local ARS

.azure-pipelines/azure-pipelines-build-alpinevs.yml

@@ -0,0 +1,50 @@
+pr: none
+trigger: none
+
+
+name: $(TeamProject)_$(Build.DefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
+
+resources:
+  repositories:
+  - repository: buildimage
+    type: github
+    name: sonic-net/sonic-buildimage
+    endpoint: sonic-net
+    ref: master
+
+
+variables:
+- template: .azure-pipelines/azure-pipelines-repd-build-variables.yml@buildimage
+- template: .azure-pipelines/template-variables.yml@buildimage
+- name: CACHE_MODE
+  value: rcache
+- name: ENABLE_FIPS
+  value: y
+- name: BUILD_BRANCH
+  ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
+    value: $(System.PullRequest.TargetBranch)
+  ${{ else }}:
+    value: $(Build.SourceBranchName)
+
+
+parameters:
+  - name: SUBMODULE
+    type: string
+    default: ' '
+
+  - name: COMMIT_ID
+    type: string
+    default: ' '
+
+
+stages:
+  - stage: BuildAlpineVS
+    pool: sonicso1ES-amd64
+    jobs:
+    - template: azure-pipelines-build.yml
+      parameters:
+        buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) ${{ variables.VERSION_CONTROL_OPTIONS }}'
+        jobGroups:
+        - name: alpinevs
+        SUBMODULE: ${{ parameters.SUBMODULE }}
+        COMMIT_ID: ${{ parameters.COMMIT_ID }}

.azure-pipelines/azure-pipelines-build.yml

@@ -58,6 +58,10 @@ jobs:
             dbg_image: yes
             asan_image: yes
 
+        - name: alpinevs
+          variables:
+            dbg_image: yes
+
         - name: barefoot
           variables:
             docker_syncd_rpc_image: yes
@@ -115,6 +119,12 @@ jobs:
           variables:
             PLATFORM_ARCH: arm64
 
+        - name: aspeed-arm64
+          pool: sonicso1ES-arm64
+          variables:
+            PLATFORM_NAME: aspeed
+            PLATFORM_ARCH: arm64
+
         - name: vpp
           variables:
             dbg_image: yes
@@ -127,6 +137,10 @@ jobs:
           if echo $(GROUP_NAME) | grep mellanox; then
             BUILD_OPTIONS="$BUILD_OPTIONS INCLUDE_DHCP_SERVER=y"
           fi
+          # ENABLE_SBOM=y emits CycloneDX SBOMs alongside each .bin /
+          # .img / .swi / .tar and standalone SBOMs for docker-ptf /
+          # docker-ptf-sai / docker-sonic-mgmt when those are built.
+          BUILD_OPTIONS="$BUILD_OPTIONS ENABLE_SBOM=y"
           if [ $(GROUP_NAME) == pensando ]; then
             make $BUILD_OPTIONS target/sonic-pensando.tar
           elif [ $(GROUP_NAME) == vs ]; then
@@ -159,6 +173,8 @@ jobs:
               mv target/sonic-vpp.img.gz target/sonic-vpp-dbg.img.gz
             fi
             make $BUILD_OPTIONS target/sonic-vpp.img.gz
+          elif [ $(GROUP_NAME) == alpinevs ]; then
+            make $BUILD_OPTIONS target/sonic-alpinevs.img.gz
           else
             if [ $(dbg_image) == yes ]; then
               make  $BUILD_OPTIONS INSTALL_DEBUG_TOOLS=y target/sonic-$(GROUP_NAME).bin

