From 494a7a51a564abd4d09dbeb432d6875817bd0fd7 Mon Sep 17 00:00:00 2001 From: mrbobbytables Date: Thu, 10 Sep 2026 17:24:48 +0000 Subject: [PATCH 1/2] fix(sbom): add Bluefin LTS NVIDIA stream and retire dx/gdx package queries Signed-off-by: mrbobbytables --- scripts/fetch-github-driver-versions.js | 1 + scripts/fetch-github-sbom.js | 75 ++----------------------- scripts/fetch-github-sbom.test.js | 19 +++++++ 3 files changed, 26 insertions(+), 69 deletions(-) diff --git a/scripts/fetch-github-driver-versions.js b/scripts/fetch-github-driver-versions.js index 2cc8a58d..e398c4fe 100644 --- a/scripts/fetch-github-driver-versions.js +++ b/scripts/fetch-github-driver-versions.js @@ -57,6 +57,7 @@ const SBOM_STREAM_PREFIX = { "bluefin-latest": "latest", "bluefin-lts": "stable", "bluefin-lts-hwe": "stable-hwe", + "bluefin-lts-nvidia": "stable", "bluefin-dx-stable": "stable", "bluefin-dx-latest": "latest", "bluefin-dx-lts": "stable", diff --git a/scripts/fetch-github-sbom.js b/scripts/fetch-github-sbom.js index 34c77ad9..3ac1dc03 100644 --- a/scripts/fetch-github-sbom.js +++ b/scripts/fetch-github-sbom.js @@ -19,12 +19,12 @@ * - Pagination: GitHub Releases API is paginated; we fetch all pages. * - Failure modes: present:false = no attestation published; * verified:false = attestation exists but verification failed. - * - lts/gdx streams: keyless:false (key-based signing, not OIDC keyless). + * - lts streams: keyless:false (key-based signing, not OIDC keyless). * verifyAttestation() uses OIDC keyless → attestation.present:false is expected. * LTS SBOMs ARE published (spdx-json format via oras attach from reusable-build-image.yml). * downloadSbom() uses ORAS directly and works regardless of signing method. * extractPackageVersions() handles both Syft JSON and SPDX JSON formats. - * Cache hit for lts/gdx uses packageVersions presence (not attestation.verified). + * Cache hit for lts uses packageVersions presence (not attestation.verified). * - SBOM download: uses `oras discover` on the image tag to find the * vnd.spdx+json referrer digest, then `oras pull` to download sbom.json * into a temp directory. @@ -32,7 +32,7 @@ * parsed for RPM artifacts to extract packageVersions. * - SBOM cache: keyed by image digest — if the digest hasn't changed AND * packageVersions is non-null, the existing cache entry is reused. - * - NVIDIA: present in GDX (bluefin-gdx-lts) SBOM as nvidia-driver RPM. + * - NVIDIA: present in LTS NVIDIA (bluefin-lts-nvidia) SBOM as nvidia-driver RPM. * Absent from base bluefin-stable/lts SBOMs (akmod, built separately). * fetch-github-driver-versions.js uses null for nvidia on stable/lts streams. * - Atomic write: output is written to a temp file then renamed to avoid @@ -124,7 +124,7 @@ const PARTIAL_RELEASES_REASON = * from keyRepo via scripts/lib/signing-trust.js, the single source of truth * shared with fetch-github-images.js: * keyless:true → OIDC keyless signing (stable/latest/beta mainline streams) - * keyless:false → key-based signing; cosignKeyUrl required (lts/gdx streams). + * keyless:false → key-based signing; cosignKeyUrl required (lts streams). * These streams have no SBOMs yet — present:false is expected. * When lts SBOMs are published, no code changes are needed. * @@ -203,77 +203,14 @@ const RAW_STREAM_SPECS = [ keyRepo: "projectbluefin/bluefin-lts", }, { - id: "bluefin-dx-stable", - label: "Bluefin DX Stable", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "stable", - keyRepo: "projectbluefin/bluefin", - }, - { - id: "bluefin-dx-latest", - label: "Bluefin DX