From 72cf3de7a56b0128ffc98fc88c90a190fe2cd3c2 Mon Sep 17 00:00:00 2001 From: Sanjeev Rohila Date: Tue, 6 Oct 2026 16:41:11 +0530 Subject: [PATCH 1/3] DLPX-99530 containerized-masking: drop SBOM_DEEP_SCAN, it builds no .deb PR URL: https://www.github.com/delphix/linux-pkg/pull/419 Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/specs/2026-09-08-sbom-per-package-design.md | 12 ++++++++++-- packages/containerized-masking/config.sh | 8 +++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/docs/specs/2026-09-08-sbom-per-package-design.md b/docs/specs/2026-09-08-sbom-per-package-design.md index 3365ec6..74f4b74 100644 --- a/docs/specs/2026-09-08-sbom-per-package-design.md +++ b/docs/specs/2026-09-08-sbom-per-package-design.md @@ -32,7 +32,7 @@ dependency to add** — it only needs to *invoke* `syft`, which is already avail The Phase 1 base scan lists every installed `.deb` as a flat `pkg:deb` component. That is correct and sufficient for 3rd-party Debian packages, but wrong for Delphix's own -first-party packages: `masking`, `virtualization`, `delphix-sso-app`, `containerized-masking`, +first-party packages: `masking`, `virtualization`, `delphix-sso-app`, `windows-connector`, `zfs`, `ptools`, `delphix-rust`, and `performance-diagnostics` all bundle third-party components across ecosystems (jars, npm, wheels, Rust crates) that `dpkg` cannot see — dpkg only knows @@ -231,7 +231,6 @@ strictly "is it 1st-party" — see the `zfs` case), `SBOM_DEEP_SCAN="true"` is s | `masking` | Java/Gradle app bundling jars + npm frontend | | `virtualization` | Java/Gradle app bundling jars + npm frontend | | `delphix-sso-app` | Java/Gradle app | -| `containerized-masking` | Java/Gradle app | | `windows-connector` | Java/Gradle app | | `zfs` | OpenZFS fork bundling Delphix's Rust object agent (crates invisible to dpkg) | | `ptools` | Rust | @@ -246,6 +245,15 @@ the top-level design's Tooling section separately calls out a possible Go overri binary-build-info cataloger that may already cover it) — revisit under Phase 4's evaluation if gaps are found. +`containerized-masking` was originally in the table above, on the strength of its content (it +is the masking Java/Gradle app). It was removed under DLPX-99530: it builds no `.deb` — its +only artifact is a `masking-kubernetes-.zip` — so `generate_sbom()`, which scans +`.deb`s and fails when an opted-in package produced none, failed every post-push build. It is +also in no appliance image, so a per-`.deb` SBOM for it would have no image SBOM to be merged +into; its third-party content is covered by the Mend scans of its container images +(`MEND_SCAN_IMAGES`). Every package left in the table builds `.deb`s that ship in appliance +images. + ### 6. Provisioning syft/cyclonedx-cli — generic build tooling, not a package dependency `generate_sbom()` is a **default hook**: defined once in `lib/common.sh` and inherited diff --git a/packages/containerized-masking/config.sh b/packages/containerized-masking/config.sh index d1cff12..c1a3f56 100644 --- a/packages/containerized-masking/config.sh +++ b/packages/containerized-masking/config.sh @@ -40,7 +40,13 @@ DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/dms-core-gate.git" # PACKAGE_NEEDS_DOCKER="true" MEND_SCAN_APPLICABLE="true" -SBOM_DEEP_SCAN="true" +# +# No SBOM_DEEP_SCAN: generate_sbom() scans this package's .debs, and it builds +# none -- its only artifact is the masking-kubernetes zip, so opting in fails +# the build. It is in no appliance image either, so there would be no image +# SBOM to merge one into. Its third-party content is covered by the Mend scans +# of MEND_SCAN_IMAGES below. +# MEND_SCAN_IMAGES="'delphix-masking-proxy', 'delphix-masking-database', 'delphix-masking-app'" From 325d30959493f8222d022e5514d2cedd4a440e36 Mon Sep 17 00:00:00 2001 From: Sanjeev Rohila Date: Tue, 6 Oct 2026 17:03:19 +0530 Subject: [PATCH 2/3] DLPX-99530 containerized-masking: set SBOM_DEEP_SCAN=false instead of unset Dropping the assignment left the flag unclassified, failing the verify-sbom-scan-flag check added in #418, which requires every package to explicitly opt in or out. Co-Authored-By: Claude Sonnet 5 --- packages/containerized-masking/config.