Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package post-build-checks-containers for
openSUSE:Factory checked in at 2026-07-23 23:16:04
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/post-build-checks-containers (Old)
and /work/SRC/openSUSE:Factory/.post-build-checks-containers.new.2004
(New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "post-build-checks-containers"
Thu Jul 23 23:16:04 2026 rev:6 rq:1367490 version:0.1
Changes:
--------
---
/work/SRC/openSUSE:Factory/post-build-checks-containers/post-build-checks-containers.changes
2026-07-21 23:01:04.043088658 +0200
+++
/work/SRC/openSUSE:Factory/.post-build-checks-containers.new.2004/post-build-checks-containers.changes
2026-07-23 23:18:53.162325589 +0200
@@ -1,0 +2,5 @@
+Thu Jul 23 13:08:23 UTC 2026 - Marcus Meissner <[email protected]>
+
+- add a VEX injector
+
+-------------------------------------------------------------------
New:
----
80-inject-vex
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ post-build-checks-containers.spec ++++++
--- /var/tmp/diff_new_pack.jdVOQP/_old 2026-07-23 23:18:55.002390050 +0200
+++ /var/tmp/diff_new_pack.jdVOQP/_new 2026-07-23 23:18:55.006390190 +0200
@@ -26,6 +26,7 @@
Source0: 80-antivirus-scan-clamav
Source1: 80-vulnerability-scan-trivy
Source2: 80-vulnerability-scan-neuvector
+Source3: 80-inject-vex
# the scanner-databases and neuvector-scanner are only on SLES.
%if ! 0%{?is_opensuse}
@@ -65,14 +66,20 @@
%build
%install
-%if 0%{?is_opensuse}
mkdir -p %{buildroot}%{_prefix}/lib/build/post-build-checks
-ln -s /bin/true %{buildroot}%{_prefix}/lib/build/post-build-checks/brp-99-true
-%else
-# sles
+# vex injector works without database artefacts
+install -D -m 0755 -t %{buildroot}%{_prefix}/lib/build/post-build-checks
%{SOURCE3}
+
+%if 0%{?is_opensuse}
+
+echo "no database artefacts possible"
+
+%else
+# sles ... they need to use stored artefacts, so not on openSUSE
install -D -m 0755 -t %{buildroot}%{_prefix}/lib/build/post-build-checks
%{SOURCE0}
+
%ifnarch s390x
# currently have a bit of endianess issue with the trivy db
install -D -m 0755 -t %{buildroot}%{_prefix}/lib/build/post-build-checks
%{SOURCE1}
++++++ 80-inject-vex ++++++
#!/bin/bash
#
# Perform vulnerability scan of a container image built by OBS using ClamAV.
# Strict mode
set -euo pipefail
TOPDIR="/usr/src/packages"
# Helper functions
log() {
echo "$@" >&2
}
log "Retrieving container image metadata"
CONTAINERINFO="$(find "$TOPDIR" -name '*.containerinfo' -print -quit)"
OUTPUTDIR="$(dirname $CONTAINERINFO)"
CONTAINER_NAME="$(basename "$CONTAINERINFO" | sed 's/\.containerinfo$//')"
CONTAINER_TAG="$(python3 -c \
'import json, sys; print(json.load(sys.stdin)["tags"][0])' \
<"$CONTAINERINFO")"
log "Container image tag to check: $CONTAINER_TAG"
CONTAINER_UNPACKED_DIR=$(mktemp -d)
fn=`find $TOPDIR -name "*vex.json" | head -n 1`
if [ "x$fn" == "x" ]; then
log "No VEX file found"
exit 0
fi
# NOTE: The subject will be filled by OBS during publishing
SCAN_TIMESTAMP="$(date '+%Y-%m-%dT%H:%M:%S.%N%:z')"
jq --rawfile result "$fn" '.predicate.data = $result' \
>"$OUTPUTDIR/$CONTAINER_NAME.vex_openvex.intoto.json" <<EOF
{
"_type": "https://in-toto.io/Statement/v0.1";,
"predicateType": "https://cosign.sigstore.dev/attestation/v1";,
"subject": [
{
"name": "",
"digest": {
"sha256": ""
}
}
],
"predicate": {
"data": "",
"timestamp": "$SCAN_TIMESTAMP"
}
}
EOF