.azure-pipelines/azure-pipelines-image-template.yml

@@ -36,7 +36,7 @@ jobs:
       - script: |
           [ -n "$OVERRIDE_BUILD_OPTIONS" ] && OVERRIDE_BUILD_OPTIONS=$(OVERRIDE_BUILD_OPTIONS)
           BUILD_OPTIONS="$(BUILD_OPTIONS) $OVERRIDE_BUILD_OPTIONS"
-          if [ -n "$(CACHE_MODE)" ] && echo $(PLATFORM_AZP) | grep -E -q "^(vs|broadcom|mellanox|marvell-prestera-armhf|marvell-prestera-arm64|vpp|nvidia-bluefield)$"; then
+          if [ -n "$(CACHE_MODE)" ] && echo $(PLATFORM_AZP) | grep -E -q "^(vs|broadcom|mellanox|marvell-prestera-armhf|marvell-prestera-arm64|vpp|nvidia-bluefield|alpinevs)$"; then
             CACHE_OPTIONS="SONIC_DPKG_CACHE_METHOD=$(CACHE_MODE) SONIC_DPKG_CACHE_SOURCE=/nfs/dpkg_cache/$(PLATFORM_AZP)"
             BUILD_OPTIONS="$BUILD_OPTIONS $CACHE_OPTIONS"
           fi
@@ -78,38 +78,56 @@ jobs:
     postSteps:
       - script: |
           BUILD_REASON=$(Build.Reason)
+          PTF_MODIFIED_IN_PR="False"
           echo "Build.Reason = $BUILD_REASON"
           echo "Build.DefinitionName = $BUILD_DEFINITIONNAME"
           if [[ "$BUILD_REASON" == "PullRequest" ]]; then
-            echo "Checking for changes to dockers/docker-ptf/Dockerfile.j2 in PR..."
-            # Get the target branch and check for changes
-            TARGET_BRANCH="origin/$(System.PullRequest.TargetBranch)"
-            echo "Comparing against target branch: $TARGET_BRANCH"
-            # Fetch target branch to ensure we have the latest
-            git fetch origin $(System.PullRequest.TargetBranch)
-            # Check if docker-ptf Dockerfile.j2 has changes
+            echo "Checking for changes to docker-ptf in PR..."
+            # Set PTF_MODIFIED to True if docker-ptf was not built from cache, otherwise set it to False
             # NOTE: The PTF_MODIFIED template parameter is of type string
             # Ensure to set it to "True" or "False" (not boolean true/false)
-            if git diff --name-only $TARGET_BRANCH...HEAD | grep -q "dockers/docker-ptf/Dockerfile.j2"; then
-              echo "docker-ptf/Dockerfile.j2 has been modified in this PR"
-              echo "##vso[task.setvariable variable=PTF_MODIFIED;isOutput=true]True"
-            else
-              echo "docker-ptf/Dockerfile.j2 has not been modified in this PR"
+            if [ ! -f "target/docker-ptf.gz.log" ]; then
+              echo "docker-ptf was not built in this PR, setting PTF_MODIFIED to False"
               echo "##vso[task.setvariable variable=PTF_MODIFIED;isOutput=true]False"
+              PTF_MODIFIED_IN_PR="False"
+            else
+              if grep -q "CACHE::LOADED" target/docker-ptf.gz.log; then
+                echo "docker-ptf was built from cache in this PR, setting PTF_MODIFIED to False"
+                echo "##vso[task.setvariable variable=PTF_MODIFIED;isOutput=true]False"
+                PTF_MODIFIED_IN_PR="False"
+              else
+                echo "docker-ptf was not built from cache in this PR, setting PTF_MODIFIED to True"
+                echo "##vso[task.setvariable variable=PTF_MODIFIED;isOutput=true]True"
+                PTF_MODIFIED_IN_PR="True"
+              fi
             fi
           else
             echo "Not a PR build, setting PTF_MODIFIED to false"
             echo "##vso[task.setvariable variable=PTF_MODIFIED;isOutput=true]False"
+            PTF_MODIFIED_IN_PR="False"
           fi
 
+          echo "PTF_MODIFIED_IN_PR = $PTF_MODIFIED_IN_PR"
+          # Prepare publish settings
+          PORT=443
+          BRANCH=$(Build.SourceBranchName)
+          echo "Branch = $BRANCH"
+          PUSH_DOCKER="False"
           if [[ "$BUILD_REASON" != "PullRequest" && "$BUILD_DEFINITIONNAME" == "Azure.sonic-buildimage.official.vs" ]]
           then
-            PORT=443
-            DOCKERS=$(ls target/docker-ptf.gz)
-            BRANCH=$(Build.SourceBranchName)
-            echo "Branch = $BRANCH"
             LABELS="$BRANCH"
             [[ "$BRANCH" == "master" ]] && LABELS="$LABELS latest"
+            DOCKERS=$(ls target/docker-ptf.gz)
+            PUSH_DOCKER="True"
+          elif [[ "$PTF_MODIFIED_IN_PR" == "True" ]]
+          then
+            LABELS="ptf-$SYSTEM_PULLREQUEST_PULLREQUESTNUMBER"
+            DOCKERS=$(ls target/docker-ptf.gz)
+            PUSH_DOCKER="True"
+          else
+            echo "Not publishing docker images since docker-ptf was not modified in this PR or build definition name is not Azure.sonic-buildimage.official.vs"
+          fi
+          if [[ "$PUSH_DOCKER" == "True" ]]; then
             for f in $DOCKERS; do
               echo $f
               echo "Labels = $LABELS"

