docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

build: move sbom example to bottom of page 

The example is quite long, so it's easy to miss the additional content
about the SBOM scanner that's below it.

Signed-off-by: Justin Chadwell <me@jedevc.com>
This commit is contained in:
Justin Chadwell 2023-01-17 14:01:14 +00:00
parent 4757ffb27b
commit 43ac85d48e
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
build/attestations/sbom.md
View File

@ -204,6 +204,22 @@ base-passwd@3.5.47
``` ```
{% endraw %} {% endraw %}
## SBOM generator
BuildKit generates the SBOM using a scanner plugin. By default, it uses is the
[BuildKit Syft scanner](https://github.com/docker/buildkit-syft-scanner){: target="blank" rel="noopener" }
plugin. This plugin is built on top of
[Anchore's Syft](https://github.com/anchore/syft){: target="blank" rel="noopener" },
an open source tool for generating an SBOM.
You can select a different plugin to use with the `generator` option, specifying
an image that implements the
[BuildKit SBOM scanner protocol](https://github.com/moby/buildkit/blob/master/docs/sbom-protocol.md){ :target="blank" rel="noopener" }.
```console
$ docker buildx build --attest type=sbom,generator=<image> .
```
## SBOM attestation example ## SBOM attestation example
The following JSON example shows what an SBOM attestation might look like. The following JSON example shows what an SBOM attestation might look like.
@ -308,19 +324,3 @@ The following JSON example shows what an SBOM attestation might look like.
} }
} }
``` ```
## SBOM generator
BuildKit generates the SBOM using a scanner plugin. By default, it uses is the
[BuildKit Syft scanner](https://github.com/docker/buildkit-syft-scanner){: target="blank" rel="noopener" }
plugin. This plugin is built on top of
[Anchore's Syft](https://github.com/anchore/syft){: target="blank" rel="noopener" },
an open source tool for generating an SBOM.
You can select a different plugin to use with the `generator` option, specifying
an image that implements the
[BuildKit SBOM scanner protocol](https://github.com/moby/buildkit/blob/master/docs/sbom-protocol.md){ :target="blank" rel="noopener" }.
```console
$ docker buildx build --attest type=sbom,generator=<image> .
```