, 2025

CDRIVER-5904 update scripts for SilkBomb 2.0 #1883

Merged

vector-of-bool approved these changes Feb 20, 2025

View reviewed changes

eramongodb added 5 commits February 20, 2025 15:30

Remove obsolete ARG --required sbom_branch

06fdcaf

Remove unnecessary FROM alpine:3.20

3ccd3e3

Reuse wording for instructions to download an augmented SBOM

6e0fe23

Remove unnecessary check for jq

91ded68

Add Earthly sbom-generate-new-serial-number

5bf1b53

eramongodb added a commit to eramongodb/mongo-c-driver that referenced this pull request Feb 21, 2025

Sync changes with mongodb#1882

98f69de

eramongodb mentioned this pull request Feb 21, 2025

MONGOCRYPT-777 update scripts and release instructions for SilkBomb 2.0 mongodb/libmongocrypt#964

Merged

vector-of-bool reviewed Feb 21, 2025

View reviewed changes

eramongodb added 2 commits February 21, 2025 11:44

Fix dev documentation syntax errors and broken references

b6e1dac

Additional backticks in releasing.rst

b51b47e

kevinAlbs approved these changes Feb 24, 2025

View reviewed changes

Remove language implying automation and asynchrony for augmented SBOM…

3caf834

… generation

eramongodb merged commit 53f9fec into mongodb:master Feb 24, 2025
1 check was pending

eramongodb deleted the cdriver-5904 branch February 24, 2025 17:20

eramongodb mentioned this pull request Feb 24, 2025

Generate a new SBOM serial number for 1.30.2 #1885

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CDRIVER-5904 update scripts and release instructions for SilkBomb 2.0 #1882

CDRIVER-5904 update scripts and release instructions for SilkBomb 2.0 #1882

Uh oh!

eramongodb commented Feb 20, 2025 •

edited

Loading

Uh oh!

vector-of-bool left a comment

Uh oh!

vector-of-bool Feb 20, 2025

Uh oh!

vector-of-bool Feb 20, 2025 •

edited

Loading

Uh oh!

vector-of-bool Feb 20, 2025

Uh oh!

vector-of-bool Feb 20, 2025

Uh oh!

eramongodb Feb 20, 2025 •

edited

Loading

Uh oh!

vector-of-bool Feb 20, 2025

Uh oh!

eramongodb Feb 20, 2025

Uh oh!

vector-of-bool Feb 20, 2025

Uh oh!

eramongodb commented Feb 21, 2025

Uh oh!

vector-of-bool Feb 21, 2025

Uh oh!

eramongodb Feb 21, 2025

Uh oh!

kevinAlbs Feb 24, 2025

Uh oh!

Uh oh!

Uh oh!

	3. Download a recent augmented SBOM from Evergreen and save it to `etc/augmented-sbom.json`.
	3. Download a recent augmented SBOM from Evergreen, created by the standalone `sbom` task in the "SBOM" variant, and save it to `etc/augmented-sbom.json`.

		Equivalent to `+sbom-generate` but uses the `--generate-new-serial-number`
		flag to generate a new unique serial number and reset the SBOM version to 1.

		The augmented SBOM is produced automatically and asynchronously as part of an
		external process that is not contained within the repository itself. The

CDRIVER-5904 update scripts and release instructions for SilkBomb 2.0 #1882

CDRIVER-5904 update scripts and release instructions for SilkBomb 2.0 #1882

Uh oh!

Conversation

eramongodb commented Feb 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vector-of-bool left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vector-of-bool Feb 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eramongodb Feb 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eramongodb commented Feb 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

eramongodb commented Feb 20, 2025 •

edited

Loading

vector-of-bool Feb 20, 2025 •

edited

Loading

eramongodb Feb 20, 2025 •

edited

Loading