.azure-pipelines/baseline_test/baseline.test.buildimage.yml

@@ -45,6 +45,10 @@ parameters:
     type: boolean
     default: true
 
+  - name: INCLUDE_JOBS
+    type: string
+    default: "all"
+
 variables:
 - template: ../azure-pipelines-repd-build-variables.yml
 - template: ../template-variables.yml
@@ -69,19 +73,24 @@ stages:
         buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) BUILD_MULTIASIC_KVM=y INCLUDE_DHCP_SERVER=y ${{ variables.VERSION_CONTROL_OPTIONS }}'
         jobGroups:
         - name: vs
+    - template: ../azure-pipelines-build.yml
+      parameters:
+        buildOptions: 'USERNAME=admin SONIC_BUILD_JOBS=$(nproc) ${{ variables.VERSION_CONTROL_OPTIONS }}'
+        jobGroups:
+        - name: vpp
 
   - stage: Test_round_1
     dependsOn: BuildVS
     condition: and(succeeded(), and(ne(stageDependencies.BuildVS.outputs['vs.SetVar.SKIP_VSTEST'], 'YES'), in(dependencies.BuildVS.result, 'Succeeded', 'SucceededWithIssues')))
     jobs:
     - template: .azure-pipelines/pr_test_template.yml@sonic-mgmt
       parameters:
-        GLOBAL_PARAMS:
-          BUILD_REASON: ${{ parameters.BUILD_REASON }}
-          RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
-          STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
-          TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
+        BUILD_REASON: ${{ parameters.BUILD_REASON }}
+        RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
+        STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
+        TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
         CHECKOUT_SONIC_MGMT: ${{ parameters.CHECKOUT_SONIC_MGMT }}
+        INCLUDE_JOBS: ${{ parameters.INCLUDE_JOBS }}
 
   - stage: Test_round_2
     dependsOn:
@@ -90,12 +99,12 @@ stages:
     jobs:
     - template: .azure-pipelines/pr_test_template.yml@sonic-mgmt
       parameters:
-        GLOBAL_PARAMS:
-          BUILD_REASON: ${{ parameters.BUILD_REASON }}
-          RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
-          STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
-          TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
+        BUILD_REASON: ${{ parameters.BUILD_REASON }}
+        RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
+        STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
+        TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
         CHECKOUT_SONIC_MGMT: ${{ parameters.CHECKOUT_SONIC_MGMT }}
+        INCLUDE_JOBS: ${{ parameters.INCLUDE_JOBS }}
 
   - stage: Test_round_3
     dependsOn:
@@ -104,12 +113,12 @@ stages:
     jobs:
     - template: .azure-pipelines/pr_test_template.yml@sonic-mgmt
       parameters:
-        GLOBAL_PARAMS:
-          BUILD_REASON: ${{ parameters.BUILD_REASON }}
-          RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
-          STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
-          TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
+        BUILD_REASON: ${{ parameters.BUILD_REASON }}
+        RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
+        STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
+        TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
         CHECKOUT_SONIC_MGMT: ${{ parameters.CHECKOUT_SONIC_MGMT }}
+        INCLUDE_JOBS: ${{ parameters.INCLUDE_JOBS }}
 
   - stage: Test_round_4
     dependsOn:
@@ -118,9 +127,9 @@ stages:
     jobs:
     - template: .azure-pipelines/pr_test_template.yml@sonic-mgmt
       parameters:
-        GLOBAL_PARAMS:
-          BUILD_REASON: ${{ parameters.BUILD_REASON }}
-          RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
-          STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
-          TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
+        BUILD_REASON: ${{ parameters.BUILD_REASON }}
+        RETRY_TIMES: ${{ parameters.RETRY_TIMES }}
+        STOP_ON_FAILURE: ${{ parameters.TEST_PLAN_STOP_ON_FAILURE }}
+        TEST_PLAN_NUM: ${{ parameters.TEST_PLAN_NUM }}
         CHECKOUT_SONIC_MGMT: ${{ parameters.CHECKOUT_SONIC_MGMT }}
+        INCLUDE_JOBS: ${{ parameters.INCLUDE_JOBS }}

