[WIP] Add a SBOM generation feature

.devcontainer/cuda12.9-conda/devcontainer.json

@@ -40,12 +40,14 @@
       "pruneStaticLibs": true
     },
     "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
+    "./features/src/rapids-build-utils": {},
+    "./features/src/sbom": {}
   },
   "overrideFeatureInstallOrder": [
     "./features/src/cuda",
     "./features/src/utils",
-    "./features/src/rapids-build-utils"
+    "./features/src/rapids-build-utils",
+    "./features/src/sbom"
   ],
   "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config,conda/pkgs,conda/${localWorkspaceFolderBasename}-cuda12.9-envs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cumlprims_mg,cuml,cugraph,cugraph-gnn,nx-cugraph}"],
   "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],

.devcontainer/cuda12.9-pip/devcontainer.json

@@ -28,12 +28,14 @@
       "installProfilers": true
     },
     "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
+    "./features/src/rapids-build-utils": {},
+    "./features/src/sbom": {}
   },
   "overrideFeatureInstallOrder": [
     "./features/src/cuda",
     "./features/src/utils",
-    "./features/src/rapids-build-utils"
+    "./features/src/rapids-build-utils",
+    "./features/src/sbom"
   ],
   "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config/pip,local/share/${localWorkspaceFolderBasename}-cuda12.9-venvs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cumlprims_mg,cuml,cugraph,cugraph-gnn,nx-cugraph}"],
   "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],

.devcontainer/cuda13.0-conda/devcontainer.json

@@ -40,12 +40,14 @@
       "pruneStaticLibs": true
     },
     "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
+    "./features/src/rapids-build-utils": {},
+    "./features/src/sbom": {}
   },
   "overrideFeatureInstallOrder": [
     "./features/src/cuda",
     "./features/src/utils",
-    "./features/src/rapids-build-utils"
+    "./features/src/rapids-build-utils",
+    "./features/src/sbom"
   ],
   "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config,conda/pkgs,conda/${localWorkspaceFolderBasename}-cuda13.0-envs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cumlprims_mg,cuml,cugraph,cugraph-gnn,nx-cugraph}"],
   "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],

.devcontainer/cuda13.0-pip/devcontainer.json

@@ -28,12 +28,14 @@
       "installProfilers": true
     },
     "./features/src/utils": {},
-    "./features/src/rapids-build-utils": {}
+    "./features/src/rapids-build-utils": {},
+    "./features/src/sbom": {}
   },
   "overrideFeatureInstallOrder": [
     "./features/src/cuda",
     "./features/src/utils",
-    "./features/src/rapids-build-utils"
+    "./features/src/rapids-build-utils",
+    "./features/src/sbom"
   ],
   "initializeCommand": ["/bin/bash", "-c", "mkdir -m 0755 -p ${localWorkspaceFolder}/../.{aws,cache,config/pip,local/share/${localWorkspaceFolderBasename}-cuda13.0-venvs,log/devcontainer-utils} ${localWorkspaceFolder}/../{rmm,dask-cuda,kvikio,ucxx,cudf,rapidsmpf,raft,cuvs,cumlprims_mg,cuml,cugraph,cugraph-gnn,nx-cugraph}"],
   "postAttachCommand": ["/bin/bash", "-c", "if [ ${CODESPACES:-false} = 'true' ]; then . devcontainer-utils-post-attach-command; fi"],

.github/actions/build-linux-image/action.yml

@@ -8,6 +8,7 @@ inputs:
   repo: {type: string, required: true, description: Image repo}
   push: {type: string, required: true, description: Whether to push the image}
   retries: {type: string, default: '10', description: Number of times to retry the container build}
+  syft_ver: {type: string, required: false, description: Syft version for SBOM feature (default 'latest')}
 
 outputs:
   hash_amd64:
@@ -35,6 +36,7 @@ runs:
         repo: "${{ inputs.repo }}"
         retries: "${{ inputs.retries }}"
         tag: "${{ inputs.tag }}"
+        syft_ver: "${{ inputs.syft_ver }}"
       run: |
         set -euo pipefail;
 
@@ -52,6 +54,7 @@ runs:
           --no-cache \
           --image-name "${repo,,}:${tag}" \
           --workspace-folder "$(realpath -m ./image)" \
+          ${syft_ver:+--build-arg SYFT_VER=${syft_ver}} \
           "${outputs[@]}" 2>&1 \
         | tee "${{ runner.temp }}/${arch}.log" 1>&2
         do

