From bddea737e5e460d8a8de1bee58eca422c7e8b259 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Wed, 16 Sep 2026 14:53:32 +0200 Subject: [PATCH] fix(opensearch-dashboards): Generate the SBOM from the built distribution --- CHANGELOG.md | 3 +++ opensearch-dashboards/Dockerfile | 31 +++++++++++++++++++++++++------ 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f70b55842..1eee8175f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -49,6 +49,8 @@ All notable changes to this project will be documented in this file. - opa, statsd-exporter: Detect the licenses of the Go dependencies ([#1638]). - opa, statsd-exporter: Report the Go dependencies at module level instead of package and file level ([#1638]). +- opensearch-dashboards: Generate the SBOM from the built distribution instead of the source + worktree, so dev dependencies are excluded ([#1641]). ### Removed @@ -66,6 +68,7 @@ All notable changes to this project will be documented in this file. [#1630]: https://github.com/stackabletech/docker-images/pull/1630 [#1635]: https://github.com/stackabletech/docker-images/pull/1635 [#1638]: https://github.com/stackabletech/docker-images/pull/1638 +[#1641]: https://github.com/stackabletech/docker-images/pull/1641 ## [26.7.0] - 2026-07-21 diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile index 96b57d7e0..7ee633303 100644 --- a/opensearch-dashboards/Dockerfile +++ b/opensearch-dashboards/Dockerfile @@ -195,6 +195,22 @@ for plugin in $(ls); do done EOF +# cdxgen runs against the built distribution in /stackable/opensearch-dashboards, +# not against the source worktree. The worktree is a full development install +# (yarn osd bootstrap), so scanning it reported every devDependency of the root +# project, of packages/*, examples/*, test/plugin_functional/plugins/* and of all +# plugin repositories: Cypress, Selenium WebDriver, ChromeDriver, Jest, Mocha, +# ESLint, webpack and ~350 @types/* packages, none of which are in the image. +# The built distribution contains exactly what is shipped. +# +# --exclude drops the lockfiles that the OpenSearch Dashboards plugins ship +# inside their installed plugin directory. cdxgen prefers a lockfile over +# node_modules, so without this it reads those 15 yarn.lock files and reports +# each plugin's devDependencies again. Excluding them makes cdxgen walk the +# installed node_modules instead, which additionally yields a license for almost +# every component, because an installed package.json records one while a Yarn 1 +# lockfile does not. +# # --spec-version is passed explicitly because cdxgen changes its default between # releases. The value is a global build argument, see boil.toml. # --type js restricts cdxgen to the JavaScript ecosystem. Without it, cdxgen @@ -202,11 +218,14 @@ EOF # GitHub Actions workflows, Gradle and Python files of the build tooling. # --no-babel disables the Babel based usage analysis, which is not needed for a # dependency inventory. -# Note: --required-only is not passed. cdxgen marks every package read from a -# yarn.lock as "required", because the Yarn 1 lockfile does not record whether a -# dependency is a devDependency, so the flag would have no effect here but would -# set `compositions.aggregate` to `incomplete`. -RUN PATH="/opt/node-cdxgen/bin:$PATH" cdxgen --type js --no-babel --json-pretty --spec-version "${CDXGEN_SPEC_VERSION}" +# Note: --required-only is not passed and is not needed. It filters a lockfile by +# the dev flag, which a Yarn 1 lockfile does not record anyway, and no lockfile is +# read here: the installed node_modules already contains only what was installed. +RUN PATH="/opt/node-cdxgen/bin:$PATH" cdxgen --type js --no-babel --json-pretty \ + --spec-version "${CDXGEN_SPEC_VERSION}" \ + --exclude '**/yarn.lock' --exclude '**/package-lock.json' \ + -o /stackable/bom.json \ + /stackable/opensearch-dashboards RUN <