.azure-pipelines/build-template.yml

@@ -83,52 +83,120 @@ jobs:
       sudo apt-get install -y acl
       export DOCKER_DATA_ROOT_FOR_MULTIARCH=/data/march/docker
       CACHE_OPTIONS="SONIC_DPKG_CACHE_METHOD=${{ parameters.cache_mode }} SONIC_DPKG_CACHE_SOURCE=/nfs/dpkg_cache/${{ parameters.platform }}"
-      ENABLE_DOCKER_BASE_PULL=y make configure PLATFORM=${{ parameters.platform }} PLATFORM_ARCH=${{ parameters.platform_arch }}
+      # ENABLE_SBOM=y emits CycloneDX SBOMs alongside every .bin and
+      # standalone SBOMs for docker-ptf / docker-ptf-sai.
+      ENABLE_DOCKER_BASE_PULL=y ENABLE_SBOM=y make configure PLATFORM=${{ parameters.platform }} PLATFORM_ARCH=${{ parameters.platform_arch }}
       trap "sudo rm -rf fsroot" EXIT
 
       if [ ${{ parameters.platform }} == vs ]; then
         if [ ${{ parameters.dbg_image }} == true ]; then
-          make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) INSTALL_DEBUG_TOOLS=y target/sonic-vs.img.gz && \
+          make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) INSTALL_DEBUG_TOOLS=y target/sonic-vs.img.gz && \
             mv target/sonic-vs.img.gz target/sonic-vs-dbg.img.gz
         fi
 
-        make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) target/docker-sonic-vs.gz target/sonic-vs.img.gz target/docker-ptf.gz
-        make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) target/docker-ptf-sai.gz
+        make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) target/docker-sonic-vs.gz target/sonic-vs.img.gz target/docker-ptf.gz
+        make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) target/docker-ptf-sai.gz
+      elif [ ${{ parameters.platform }} == alpinevs ]; then
+        make USERNAME=admin SONIC_BUILD_JOB=2 $CACHE_OPTIONS ENABLE_SBOM=y target/sonic-alpinevs.img.gz
       else
         if [ ${{ parameters.dbg_image }} == true ]; then
-          make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) INSTALL_DEBUG_TOOLS=y target/sonic-${{ parameters.platform }}.bin && \
+          make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) INSTALL_DEBUG_TOOLS=y target/sonic-${{ parameters.platform }}.bin && \
             mv target/sonic-${{ parameters.platform }}.bin target/sonic-${{ parameters.platform }}-dbg.bin
         fi
         if [ ${{ parameters.swi_image }} == true ]; then
-          make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) ENABLE_IMAGE_SIGNATURE=y target/sonic-aboot-${{ parameters.platform }}.swi
+          make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) ENABLE_IMAGE_SIGNATURE=y target/sonic-aboot-${{ parameters.platform }}.swi
         fi
         if [ ${{ parameters.sync_rpc_image }} == true ]; then
-          make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) ENABLE_SYNCD_RPC=y target/docker-syncd-${{ parameters.platform_short }}-rpc.gz
+          make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) ENABLE_SYNCD_RPC=y target/docker-syncd-${{ parameters.platform_short }}-rpc.gz
           # workaround for issue in rules/sairedis.dep,  git ls-files will list un-exist files for cache
           pushd ./src/sonic-sairedis/SAI
           git stash
           popd 
           if [ ${{ parameters.platform }} == broadcom ]; then
-            make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) ENABLE_SYNCD_RPC=y SAITHRIFT_V2=y target/docker-saiserverv2-brcm.gz
+            make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) ENABLE_SYNCD_RPC=y SAITHRIFT_V2=y target/docker-saiserverv2-brcm.gz
             pushd ./src/sonic-sairedis/SAI
             git stash
             popd 
           fi
           if [ ${{ parameters.platform }} == barefoot ]; then
-            make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) SAITHRIFT_V2=y  ENABLE_SYNCD_RPC=y  target/docker-saiserverv2-bfn.gz
+            make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) SAITHRIFT_V2=y  ENABLE_SYNCD_RPC=y  target/docker-saiserverv2-bfn.gz
             pushd ./src/sonic-sairedis/SAI
             git stash
             popd 
           fi
         fi
 
