Hi,
Our security team requires defining versions for all 3rd party dependencies used by our Docker images. There is an internal tool used for scanning, and it has problems with Coretto 11 RPM distribution.
I want to have the option to download/generate a BOM file during build in GitHub Actions and attach it to the build Docker file
Question:
Where can I find or generate a full BOM (SPDX format) file for the RPM distribution?
Snippet from Dockerfile:
# Install Java Coretto 11
RUN rpm --import https://yum.corretto.aws/corretto.key
RUN curl -L -o /etc/yum.repos.d/corretto.repo https://yum.corretto.aws/corretto.repo
RUN dnf install -y java-11-amazon-corretto-devel
RUN java --version
The base image is Red Hat 9
Hi,
Our security team requires defining versions for all 3rd party dependencies used by our Docker images. There is an internal tool used for scanning, and it has problems with Coretto 11 RPM distribution.
I want to have the option to download/generate a BOM file during build in GitHub Actions and attach it to the build Docker file
Question:
Where can I find or generate a full BOM (SPDX format) file for the RPM distribution?
Snippet from Dockerfile:
The base image is Red Hat 9