Latest", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "latest", - keyRepo: "projectbluefin/bluefin", - }, - { - id: "bluefin-dx-lts", - label: "Bluefin DX LTS", - org: "projectbluefin", - package: "bluefin-lts", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "stable", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-hwe-testing", - label: "Bluefin DX LTS HWE Testing", - org: "projectbluefin", - package: "bluefin-lts", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "stable-hwe-testing", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-hwe-testing-50", - label: "Bluefin DX LTS HWE Testing 50", - org: "projectbluefin", - package: "bluefin-lts", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "stable-hwe-testing-50", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-testing-50", - label: "Bluefin DX LTS Testing 50", - org: "projectbluefin", - package: "bluefin-lts", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "stable-testing-50", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-gdx-lts", - label: "Bluefin GDX LTS", + id: "bluefin-lts-nvidia", + label: "Bluefin LTS NVIDIA", org: "projectbluefin", package: "bluefin-lts", releasesRepo: "projectbluefin/bluefin-lts", streamPrefix: "stable", keyRepo: "projectbluefin/bluefin-lts", }, - { - id: "bluefin-gdx-latest", - label: "Bluefin GDX Latest", - org: "projectbluefin", - package: "bluefin-gdx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "latest", - keyRepo: "projectbluefin/bluefin", - }, { id: "bluefin-nvidia-open-stable", label: "Bluefin Nvidia Open Stable", diff --git a/scripts/fetch-github-sbom.test.js b/scripts/fetch-github-sbom.test.js index 56ef33a3..744af37e 100644 --- a/scripts/fetch-github-sbom.test.js +++ b/scripts/fetch-github-sbom.test.js @@ -321,6 +321,25 @@ test("STREAM_SPECS maps all Bluefin LTS streams to bluefin-lts package and stabl assert.ok(primaryLts, "bluefin-lts spec must exist"); assert.equal(primaryLts.package, "bluefin-lts"); assert.equal(primaryLts.streamPrefix, "stable"); + + const ltsNvidia = STREAM_SPECS.find((s) => s.id === "bluefin-lts-nvidia"); + assert.ok(ltsNvidia, "bluefin-lts-nvidia spec must exist"); + assert.equal(ltsNvidia.package, "bluefin-lts"); + assert.equal(ltsNvidia.streamPrefix, "stable"); + assert.equal(ltsNvidia.org, "projectbluefin"); + assert.equal(ltsNvidia.releasesRepo, "projectbluefin/bluefin-lts"); + assert.equal(ltsNvidia.keyRepo, "projectbluefin/bluefin-lts"); +}); + +test("STREAM_SPECS does not contain retired dx or gdx streams", () => { + const retiredStreams = STREAM_SPECS.filter( + (s) => s.id.includes("-dx-") || s.id.includes("-gdx-"), + ); + assert.deepEqual( + retiredStreams.map((s) => s.id), + [], + "dx and gdx streams should be retired", + ); }); // Dynamic reference date based on current time to avoid lookback window flakiness. From a3f8a898f2c5802d574c1d0c3879a66578314b09 Mon Sep 17 00:00:00 2001 From: Jorge Castro Date: Mon, 14 Sep 2026 10:15:03 -0400 Subject: [PATCH 2/2] fix(images): drop obsolete nvidiaSbomFallbackStreamId pointing to bluefin-gdx-lts --- scripts/fetch-github-images.js | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/fetch-github-images.js b/scripts/fetch-github-images.js index 642f47c1..4efbc1e8 100644 --- a/scripts/fetch-github-images.js +++ b/scripts/fetch-github-images.js @@ -68,7 +68,6 @@ const PRODUCT_SPECS = [ releaseSource: { feed: "lts", stream: "lts" }, sbomStreamId: "bluefin-lts", nvidiaSbomStreamId: "bluefin-lts-nvidia", - nvidiaSbomFallbackStreamId: "bluefin-gdx-lts", keyRepo: "projectbluefin/bluefin-lts", nvidiaPackage: "bluefin-lts-nvidia", allowTestingStreams: true,