Add BOM to build metadata label

cmd/builder/main.go

@@ -5,12 +5,12 @@ import (
 	"io/ioutil"
 	"log"
 	"os"
-	"path/filepath"
 
 	"github.com/BurntSushi/toml"
 
 	"github.com/buildpack/lifecycle"
 	"github.com/buildpack/lifecycle/cmd"
+	"github.com/buildpack/lifecycle/metadata"
 )
 
 var (
@@ -82,13 +82,13 @@ func build() error {
 		Err:         log.New(os.Stderr, "", 0),
 	}
 
-	metadata, err := builder.Build()
+	md, err := builder.Build()
 	if err != nil {
 		return cmd.FailErrCode(err, cmd.CodeFailedBuild, "build")
 	}
 
-	metadataPath := filepath.Join(layersDir, "config", "metadata.toml")
-	if err := lifecycle.WriteTOML(metadataPath, metadata); err != nil {
+	metadataPath := metadata.MetadataFilePath(layersDir)
+	if err := lifecycle.WriteTOML(metadataPath, md); err != nil {
 		return cmd.FailErr(err, "write metadata")
 	}
 	return nil

cmd/launcher/main.go

@@ -2,14 +2,14 @@ package main
 
 import (
 	"os"
-	"path/filepath"
 	"strings"
 	"syscall"
 
 	"github.com/BurntSushi/toml"
 
 	"github.com/buildpack/lifecycle"
 	"github.com/buildpack/lifecycle/cmd"
+	"github.com/buildpack/lifecycle/metadata"
 )
 
 var (
@@ -43,9 +43,9 @@ func launch() error {
 	}
 	_ = os.Unsetenv(cmd.EnvAppDir)
 
-	var metadata lifecycle.BuildMetadata
-	metadataPath := filepath.Join(layersDir, "config", "metadata.toml")
-	if _, err := toml.DecodeFile(metadataPath, &metadata); err != nil {
+	var md lifecycle.BuildMetadata
+	metadataPath := metadata.MetadataFilePath(layersDir)
+	if _, err := toml.DecodeFile(metadataPath, &md); err != nil {
 		return cmd.FailErr(err, "read metadata")
 	}
 
@@ -59,8 +59,8 @@ func launch() error {
 		DefaultProcessType: defaultProcessType,
 		LayersDir:          layersDir,
 		AppDir:             appDir,
-		Processes:          metadata.Processes,
-		Buildpacks:         metadata.Buildpacks,
+		Processes:          md.Processes,
+		Buildpacks:         md.Buildpacks,
 		Env:                env,
 		Exec:               syscall.Exec,
 	}

exporter.go

@@ -6,6 +6,7 @@ import (
 	"log"
 	"path/filepath"
 
+	"github.com/BurntSushi/toml"
 	"github.com/buildpack/imgutil"
 	"github.com/buildpack/imgutil/local"
 	"github.com/buildpack/imgutil/remote"
@@ -48,10 +49,6 @@ func (e *Exporter) Export(
 	}
 
 	meta.RunImage.Reference = identifier.String()
-	if err != nil {
-		return errors.Wrap(err, "get run image digest")
-	}
-
 	meta.Stack = stack
 
 	meta.App.SHA, err = e.addOrReuseLayer(workingImage, &layer{path: appDir, identifier: "app"}, origMetadata.App.SHA)
@@ -126,6 +123,20 @@ func (e *Exporter) Export(
 		return errors.Wrap(err, "set app image metadata label")
 	}
 
+	buildMD := &BuildMetadata{}
+	if _, err := toml.DecodeFile(metadata.MetadataFilePath(layersDir), buildMD); err != nil {
+		return errors.Wrap(err, "read build metadata")
+	} else {
+		buildJson, err := json.Marshal(metadata.BuildMetadata{BOM: buildMD.BOM})
+		if err != nil {
+			return errors.Wrap(err, "parse build metadata")
+		}
+
+		if err = workingImage.SetLabel(metadata.BuildMetadataLabel, string(buildJson)); err != nil {
+			return errors.Wrap(err, "set build image metadata label")
+		}
+	}
+
 	if err = workingImage.SetEnv(cmd.EnvLayersDir, layersDir); err != nil {
 		return errors.Wrapf(err, "set app image env %s", cmd.EnvLayersDir)
 	}

exporter_test.go

@@ -320,6 +320,88 @@ func testExporter(t *testing.T, when spec.G, it spec.S) {
 				h.AssertEq(t, meta.Stack.RunImage.Mirrors, []string{"registry.example.com/some/run", "other.example.com/some/run"})
 			})
 
