You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by sb...@apache.org on 2026/09/16 13:26:24 UTC
(tooling-trusted-releases) 01/01: Update tools in the Alpine container
This is an automated email from the ASF dual-hosted git repository.
sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
commit fa60105cbb137716f909b466b2de5f8b172b7ddd
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Wed Sep 16 14:25:56 2026 +0100
Update tools in the Alpine container
---
Dockerfile.alpine | 21 +++++++++------------
atr/docs/dependency-updates.md | 8 ++++----
atr/sbom/sbomqs.py | 2 +-
atr/tasks/sbom.py | 2 +-
scripts/ci/check_dockerfile_tool_versions.py | 1 -
5 files changed, 15 insertions(+), 19 deletions(-)
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 1a1943be..04b4a470 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -65,10 +65,10 @@ RUN set -eux; \
rm -rf /tmp/apache-rat
# WORKDIR /var/run
-ENV SYFT_VERSION=1.46.0
-ENV SYFT_INSTALL_SHA256=8a277b4b4dc21809ecd9a0e4926f4d7319affc6451a607fdeb3e5e1fbd9bc573
-ENV SYFT_SHA256_amd64=574df1a0862ff88ad933be214e81069e35b17618a13e019f8f1c84fe063222a2
-ENV SYFT_SHA256_arm64=9640d29da74a63de41d2cc2373ac2092462165ee99709f7d8dc3dea57a748b06
+ENV SYFT_VERSION=1.51.1
+ENV SYFT_INSTALL_SHA256=ea054f8b6754db17d34129482ecda1ab733cadab57c1c9202bbe98eb5fe18d24
+ENV SYFT_SHA256_amd64=abca2def61de9952fa06d3977bb1e064818facb9badfce502b450d3d6846a91f
+ENV SYFT_SHA256_arm64=617cef943234e0cae184b4901414ca4059ad6c6923a9c9decb46f49f6a2c6573
# RUN GOPATH=/usr/local go install github.com/anchore/syft/cmd/syft@v${SYFT_VERSION}
# Faster than a go-install; the resulting binary is pinned by SHA after install
RUN case "$TARGETARCH" in \
@@ -81,16 +81,14 @@ RUN case "$TARGETARCH" in \
sh /tmp/syft-install.sh -b /usr/local/bin "v${SYFT_VERSION}" && \
echo "${SYFT_SHA256} /usr/local/bin/syft" | sha256sum -c - && \
rm -f /tmp/syft-install.sh
-ENV PARLAY_VERSION=0.9.0
-RUN GOPATH=/usr/local go install github.com/snyk/parlay@v${PARLAY_VERSION}
-ENV SBOMQS_VERSION=1.1.0
-RUN GOPATH=/usr/local go install github.com/interlynk-io/sbomqs@v${SBOMQS_VERSION}
+ENV SBOMQS_VERSION=2.1.2
+RUN GOPATH=/usr/local GOTOOLCHAIN=auto go install github.com/interlynk-io/sbomqs/v2@v${SBOMQS_VERSION}
-ENV CDXCLI_VERSION=0.32.0
+ENV CDXCLI_VERSION=0.33.1
ENV CDXCLI_ASSET_amd64=cyclonedx-linux-musl-x64
ENV CDXCLI_ASSET_arm64=cyclonedx-linux-arm64
-ENV CDXCLI_SHA256_amd64=29138e6068e6cf2dc60e776d078c2b17cbf45750c485aa12c28e1fef5556a15f
-ENV CDXCLI_SHA256_arm64=abf0b7c5648a5b127791d691cad41f004aceea27c75bb42c9572fdc9694770cf
+ENV CDXCLI_SHA256_amd64=0095dcfeec6ea1a3f6598d8e0257d52903341d0df21a325fb1510aee7c6b30dd
+ENV CDXCLI_SHA256_arm64=b2e9fdf9665ef49868a2ec012171c6e785dcd69745bc5869e53e4f4bfb096a5f
RUN case "$TARGETARCH" in \
amd64|"") CDXCLI_ASSET="$CDXCLI_ASSET_amd64"; CDXCLI_SHA256="$CDXCLI_SHA256_amd64" ;; \
arm64) CDXCLI_ASSET="$CDXCLI_ASSET_arm64"; CDXCLI_SHA256="$CDXCLI_SHA256_arm64" ;; \
@@ -141,7 +139,6 @@ RUN addgroup -g 1000 atr && \
chown atr:atr /opt/atr/state
COPY --from=depbuilder /usr/local/bin/syft /usr/local/bin/syft
-COPY --from=depbuilder /usr/local/bin/parlay /usr/local/bin/parlay
COPY --from=depbuilder /usr/local/bin/sbomqs /usr/local/bin/sbomqs
COPY --from=depbuilder /usr/local/bin/cyclonedx /usr/local/bin/cyclonedx
COPY --from=depbuilder /opt/tools /opt/tools
diff --git a/atr/docs/dependency-updates.md b/atr/docs/dependency-updates.md
index 93d03c1f..cd5d3c45 100644
--- a/atr/docs/dependency-updates.md
+++ b/atr/docs/dependency-updates.md
@@ -89,17 +89,17 @@ time, each pinned to a specific version in
* **Apache RAT** (`0.18`) - downloaded from the ASF distribution mirrors and
checked against the published `.sha512` checksum.