.github/actions/build-windows-image/action.yml

@@ -32,6 +32,11 @@ inputs:
     required: false
     default: process
     description: Windows isolation mode to target (hyperv or process isolation)
+  syft_ver:
+    type: string
+    required: false
+    default: latest
+    description: Syft version for SBOM generation
 
 runs:
   using: composite
@@ -45,4 +50,5 @@ runs:
           -cudaVersion ${{ inputs.cuda }} `
           -repoVersion ${{ inputs.version }} `
           -isolation ${{ inputs.isolation }} `
-          -edition windows${{ inputs.edition }}
+          -edition windows${{ inputs.edition }} `
+          -syftVer ${{ inputs.syft_ver }}

.github/actions/devcontainer-json/action.sh

@@ -6,6 +6,7 @@ cd "$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )/../../../";
 os="${1:-"ubuntu:22.04"}";
 features="${2:-"[]"}";
 container_env="${3:-"null"}";
+syft_ver="${4:-"latest"}";
 
 VERSION="$(git describe --abbrev=0 --tags | sed 's/[a-zA-Z]//g' | cut -d '.' -f -2)";
 tag="$(node -p "$(cat <<EOF
@@ -28,6 +29,7 @@ const json = JSON.parse(readFileSync('image/.devcontainer/devcontainer.json'));
 
 json.build.args.BASE = '${os}';
 json.build.args.RAPIDS_VERSION = '${VERSION}';
+json.build.args.SYFT_VER = '${syft_ver}';
 json.containerEnv = Object.assign(json.containerEnv || {}, ${container_env} || {});
 
 const dups = {};

.github/actions/devcontainer-json/action.yml

@@ -12,6 +12,10 @@ inputs:
   container_env:
     type: string
     required: false
+  syft_ver:
+    type: string
+    required: false
+    default: latest
 
 outputs:
   tag:
@@ -30,6 +34,7 @@ runs:
           '${{ inputs.os }}'                          \
           '${{ inputs.features }}'                    \
           '${{ inputs.container_env }}'               \
+          '${{ inputs.syft_ver }}'                \
         3>> "$GITHUB_OUTPUT"                          \
         4> image/.devcontainer/devcontainer.json.out  ;
 

.github/workflows/build-test-and-push-linux-image.yml

@@ -24,6 +24,11 @@ on:
         type: string
         required: false
         description: JSON map of default envvars to build into the devcontainer
+      syft_ver:
+        type: string
+        required: false
+        default: latest
+        description: Syft version for SBOM generation
 
 jobs:
 
@@ -55,6 +60,7 @@ jobs:
           os: "${{ inputs.os }}"
           features: "${{ inputs.features }}"
           container_env: "${{ inputs.container_env }}"
+          syft_ver: "${{ inputs.syft_ver }}"
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3
@@ -70,6 +76,7 @@ jobs:
           repo: "${{ inputs.repo }}"
           push: "${{ inputs.push }}"
           tag: "${{ steps.json.outputs.tag }}"
+          syft_ver: "${{ inputs.syft_ver }}"
 
   push-to-dockerhub:
     if: inputs.push == 'true'

.github/workflows/build-test-and-push-windows-image.yml

@@ -24,6 +24,11 @@ on:
         type: string
         required: false
         description: JSON map of default envvars to build into the devcontainer
+      syft_ver:
+        type: string
+        required: false
+        default: latest
+        description: Syft version for SBOM generation
 
 jobs:
 
@@ -75,6 +80,7 @@ jobs:
           repo: "${{ steps.info.outputs.repo }}"
           version: "${{ steps.info.outputs.version }}"
           edition: "${{ matrix.edition }}"
+          syft_ver: "${{ inputs.syft_ver }}"
 
       - name: Test ${{ steps.info.outputs.tag }}
         uses: ./.github/actions/test-windows-image

.github/workflows/release-linux.yml

@@ -6,6 +6,11 @@ concurrency:
 
 on:
   workflow_dispatch:
+    inputs:
+      syft_ver:
+        description: "Syft version for SBOM generation"
+        required: false
+        default: latest
 
 jobs:
 
@@ -67,3 +72,4 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "${{ inputs.syft_ver || 'latest' }}"

.github/workflows/release-windows.yml

@@ -6,6 +6,11 @@ concurrency:
 
 on:
   workflow_dispatch:
+    inputs:
+      syft_ver:
+        description: "Syft version for SBOM generation"
+        required: false
+        default: latest
 
 jobs:
 
@@ -42,3 +47,4 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "${{ inputs.syft_ver || 'latest' }}"