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/containerized-masking/config.sh b/packages/containerized-masking/config.sh index c1a3f56..72670a3 100644 --- a/packages/containerized-masking/config.sh +++ b/packages/containerized-masking/config.sh @@ -41,12 +41,13 @@ DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/dms-core-gate.git" PACKAGE_NEEDS_DOCKER="true" MEND_SCAN_APPLICABLE="true" # -# No SBOM_DEEP_SCAN: generate_sbom() scans this package's .debs, and it builds +# Not deep-scanned: generate_sbom() scans this package's .debs, and it builds # none -- its only artifact is the masking-kubernetes zip, so opting in fails # the build. It is in no appliance image either, so there would be no image # SBOM to merge one into. Its third-party content is covered by the Mend scans # of MEND_SCAN_IMAGES below. # +SBOM_DEEP_SCAN="false" MEND_SCAN_IMAGES="'delphix-masking-proxy', 'delphix-masking-database', 'delphix-masking-app'" From c6b4f34a8c7887783e0f5379324ef4405d9fb7bc Mon Sep 17 00:00:00 2001 From: Sanjeev Rohila Date: Tue, 6 Oct 2026 17:08:06 +0530 Subject: [PATCH 3/3] DLPX-99530 docs: fix sbom-per-package design doc for containerized-masking The doc described containerized-masking's SBOM_DEEP_SCAN as removed/ unset, but 325d309 set it explicitly to "false" instead, so the false count was off by one and the explanatory text no longer matched. Co-Authored-By: Claude Sonnet 5 --- docs/specs/2026-09-08-sbom-per-package-design.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/specs/2026-09-08-sbom-per-package-design.md b/docs/specs/2026-09-08-sbom-per-package-design.md index 74f4b74..95aae47 100644 --- a/docs/specs/2026-09-08-sbom-per-package-design.md +++ b/docs/specs/2026-09-08-sbom-per-package-design.md @@ -237,7 +237,7 @@ strictly "is it 1st-party" — see the `zfs` case), `SBOM_DEEP_SCAN="true"` is s | `delphix-rust` | Rust | | `performance-diagnostics` | 1st-party Delphix package built from its own source | -The remaining 31 packages (kernel packages, `misc-debs`, `syft`/`cyclonedx-cli` themselves, +The remaining 32 packages (kernel packages, `misc-debs`, `syft`/`cyclonedx-cli` themselves, etc.) get `SBOM_DEEP_SCAN="false"` — plain 3rd-party forks or single-ecosystem tools already fully represented by the Phase 1 flat `pkg:deb` component. `delphix-go` is a judgment call: the top-level design's Tooling section separately calls out a possible Go override @@ -246,13 +246,13 @@ binary-build-info cataloger that may already cover it) — revisit under Phase 4 if gaps are found. `containerized-masking` was originally in the table above, on the strength of its content (it -is the masking Java/Gradle app). It was removed under DLPX-99530: it builds no `.deb` — its -only artifact is a `masking-kubernetes-.zip` — so `generate_sbom()`, which scans -`.deb`s and fails when an opted-in package produced none, failed every post-push build. It is -also in no appliance image, so a per-`.deb` SBOM for it would have no image SBOM to be merged -into; its third-party content is covered by the Mend scans of its container images -(`MEND_SCAN_IMAGES`). Every package left in the table builds `.deb`s that ship in appliance -images. +is the masking Java/Gradle app). It was reclassified to `SBOM_DEEP_SCAN="false"` under +DLPX-99530: it builds no `.deb` — its only artifact is a `masking-kubernetes-.zip` — +so `generate_sbom()`, which scans `.deb`s and fails when an opted-in package produced none, +failed every post-push build. It is also in no appliance image, so a per-`.deb` SBOM for it +would have no image SBOM to be merged into; its third-party content is covered by the Mend +scans of its container images (`MEND_SCAN_IMAGES`). Every other package left in the `"true"` +table builds `.deb`s that ship in appliance images. ### 6. Provisioning syft/cyclonedx-cli — generic build tooling, not a package dependency