Generate modern sbom formats when releasing etcd

[idunbarh]

What would you like to be added?

I'd like to contribute SBOM generation to the release process of this project in both cyclonedx and spdx formats.

I'm part of https://github.com/CISA-SBOM-Community/SBOM-Generation thats building reference implementations for "good" SBOM generation and we thought etcd would be a great candidate.

Why is this needed?

SBOMs are becoming a common part of software releases because they provide insight into what dependencies are used in a project. This allows better vulnerability management.

[jmhbnz]

Hi @idunbarh many thanks for raising this and volunteering. For background we last touched the SBOM process for etcd in #15747 and the process essentially relies on a very antiquated approach to generate the json file https://github.com/etcd-io/etcd/blob/main/bill-of-materials.json.

Adopting new cyclonedx and spdx format support is definitely something I would support. We would need to still retain the old json format sbom process in the stable release branches until the next minor release at least in order to not break any existing processes but I am very keen to forge ahead implementing this in main initially.

cc @ivanvc, @ahrtr, @serathius for any further thoughts on this.

/assign @idunbarh

[jmhbnz]

/retitle Generate modern sbom formats when releasing etcd

[ivanvc]

I think this is a great idea. I spoke with @puerco (sig release) regarding this at KubeCon.

[ahrtr]

Thanks for raising this discussion. The json format of SPDX seems a better choice to me. The only minor concern is that SBOM-Generation is implemented with Python. It means that we have to get python installed in contributors' dev environment to update SBOM.

Alternatives:

• https://github.com/anchore/syft
• generate a tool based on https://github.com/spdx/tools-golang

[idunbarh]

I think this is a great idea. I spoke with @puerco (sig release) regarding this at KubeCon.

@puerco is an awesome reference (and an awesome person too :-D ). We talk regularly around SBOM items. I'll tag him an any PRs.

[idunbarh]

@ahrtr I'll create both SPDX and CycloneDX since its best to let users choose what works best for them. Its simple to do both.

The SBOM-Generation has several different reference implementations that include kubectl with trivy. I'll use syft for this implementation.

[ahrtr]

I'll use syft for this implementation.

Do you mean https://github.com/anchore/syft? If yes, then looks good to me.

[jmhbnz]

Discussed during sig-etcd triage meeting. Checking in, @idunbarh are you still keen to work on this?