+			when("metadata.toml does not include BOM", func() {
+				it.Before(func() {
+					err := ioutil.WriteFile(filepath.Join(layersDir, "config", "metadata.toml"), []byte(`
+[[processes]]
+  type = "web"
+  command = "npm start"
+`),
+						os.ModePerm,
+					)
+					h.AssertNil(t, err)
+				})
+
+				it("BOM is not present in that label", func() {
+					h.AssertNil(t, exporter.Export(layersDir, appDir, fakeAppImage, fakeImageMetadata, additionalNames, launcherPath, stack))
+
+					metadataJSON, err := fakeAppImage.Label("io.buildpacks.build.metadata")
+					h.AssertNil(t, err)
+
+					h.AssertJSONEq(t, `
+{
+  "bom": null
+}
+`,
+						metadataJSON)
+
+				})
+			})
+
+			when("metadata.toml includes BOM", func() {
+				it.Before(func() {
+					err := ioutil.WriteFile(filepath.Join(layersDir, "config", "metadata.toml"), []byte(`
+[[processes]]
+  type = "web"
+  command = "npm start"
+[bom]
+  [bom.auto-reconfiguration]
+    version = "2.7.0"
+    [bom.auto-reconfiguration.metadata]
+      name = "Spring Auto-reconfiguration"
+      sha256 = "0d524877db7344ec34620f7e46254053568292f5ce514f74e3a0e9b2dbfc338b"
+      stacks = ["io.buildpacks.stacks.bionic", "org.cloudfoundry.stacks.cflinuxfs3"]
+      uri = "https://example.com"
+
+      [[bom.auto-reconfiguration.metadata.licenses]]
+        type = "Apache-2.0"
+`),
+						os.ModePerm,
+					)
+					h.AssertNil(t, err)
+				})
+
+				it("saves BOM metadata to the resulting image", func() {
+					h.AssertNil(t, exporter.Export(layersDir, appDir, fakeAppImage, fakeImageMetadata, additionalNames, launcherPath, stack))
+
+					metadataJSON, err := fakeAppImage.Label("io.buildpacks.build.metadata")
+					h.AssertNil(t, err)
+					h.AssertJSONEq(t, `
+{
+  "bom": {
+    "auto-reconfiguration": {
+      "metadata": {
+        "licenses": [
+          {
+            "type": "Apache-2.0"
+          }
+        ],
+        "name": "Spring Auto-reconfiguration",
+        "sha256": "0d524877db7344ec34620f7e46254053568292f5ce514f74e3a0e9b2dbfc338b",
+        "stacks": [
+          "io.buildpacks.stacks.bionic",
+          "org.cloudfoundry.stacks.cflinuxfs3"
+        ],
+        "uri": "https://example.com"
+      },
+      "version": "2.7.0"
+    }
+  }
+}
+`, metadataJSON)
+				})
+			})
+
 			it("sets CNB_LAYERS_DIR", func() {
 				h.AssertNil(t, exporter.Export(layersDir, appDir, fakeAppImage, fakeImageMetadata, additionalNames, launcherPath, stack))
 

go.sum

@@ -70,6 +70,7 @@ github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24
 github.com/sirupsen/logrus v1.4.1 h1:GL2rEmy6nsikmW0r8opw9JIRScdMF5hA8cOYLH7In1k=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=

metadata/metadata.go

@@ -2,12 +2,18 @@ package metadata
 
 import (
 	"encoding/json"
+	"path"
 
 	"github.com/buildpack/imgutil"
 	"github.com/pkg/errors"
 )
 
 const AppMetadataLabel = "io.buildpacks.lifecycle.metadata"
+const BuildMetadataLabel = "io.buildpacks.build.metadata"
+
+type BuildMetadata struct {
+	BOM map[string]map[string]interface{} `json:"bom"`
+}
 
 type AppImageMetadata struct {
 	App        AppMetadata         `json:"app" toml:"app"`
@@ -102,3 +108,7 @@ func GetRawMetadata(image imgutil.Image, metadataLabel string) (string, error) {
 	}
 	return contents, nil
 }
+
+func MetadataFilePath(layersDir string) string {
+	return path.Join(layersDir, "config", "metadata.toml")
+}

testhelpers/testhelpers.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -83,6 +84,22 @@ func AssertNil(t *testing.T, actual interface{}) {
 	}
 }
 
+func AssertJSONEq(t *testing.T, expected, actual string) {
+	t.Helper()
+
+	var expectedJSONAsInterface, actualJSONAsInterface interface{}
+
+	if err := json.Unmarshal([]byte(expected), &expectedJSONAsInterface); err != nil {
+		t.Fatalf("Expected value ('%s') is not valid json.\nJSON parsing error: '%s'", expected, err.Error())
+	}
+
+	if err := json.Unmarshal([]byte(actual), &actualJSONAsInterface); err != nil {
+		t.Fatalf("Input ('%s') needs to be valid json.\nJSON parsing error: '%s'", actual, err.Error())
+	}
+
+	AssertEq(t, expectedJSONAsInterface, actualJSONAsInterface)
+}
+
 func isNil(value interface{}) bool {
 	return value == nil || (reflect.TypeOf(value).Kind() == reflect.Ptr && reflect.ValueOf(value).IsNil())
 }