Don't compute layer hash twice

internal/cli/build.go

@@ -289,19 +289,22 @@ func buildImageComponents(ctx context.Context, wd string, archs []types.Architec
 			if bc.Options.SourceDateEpoch, err = bc.GetBuildDateEpoch(); err != nil {
 				return fmt.Errorf("failed to determine build date epoch: %w", err)
 			}
-			if bc.Options.SourceDateEpoch.After(multiArchBDE) {
-				multiArchBDE = bc.Options.SourceDateEpoch
-			}
 
 			img, err := oci.BuildImageFromLayer(
 				layer, bc.ImageConfiguration, bc.Options.SourceDateEpoch, bc.Options.Arch, bc.Logger())
 			if err != nil {
 				return fmt.Errorf("failed to build OCI image for %q: %w", arch, err)
 			}
+
 			mtx.Lock()
+			defer mtx.Unlock()
+
 			imgs[arch] = img
 			imageTars[arch] = layerTarGZ
-			mtx.Unlock()
+
+			if bc.Options.SourceDateEpoch.After(multiArchBDE) {
+				multiArchBDE = bc.Options.SourceDateEpoch
+			}
 
 			return nil
 		})
@@ -345,8 +348,9 @@ func buildImageComponents(ctx context.Context, wd string, archs []types.Architec
 					return fmt.Errorf("generating sbom for %s: %w", arch, err)
 				}
 				mtx.Lock()
+				defer mtx.Unlock()
+
 				sboms = append(sboms, outputs...)
-				mtx.Unlock()
 				return nil
 			})
 		}

pkg/build/build.go

@@ -94,8 +94,8 @@ func (bc *Context) GenerateIndexSBOM(ctx context.Context, indexDigest name.Diges
 	return bc.impl.GenerateIndexSBOM(ctx, &bc.Options, &bc.ImageConfiguration, indexDigest, imgs)
 }
 
-func (bc *Context) GenerateSBOM(ctx context.Context) error {
-	return bc.impl.GenerateSBOM(ctx, &bc.Options, &bc.ImageConfiguration)
+func (bc *Context) GenerateSBOM(ctx context.Context, digest v1.Hash) error {
+	return bc.impl.GenerateSBOM(ctx, &bc.Options, &bc.ImageConfiguration, digest)
 }
 
 func (bc *Context) InstalledPackages() ([]*apkimpl.InstalledPackage, error) {
@@ -183,9 +183,14 @@ func (bc *Context) ImageLayoutToLayer(ctx context.Context) (string, v1.Layer, er
 		return "", nil, err
 	}
 
+	h := v1.Hash{
+		Algorithm: "sha256",
+		Hex:       hex.EncodeToString(digest.Sum(make([]byte, 0, digest.Size()))),
+	}
+
 	// generate SBOM
 	if bc.Options.WantSBOM {
-		if err := bc.GenerateSBOM(ctx); err != nil {
+		if err := bc.GenerateSBOM(ctx, h); err != nil {
 			return "", nil, fmt.Errorf("generating SBOMs: %w", err)
 		}
 	} else {
@@ -200,10 +205,7 @@ func (bc *Context) ImageLayoutToLayer(ctx context.Context) (string, v1.Layer, er
 	l := &layer{
 		filename: layerTarGZ,
 		desc: &v1.Descriptor{
-			Digest: v1.Hash{
-				Algorithm: "sha256",
-				Hex:       hex.EncodeToString(digest.Sum(make([]byte, 0, digest.Size()))),
-			},
+			Digest:    h,
 			Size:      size,
 			MediaType: mt,
 		},

pkg/build/build_implementation.go

@@ -137,7 +137,16 @@ func (di *buildImplementation) GenerateImageSBOM(ctx context.Context, o *options
 
 	s := newSBOM(di.workdirFS, o, ic)
 