-* **syft** (`1.46.0`) - installed through the pinned upstream `install.sh`, which
+* **syft** (`1.51.1`) - installed through the pinned upstream `install.sh`, which
is itself verified against a recorded sha256; the resulting binary is then
verified against a per-architecture sha256.
-* **cyclonedx-cli** (`0.32.0`) - downloaded as a per-architecture release asset
+* **cyclonedx-cli** (`0.33.1`) - downloaded as a per-architecture release asset
and verified against a per-architecture sha256.
-* **parlay** (`0.9.0`) and **sbomqs** (`1.1.0`) - built with `go install` at a
+* **sbomqs** (`2.1.2`) - built with `go install` at a
pinned version, which resolves and verifies each module against the Go checksum
database.
Updating a tool means editing its version and its checksum in the Dockerfile and rebuilding the image.
-There is no automated freshness check for these tools.
+The weekly tool freshness workflow reports newer releases of these tools.
## Implementation references
diff --git a/atr/sbom/sbomqs.py b/atr/sbom/sbomqs.py
index addc6936..c4a1ce15 100644
--- a/atr/sbom/sbomqs.py
+++ b/atr/sbom/sbomqs.py
@@ -28,7 +28,7 @@ from . import models
def total_score(value: pathlib.Path | str | dict[str, Any]) -> float:
- args = ["sbomqs", "compliance", "--ntia", "--json", "--"]
+ args = ["sbomqs", "compliance", "--ntia-2021", "--json", "--"]
with tempfile.NamedTemporaryFile("w", encoding="utf-8", suffix=".json") as tf:
match value:
case dict():
diff --git a/atr/tasks/sbom.py b/atr/tasks/sbom.py
index f426e426..b5ed27ee 100644
--- a/atr/tasks/sbom.py
+++ b/atr/tasks/sbom.py
@@ -332,7 +332,7 @@ async def score_qs(args: args.FileArgs) -> results.Results | None:
raise SBOMScoringError("SBOM file does not exist", {"file_path": path_str})
proc = await asyncio.create_subprocess_exec(
*sandbox.command(
- ["sbomqs", "score", "--json", "--", full_path.name],
+ ["sbomqs", "score", "--legacy", "--json", "--", full_path.name],
ro_paths=[str(full_path.parent)],
),
cwd=str(full_path.parent),
diff --git a/scripts/ci/check_dockerfile_tool_versions.py b/scripts/ci/check_dockerfile_tool_versions.py
index 0769b7d0..241463ec 100755
--- a/scripts/ci/check_dockerfile_tool_versions.py
+++ b/scripts/ci/check_dockerfile_tool_versions.py
@@ -44,7 +44,6 @@ _GITHUB_API: Final = "https://api.github.com"
# Dockerfile ENV that pins them, with the binary name each produces.
_GITHUB_TOOLS: Final[dict[str, tuple[str, str]]] = {
"SYFT_VERSION": ("anchore/syft", "syft"),
- "PARLAY_VERSION": ("snyk/parlay", "parlay"),
"SBOMQS_VERSION": ("interlynk-io/sbomqs", "sbomqs"),
"CDXCLI_VERSION": ("CycloneDX/cyclonedx-cli", "cyclonedx-cli"),
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org