fix(sbom): make sc sbom generate fail loudly on syft errors#285
Closed
Cre-eD wants to merge 2 commits into
Closed
Conversation
The standalone CLI built a SecurityConfig with SBOM.Required=false, which told the executor to fail-open: on syft errors it printed "Warning: SBOM generation failed, continuing" and returned (nil, nil). The CLI wrapper then turned that nil-nil into "Error: no SBOM generated" and exited 1 — fail-open semantics with a fail-closed exit code. For a user-invoked `sc sbom generate`, the right behavior is fail-loud: surface the real syft error (signal: killed for OOM, registry timeouts, etc.) so the caller knows why. Setting Required=true makes the executor return the underlying error directly, which the wrapper already maps to "failed to generate SBOM: <reason>". Surfaced by a PAY-SPACE pay_space_wallet production deploy where syft was OOM-killed on a large image; Pulumi saw "no SBOM generated" exit 1 and aborted the stack update. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Semgrep Scan ResultsRepository:
Scanned at 2026-05-22 08:31 UTC |
Security Scan ResultsRepository:
Scanned at 2026-05-22 08:31 UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sc sbom generatebuilt aSecurityConfigwithSBOM.Required=false, telling the executor to fail-open on syft errors. The executor returned(nil, nil)after printingWarning: SBOM generation failed, continuing, but the CLI wrapper turned that intoError: no SBOM generatedandexit 1— fail-open semantics with a fail-closed exit code.sc sbom generate, the right behavior is fail-loud. SettingSBOM.Required=truelets the executor propagate the underlying syft error (signal: killedfor OOM, registry timeouts, etc.), which the wrapper already maps tofailed to generate SBOM: <reason>.Why this matters
Surfaced by a PAY-SPACE
pay_space_walletproduction deploy where syft was OOM-killed on a large image:Pulumi (running
sc sbom generateas a step) sawexit 1, aborted the stack update, and the production deploy hard-failed. The misleadingsignal: killed (stderr: )was the real diagnostic — this PR makes sure it reaches the user instead of being shadowed by the bogus wrapper error.Test plan
go build ./pkg/cmd/cmd_sbom/... ./pkg/security/...— cleansc sbom generateagainst a known-large image and confirm the real syft stderr (or OOM signal) is surfaced verbatim instead ofno SBOM generated