-	if err := s.ReadLayerTarball(ctx, o.TarballPath); err != nil {
+	m, err := img.Manifest()
+	if err != nil {
+		return nil, fmt.Errorf("getting %s manifest: %w", o.Arch, err)
+	}
+
+	if len(m.Layers) != 1 {
+		return nil, fmt.Errorf("unexpected layers in %s manifest: %d", o.Arch, len(m.Layers))
+	}
+
+	if err := s.SetLayerDigest(ctx, m.Layers[0].Digest); err != nil {
 		return nil, fmt.Errorf("reading layer tar: %w", err)
 	}
 
@@ -175,7 +184,7 @@ func (di *buildImplementation) GenerateImageSBOM(ctx context.Context, o *options
 }
 
 // GenerateSBOM generates an SBOM for an apko layer
-func (di *buildImplementation) GenerateSBOM(ctx context.Context, o *options.Options, ic *types.ImageConfiguration) error {
+func (di *buildImplementation) GenerateSBOM(ctx context.Context, o *options.Options, ic *types.ImageConfiguration, digest v1.Hash) error {
 	ctx, span := otel.Tracer("apko").Start(ctx, "GenerateSBOM")
 	defer span.End()
 
@@ -186,7 +195,7 @@ func (di *buildImplementation) GenerateSBOM(ctx context.Context, o *options.Opti
 
 	s := newSBOM(di.workdirFS, o, ic)
 
-	if err := s.ReadLayerTarball(ctx, o.TarballPath); err != nil {
+	if err := s.SetLayerDigest(ctx, digest); err != nil {
 		return fmt.Errorf("reading layer tar: %w", err)
 	}
 

pkg/sbom/sbom.go

@@ -17,19 +17,16 @@ package sbom
 //go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
 
 import (
-	"bufio"
 	"context"
 	"fmt"
 	"io"
 	"io/fs"
-	"os"
 	"path/filepath"
 
 	apkfs "github.com/chainguard-dev/go-apk/pkg/fs"
 	osr "github.com/dominodatalab/os-release"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"gitlab.alpinelinux.org/alpine/go/pkg/repository"
-	"go.opentelemetry.io/otel"
 
 	"chainguard.dev/apko/pkg/build/types"
 	"chainguard.dev/apko/pkg/sbom/generator"
@@ -132,11 +129,8 @@ func (s *SBOM) GenerateIndex() ([]string, error) {
 }
 
 // ReadLayerTarball reads an apko layer tarball and adds its metadata to the SBOM options
-func (s *SBOM) ReadLayerTarball(ctx context.Context, path string) error {
-	_, span := otel.Tracer("apko").Start(ctx, "ReadLayerTarball")
-	defer span.End()
-
-	return s.impl.ReadLayerTarball(&s.Options, path)
+func (s *SBOM) SetLayerDigest(ctx context.Context, digest v1.Hash) error {
+	return s.impl.SetLayerDigest(&s.Options, digest)
 }
 
 //counterfeiter:generate . sbomImplementation
@@ -146,7 +140,7 @@ type sbomImplementation interface {
 	Generate(*options.Options, map[string]generator.Generator) ([]string, error)
 	CheckGenerators(*options.Options, map[string]generator.Generator) error
 	GenerateIndex(*options.Options, map[string]generator.Generator) ([]string, error)
-	ReadLayerTarball(*options.Options, string) error
+	SetLayerDigest(*options.Options, v1.Hash) error
 }
 
 type defaultSBOMImplementation struct{}
@@ -247,17 +241,7 @@ func (di *defaultSBOMImplementation) GenerateIndex(opts *options.Options, genera
 }
 
 // ReadLayerTarball reads an apko layer adding its digest to the sbom options
-func (di *defaultSBOMImplementation) ReadLayerTarball(opts *options.Options, tarballPath string) error {
-	f, err := os.Open(tarballPath)
-	if err != nil {
-		return fmt.Errorf("failed to open tar.gz: %w", err)
-	}
-	defer f.Close()
-
-	digest, _, err := v1.SHA256(bufio.NewReader(f))
-	if err != nil {
-		return fmt.Errorf("could not calculate layer digest: %w", err)
-	}
+func (di *defaultSBOMImplementation) SetLayerDigest(opts *options.Options, digest v1.Hash) error {
 	opts.ImageInfo.LayerDigest = digest.String()
 	return nil
 }