rbom 0.1.1

Release Bill of Materials (RBOM)

RBOM

Release Bill Of Materials

UNDER DEVELOPMENT 🚧

Setup

Create a rbom.yaml in the root repository directory, you can have multiple: - dev: dev.rbom.yaml - staging: staging.rbom.yaml - production: prod.rbom.yaml

Overview

Policy support

Custom Policy

Here for example a policy can be defined programatically, by checking if the actor who ran the workflow is an admin:

rbom set --policy custom:actor-is-admin --passed=${{ github.actor.is_admin }}

Pre-Defined Policies

In the context of GitHub actions for example, a policy id can be that of a check suite such as tests.

The policy id gha-check: Run Tests must be the same as the job name. We specify gha-check: to know to look at GitHub's check suite and then use Run Tests to determine if that specific job passed or failed.

This is auto-matically handled by rbom and the pre-defined policy. You could also add a new policy on the fly by using:

rbom new --policy id="gha-check: Run Tests"

Installation

pip install rbom

Signing

Generate RSA Key Pair

openssl genrsa -out private_rbom_key.pem 2048
openssl rsa -in private_rbom_key.pem -pubout -out public_rbom_key.pem

---

Haiku

"Scripts fire in the night,
What shipped, who signed, what passed checks?
RBOM leaves no doubt"