-        make USERNAME=admin $CACHE_OPTIONS SONIC_BUILD_JOBS=$(nproc) target/sonic-${{ parameters.platform }}.bin
+        make USERNAME=admin $CACHE_OPTIONS ENABLE_SBOM=y SONIC_BUILD_JOBS=$(nproc) target/sonic-${{ parameters.platform }}.bin
       fi
     displayName: 'Build sonic image'
+  - script: |
+      set +e
+      # Run an SBOM-based vulnerability scan against each SBOM the
+      # build produced in this pipeline: the platform .bin/.img/.swi
+      # plus the docker-ptf / docker-ptf-sai test containers when
+      # the VS group built them. docker-sonic-mgmt is scanned in
+      # its own pipeline (docker-sonic-mgmt.yml) and is not built
+      # here. VEX statements under vex/ suppress CVEs that SONiC
+      # patches fix. Mirrors the legacy trivy policy: MEDIUM+
+      # severity, fixed-only, fail on remaining unsuppressed
+      # findings.
+      OVERALL_RC=0
+      mkdir -p $(Build.ArtifactStagingDirectory)/sbom-vuln
+      shopt -s nullglob
+      # Aggregate SBOMs the build emitted. SONiC produces several
+      # installer formats — .bin (ONIE), .swi (Arista aboot),
+      # .img.gz (VS/VPP) — plus standalone test-container SBOMs
+      # (note the .sbom. infix on the latter, which distinguishes
+      # them from per-container recipe fragments at
+      # target/docker-*.gz.cdx.json).
+      for sbom in \
+          target/sonic-*.bin.cdx.json \
+          target/sonic-*.swi.cdx.json \
+          target/sonic-*.img.gz.cdx.json \
+          target/docker-*.gz.sbom.cdx.json
+      do
+        # Derive a short name for this scan's outputs. Test-container
+        # SBOMs include a `.sbom` infix on disk (e.g. docker-ptf.gz.sbom.cdx.json)
+        # to distinguish them from per-container recipe fragments
+        # (docker-ptf.gz.cdx.json); strip it so the per-artifact
+        # output names match the underlying artifact extension:
+        #   sonic-broadcom.bin.cdx.json     -> sonic-broadcom.bin{.txt,.cdx.json}
+        #   docker-ptf.gz.sbom.cdx.json     -> docker-ptf.gz{.txt,.cdx.json}
+        name=$(basename "$sbom" .cdx.json)
+        name="${name%.sbom}"
+        # Azure Pipelines log-folding directive — wrap each SBOM's
+        # output so the log view shows a collapsible section per
+        # scan rather than one giant concatenated stream.
+        echo "##[group]SBOM vuln scan: $name"
+        python3 scripts/sbom_vuln_scan.py \
+          --vex vex \
+          --min-severity medium \
+          --fail-on medium \
+          --format both \
+          --output "$(Build.ArtifactStagingDirectory)/sbom-vuln/${name}.cdx.json" \
+          "$sbom" | tee "$(Build.ArtifactStagingDirectory)/sbom-vuln/${name}.txt"
+        RC=${PIPESTATUS[0]}
+        if [ "$RC" != "0" ]; then OVERALL_RC=$RC; fi
+        echo "##[endgroup]"
+      done
+      exit $OVERALL_RC
+    # Disabled for now; change to `succeededOrFailed()` to re-enable
+    # the SBOM-based vulnerability scan step. SBOM emission itself is
+    # unaffected — the .cdx.json sidecars are still produced by the
+    # `Build sonic image` step above. Only the post-build scan is
+    # gated.
+    condition: false
+    continueOnError: true
+    displayName: 'SBOM vulnerability scan'
   - template: cleanup.yml
   - publish: $(System.DefaultWorkingDirectory)/
     artifact: sonic-buildimage.${{ parameters.platform }}
     displayName: "Archive sonic image"
+  - publish: $(Build.ArtifactStagingDirectory)/sbom-vuln
+    artifact: sbom-vuln-scan-results.${{ parameters.platform }}
+    displayName: "Archive SBOM vuln-scan results"
+    condition: always()
+    continueOnError: true
   - script: |
       set -x
       find target -name "*.log" | xargs -I{} cp {} $(Build.ArtifactStagingDirectory)/