4.4 Build and SBOM

A trusted software supply chain needs the artifact and an inventory of what went into it. BuildConfig emits ImageStream spring-boot-lw-poc. The pipeline writes CycloneDX. That SBOM includes the Lightwell Network GAV you pinned. The known-bad Dockerfile still failing is the proof that hermetic is required: a public FROM cannot build once 4.1 through 4.3 are in place.

After 4.3, an HTTPS Route from lw-poc-build hangs. The PipelineRun therefore uses the in-cluster Gitea URL and the in-cluster Trusted Artifact Signer URLs. 5.1 Sign reads .tekton/pipelinerun.yaml from Gitea, so you commit the filled file before oc create. A run created only from a local file leaves the placeholders on origin, and 5.1 fails even when this run succeeds.

Lightwell Clearinghouse Premier does not change the builder. A member GAV shows up in the same SBOM that Track 7 ingests.

In a customer engagement, CI produces a signed image and an SBOM. This page proves the image landed and the SBOM exists. Admission and GitOps promotion are later tracks.

By the end of this module, you will be able to:

The control a customer calls "the Konflux build" is often a Buildah task. Here the pipeline runs oc start-build --from-dir against a Binary BuildConfig. Adding a Buildah task fails the Check. The term map is Appendix: Konflux mapping.

The block below is that Buildah task, pointed at an image this cluster does not build. A paste of it fails the Check.

Apply the Pipeline you wired on 4.2, in the build namespace. REPO_URL is student_repo_internal_url, the in-cluster Gitea Service. Success is the Pipeline object present in that namespace, and the internal URL printed beside it.

Edit .tekton/pipelinerun.yaml. Replace STUDENT_REPO_URL_PLACEHOLDER with student_repo_internal_url (http://gitea.gitea.svc:3000/…). The HTTPS Route is blocked after 4.3. Replace <lab-namespace> with lw-poc-build. Fill Fulcio, Rekor, and TUF from ConfigMap demo-userinfo-rhtas in namespace trusted-artifact-signer, using fulcio_internal_url, rekor_internal_url, and tuf_internal_url. Those are in-cluster Services. The Route hints (fulcio_url_hint and its siblings) fail after 4.3. Leave the syft rhtpa-url empty. Track 7 uploads the SBOM from Showroom.

5.1 reads this file from Gitea, not from the live PipelineRun. oc create alone leaves the placeholder on origin. Commit and push before you create the run. Success is a push of .tekton/pipelinerun.yaml with the placeholders gone.

Create the PipelineRun from that file. Success is a run whose tasks openshift-build and syft-sbom-rhtpa succeed. ACS may fail or soft-skip. This Check is the image and the SBOM. ACS is Track 7. cosign verify is Track 5.

The capture is tkn pipelinerun describe for a run in lw-poc-build. Read openshift-build and syft-sbom-rhtpa as Succeeded. acs-image-check may show Failed on that capture. This page does not grade ACS. The task list is newest-first, so clone appears at the bottom.

Success is ImageStream spring-boot-lw-poc in the build namespace, a PipelineRun, and a succeeded TaskRun for syft-sbom-rhtpa. The SBOM file lands in ConfigMap lab-sbom-cyclonedx. Track 7 copies it from there.

The known-bad path is a separate build of Dockerfile.known-bad. oc start-build has no -DdockerfilePath, so you patch the BuildConfig, start a binary build, and then restore dockerfilePath to Dockerfile. The first registry-1.docker.io timeout (dial tcp …:443: i/o timeout) is the failure. Press Ctrl-C. That stops --follow only. OpenShift keeps retrying the pull for many minutes and queues later Binary builds, including the PipelineRuns on 5.2 and 7.2. Cancel the Build, then restore dockerfilePath.

Success is a build that fails on the public pull, a cancelled Build, and a BuildConfig whose dockerfilePath is Dockerfile again.

The public FROM and the curl fail because of 4.1 through 4.3. Leave the BuildConfig on Dockerfile. Leave no known-bad Build in Running.

The Job also grades ConfigMap report-11-build-sbom key image_builder. Set it to buildconfig. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

The scored Check is Job validate-11-build-sbom in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

The Validate Job grades the image and the SBOM. Track 5 still opens if you skip this page. oc tag into staging is Track 6. A Clearinghouse Premier member GAV would appear in the same CycloneDX document.