Store SBOM

[tupui]

SBOM should be stored for releases. The file itself can be stored on IPFS while the CID would be stored onchain.

[Edoscoba]

Can I start working on this?

[tupui]

Can I start working on this?

@Edoscoba Thank you but no this one is not ready and if you are coming for the ODHack12 please only look at issues marked with the label.

[prempador]

Conceptual Proposal for this Issue:

• Create Github Action for soroban-versioning project itself, showing all the steps needed
• Convert to a generalised Workflow (can be stored in the mono-repo for now)
• See where it goes, potentially split off from monorepo

As for the technology used to create the SBOM I would suggest to use aquasecurity/trivy, which allows to create both SPDX and CycloneDX as per their documentation and is fully open-source. My suggestion here would be to generate both formats, as we don't know yet which one of those specifications will be more widely used in the future.

For IPFS I think that the Kubo CLI is a good approach, in this case we could be running this whole process only on CLI commands. We can get some inspiration from already existing actions like ipfs-deploy-action.

Workflow Steps:

• Generate SPDX SBOM (trivy)
• Generate CycloneDX SBOM (trivy)
• Store Both SBOMs (kubo)
• Store CIDs on Chain

@tupui please assign me to the issue if there is no major conceptual problems with my proposed approach, I would like to start working on the issue this week.

[tupui]

Woo thanks @prempador for the very well thought out plan 🙌 I am happily assigned in the issue to you!

The plan looks great. For IPFS in the CI there is some stuff in dapp-ipfs.yml. We can either reuse some of that or go with your suggestion. I don't have strong opinions there and did not know Kubo actually :) We use Storacha as an IPFS provider right now. (In a hypothetical future, we could have our own nodes but for now Storacha is great and the 5GB of the free tier is more than enough.)

[prempador]

Thanks for the pointer, seems like I have overlooked that IPFS is already used in the CI here, so let's just stick with that then.