.github/workflows/release.yml

@@ -6,6 +6,11 @@ concurrency:
 
 on:
   workflow_dispatch:
+    inputs:
+      syft_ver:
+        description: "Syft version for SBOM generation"
+        required: false
+        default: latest
   push:
     branches:
       - "branch-[0-9][0-9].[0-9][0-9]"
@@ -73,6 +78,7 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "${{ inputs.syft_ver || 'latest' }}"
 
   release-windows:
     if: needs.image-matrix.outputs.windows != '{"include":[]}'
@@ -89,6 +95,7 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "${{ inputs.syft_ver || 'latest' }}"
 
   release-features:
     if: needs.features-matrix.outputs.features != '[]' || needs.features-matrix.outputs.scenarios != '[]'

.github/workflows/test.yml

@@ -175,6 +175,7 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "latest"
 
   build-and-test-windows-images:
     if: needs.image-matrix.outputs.windows != '{"include":[]}'
@@ -191,3 +192,4 @@ jobs:
       features: "${{ toJSON(matrix.features) }}"
       container_env: "${{ toJSON(matrix.env) }}"
       repo: "${{ vars.DOCKERHUB_REPOSITORY || github.repository }}"
+      syft_ver: "latest"

features/src/sbom/common/etc/bash.bash_env

@@ -0,0 +1,37 @@
+#! /usr/bin/env bash
+
+# Respect --noprofile and --norc
+if [[ ! $(ps -o args= -p $$) =~ (--noprofile) ]]; then
+    # Otherwise, initialize non-login shells like login shells
+    if ! shopt -q login_shell; then
+        if [ -f /etc/profile ]; then
+            . /etc/profile
+        fi
+        for x in "$HOME"/.{bash_profile,bash_login,profile}; do
+            if [ -f "$x" ]; then
+                . "$x"
+                break
+            fi
+        done
+    fi
+elif [[ ! $(ps -o args= -p $$) =~ (--norc|--rcfile|--init-file) ]]; then
+    if [ -f /etc/bash.bashrc ]; then
+        . /etc/bash.bashrc
+    fi
+    for x in "$HOME"/.bashrc; do
+        if [ -f "$x" ]; then
+            . "$x"
+            break
+        fi
+    done
+fi
+
+export BASH_ENV=/etc/bash.bash_env
+
+if [ -n "${BASH_ENV_ETC_PROFILE:-}" ]; then
+    if [ -f "$BASH_ENV_ETC_PROFILE" ]              \
+    && [ "$BASH_ENV_ETC_PROFILE" != "$BASH_ENV" ]; \
+    then
+        . "$BASH_ENV_ETC_PROFILE"
+    fi
+fi

features/src/sbom/common/etc/skel/.config/clangd/config.yaml

@@ -0,0 +1,63 @@
+# https://clangd.llvm.org/config
+
+# Apply a config conditionally to all C files
+If:
+  PathMatch: .*\.(c|h)$
+
+---
+
+# Apply a config conditionally to all C++ files
+If:
+  PathMatch: .*\.(c|h)pp
+
+---
+
+# Apply a config conditionally to all CUDA files
+If:
+  PathMatch: .*\.cuh?
+CompileFlags:
+  Add:
+    - "-x"
+    - "cuda"
+    # No error on unknown CUDA versions
+    - "-Wno-unknown-cuda-version"
+    # Allow variadic CUDA functions
+    - "-Xclang=-fcuda-allow-variadic-functions"
+
+---
+
+# Tweak the clangd parse settings for all files
+CompileFlags:
+  Add:
+    # report all errors
+    - "-ferror-limit=0"
+    - "-fmacro-backtrace-limit=0"
+    - "-ftemplate-backtrace-limit=0"
+    # Skip the CUDA version check
+    - "--no-cuda-version-check"
+  Remove:
+    # remove gcc's -fcoroutines
+    - -fcoroutines
+    # remove nvc++ flags unknown to clang
+    - "-gpu=*"
+    - "-stdpar*"
+    # remove nvcc flags unknown to clang
+    - "-arch*"
+    - "-gencode*"
+    - "--generate-code*"
+    - "-ccbin*"
+    - "-t=*"
+    - "--threads*"
+    - "-Xptxas*"
+    - "-Xcudafe*"
+    - "-Xfatbin*"
+    - "-Xcompiler*"
+    - "--diag-suppress*"
+    - "--diag_suppress*"
+    - "--compiler-options*"
+    - "--expt-extended-lambda"
+    - "--expt-relaxed-constexpr"
+    - "-forward-unknown-to-host-compiler"
+    - "-Werror=cross-execution-space-call"
+    - "--compress-mode*"
+    - "-static-global-template-stub*"