4.4 Build and SBOM

Overview

OpenShift BuildConfig produces the app image in lw-poc-build. The pipeline writes a CycloneDX SBOM. The known-bad Dockerfile still fails. This is not oc tag (Track 6). This is not keyless verify (Track 5).

Image build is not Buildah. Showroom syft may be missing (syft_baked=false).

Why it matters

You need a produced artifact plus an inventory of what went into it, including the Lightwell GAV you pinned. The known-bad Dockerfile still failing proves hermetic is not optional.

After 4.3, HTTPS Routes hang. PipelineRun placeholders must use in-cluster Gitea and RHTAS internal URLs. Check 12 later reads the file from Gitea, so you commit before oc create.

Clearinghouse Premier does not change the builder. Member GAVs appear in the same SBOM format Track 7 will ingest.

What does it solve

  • Production images with no SBOM

  • A Buildah-only mental model on this cluster

  • Using HTTPS Routes after 4.3

BuildConfig vs Buildah

Konflux “build” on hosted Konflux is often Buildah. This cluster maps that control to Binary BuildConfig started from Tekton (oc start-build --from-dir). Do not add a Buildah task. The term map is in Konflux mapping.

Worked example (not the Check)

A Buildah task that never creates ImageStream spring-boot-lw-poc. Paste-identical copy fails.

# Worked example ONLY — Konflux Buildah path. This claim scores BuildConfig + syft.
- name: buildah
  taskRef:
    name: buildah
  params:
    - name: IMAGE
      value: example.invalid/not-your-app:latest

Your change: successful pipeline in the build namespace

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
REPO_URL="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_repo_internal_url}')"
echo "BUILD_NS=${BUILD_NS}"
echo "REPO_URL=${REPO_URL}"
oc -n "${BUILD_NS}" apply -f /tmp/spring-boot-lw-poc/.tekton/rbac.yaml
oc -n "${BUILD_NS}" apply -f /tmp/spring-boot-lw-poc/.tekton/pipeline.yaml

Edit .tekton/pipelinerun.yaml: replace STUDENT_REPO_URL_PLACEHOLDER with student_repo_internal_url (http://gitea.gitea.svc:3000/… — the HTTPS Route is blocked after 4.3), replace <lab-namespace> with lw-poc-build, and fill Fulcio/Rekor/TUF from demo-userinfo-rhtas fulcio_internal_url / rekor_internal_url / tuf_internal_url (in-cluster Services). Route hints (fulcio_url_hint) fail after 4.3. Leave syft rhtpa-url empty — Track 7 uploads from Showroom.

Check 12 (5.1) reads this file from Gitea, not the live PipelineRun. oc create alone leaves the placeholder on origin. Commit and push before you create the run:

cd /tmp/spring-boot-lw-poc
git add .tekton/pipelinerun.yaml
git status
git diff --cached
git commit -m "Fill PipelineRun in-cluster repo, namespace, and RHTAS URLs"
git push origin HEAD

Then create the PipelineRun from the filled file:

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
oc -n "${BUILD_NS}" create -f /tmp/spring-boot-lw-poc/.tekton/pipelinerun.yaml
oc -n "${BUILD_NS}" get pipelinerun -w

Wait until openshift-build and syft-sbom-rhtpa succeed. ACS may fail or soft-skip; this Check is image + SBOM, not ACS (Track 7) and not cosign verify (Track 5).

PipelineRun graph with BuildConfig and SBOM tasks succeeding

Check: image + SBOM; known-bad still fails

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
oc -n "${BUILD_NS}" get imagestream spring-boot-lw-poc
oc -n "${BUILD_NS}" get pipelinerun
# SBOM workspace / Task result — name may vary; confirm the syft task Succeeded
oc -n "${BUILD_NS}" get tr -l tekton.dev/pipelineTask=syft-sbom-rhtpa

Known-bad: patch the BuildConfig Dockerfile, start a binary build, then restore the good path. oc start-build has no -DdockerfilePath. The first registry-1.docker.io / dial tcp …:443: i/o timeout is the fail — press Ctrl-C. That only stops --follow; OpenShift keeps retrying the pull for many minutes and queues later Binary builds (5.2 / 7.2 PipelineRuns). Cancel the Build, then restore dockerfilePath.

BUILD_NS="$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_build_namespace}')"
cd /tmp/spring-boot-lw-poc
oc -n "${BUILD_NS}" patch bc spring-boot-lw-poc --type=json \
  -p '[{"op":"replace","path":"/spec/strategy/dockerStrategy/dockerfilePath","value":"Dockerfile.known-bad"}]'
# Ctrl-C after the first registry-1.docker.io timeout — do not wait out retries.
oc -n "${BUILD_NS}" start-build spring-boot-lw-poc --from-dir=. --follow || true
# Ctrl-C does not cancel the Build. Cancel it so later oc start-build / PipelineRuns are not queued.
oc -n "${BUILD_NS}" cancel-build bc/spring-boot-lw-poc
oc -n "${BUILD_NS}" patch bc spring-boot-lw-poc --type=json \
  -p '[{"op":"replace","path":"/spec/strategy/dockerStrategy/dockerfilePath","value":"Dockerfile"}]'

It must fail (public FROM / curl after 4.1–4.3). Do not leave the BuildConfig pointed at the known-bad file, and do not leave a Running known-bad Build.

Fill the report

The Job also grades ConfigMap report-11-build-sbom key image_builder. Set it to buildconfig. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-11-build-sbom

The scored Check is Job validate-11-build-sbom in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-11-build-sbom --ignore-not-found
TPL='job-11.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-11-build-sbom

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: Track 5 still opens.

Callout: SPDX

Wheels typically ship SPDX; this Check produces CycloneDX from the Maven / syft path. TPA still treats either format as the system of record in Track 7.

Official documentation

Key takeaways

  • TSSC build on this cluster is BuildConfig plus Tekton, with an SBOM that must include the Lightwell pin.

  • oc tag into staging is Track 6, not this Check.

  • Clearinghouse Premier member GAVs would appear in the same CycloneDX document.

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-11