Repository: mongodb/mongodb-atlas-cli
Pull request #3862: CLOUDP-315271: Onboard Kundukto to CI
Author: login: cveticm
Created: 2025-04-29T13:32:24Z | Merged: 2025-05-19T10:18:02Z

## Proposed changes

Adds new evergreen task "generate_and_upload_sbom" to generate an SBOM and package it in the release.
Adds new file build/ci/purls.txt which is a list of purls built from the binary. 
This step of work does the following:

1. New task "generate_and_upload_sbom":
    1.   Creates Silkbomb tokens
    2.   Generates a list of purls from the linux binary
    3.   Generates an non-augemented SBOM in dir `compliance/.`
    4.   Creates a Kondukto token
    5.   Uploads the SBOM to the mongodb_mongodb-atlas-cli Kondukto project
2. Modification to release process
    1. Includes the SBOM in release page.
3. New purls check
    1. A new make command generates build/ci/purls.txt for visibility to devs on the implications their changes have to the sbom
    2. A new EVG check that purls.txt is up-to-date 

This PR does not:
1. Generate SSDLC report (future work of [CLOUDP-315269](https://jira.mongodb.org/browse/CLOUDP-315269))
3. Generate augmented SBOMs (future work of [CLOUDP-315270](https://jira.mongodb.org/browse/CLOUDP-315270))
5. Generate a purls list for any other OS (future work of [CLOUDP-316920](https://jira.mongodb.org/browse/CLOUDP-316920)


_Jira ticket:_ [CLOUDP-315271](https://jira.mongodb.org/browse/CLOUDP-315271)

## Checklist

- [x] I have signed the [MongoDB CLA](https://www.mongodb.com/legal/contributor-agreement)
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] I have added any necessary documentation in document requirements section listed in [CONTRIBUTING.md](https://github.com/mongodb/mongodb-atlas-cli/blob/master/CONTRIBUTING.md) (if appropriate)
- [ ] I have addressed the @mongodb/docs-cloud-team comments (if appropriate)
- [ ] I have updated [test/README.md](https://github.com/mongodb/mongodb-atlas-cli/blob/master/test/README.md) (if an e2e test has been added)
- [ ] I have run `make fmt` and formatted my code



Diff:
diff --git a/.gitignore b/.gitignore
index 68d0517690c..34b4a13e2b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@
 *.so
 *.dylib
 bin/**
+compliance/**
 dist/**
 # mac notarization service
 linux_amd64/**
diff --git a/Makefile b/Makefile
index a3c6940ea6b..d5fef420ab0 100644
--- a/Makefile
+++ b/Makefile
@@ -117,7 +117,7 @@ addcopy: ## Add missing license to files
 	@scripts/add-copy.sh
 
 .PHONY: generate
-generate: gen-docs gen-mocks gen-api-commands ## Generate docs, mocks, code, api commands, all auto generated assets
+generate: gen-docs gen-mocks gen-api-commands gen-purls ## Generate docs, mocks, code, api commands, all auto generated assets
 
 .PHONY: apply-overlay
 apply-overlay: ## Apply overlay on openapi spec
@@ -149,6 +149,14 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
+	@echo "==> Generating purls"
+	GOOS=linux GOARCH=amd64 go build -trimpath -mod=readonly -o bin/atlas-linux ./cmd/atlas
+	go version -m ./bin/atlas-linux | \
+		awk '$$1 == "dep" || $$1 == "=>" { print "pkg:golang/" $$2 "@" $$3 }' | \
+		LC_ALL=C sort > build/package/purls.txt
+
 .PHONY: build
 build: ## Generate an atlas binary in ./bin
 	@echo "==> Building $(ATLAS_BINARY_NAME) binary"
diff --git a/build/ci/check-purls.sh b/build/ci/check-purls.sh
new file mode 100755
index 00000000000..b15acf9fd72
--- /dev/null
+++ b/build/ci/check-purls.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+if ! git diff --quiet --exit-code build/package/purls.txt; then
+    echo "build/package/purls.txt is out of date. Please run 'make gen-purls' and commit the result."
+    git --no-pager diff build/package/purls.txt
+    exit 1
+fi
diff --git a/build/ci/evergreen.yml b/build/ci/evergreen.yml
index 7dc0f7f4a76..e136a40a726 100644
--- a/build/ci/evergreen.yml
+++ b/build/ci/evergreen.yml
@@ -533,6 +533,21 @@ functions:
         binary: make
         args:
           - otel
+  "check purls":
+    - command: subprocess.exec
+      type: test
+      params:
+        <<: *go_options
+        binary: make
+        args: 
+        - gen-purls
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - workdir
+        binary: build/ci/check-purls.sh
+
 tasks:
   - name: compile
     tags: ["code_health"]
@@ -1726,6 +1741,10 @@ tasks:
         vars:
           span: "coverage"
           attr: "total=${percentage},count=${count}"
+  - name: check_purls
+    tags: ["code_health"]
+    commands:
+      - func: "check purls"
   - name: snyk_monitor
     tags:
     - snyk
diff --git a/build/ci/release.yml b/build/ci/release.yml
index eff153c9bd9..1ab85541780 100644
--- a/build/ci/release.yml
+++ b/build/ci/release.yml
@@ -70,6 +70,48 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
+          - workdir
+        binary: build/package/generate-sbom.sh 
+  "run silkbomb": 
+    - command: ec2.assume_role
+      params:
+        role_arn: ${kondukto_role_arn}
+    - command: shell.exec
+      params:
+        silent: true
+        shell: bash
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
+        script: |
+          set -e
+          kondukto_token=$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)
+          echo "KONDUKTO_TOKEN=$kondukto_token" > ${workdir}/kondukto_credentials.env
+    - command: shell.exec
+      params:
+        shell: bash
+        script: |
+          docker run \
+          --pull=always \
+          --platform="linux/amd64" \
+          --rm \
+          --env-file ${workdir}/kondukto_credentials.env \
+          -v ${workdir}:/workdir \
+          901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 \
+          upload \
+          --sbom-in /workdir/src/github.com/mongodb/mongodb-atlas-cli/compliance/sbom.json \
+          --repo mongodb_mongodb-atlas-cli  \
+          --branch ${branch_name}  
+          rm ${workdir}/kondukto_credentials.env
   "package":
     - command: github.generate_token
       params:
@@ -317,6 +359,10 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
+    commands:  
+      - func: "generate sbom"
+      - func: "run silkbomb"
   - name: package_goreleaser
     tags: ["packaging"]
     depends_on:
@@ -528,6 +574,8 @@ buildvariants:
         depends_on:
           - name: package_msi
             variant: "go_atlascli_msi_snapshot"
+          - name: generate_and_upload_sbom
+            variant: ssdlc
   - name: publish_atlascli_snapshot
     display_name: "Publish AtlasCLI Snapshot"
     run_on:
@@ -553,6 +601,8 @@ buildvariants:
         depends_on:
           - name: package_msi
             variant: release_atlascli_msi
+          - name: generate_and_upload_sbom
+            variant: ssdlc
   - name: copybara
     display_name: "Copybara"
     git_tag_only: true
@@ -605,3 +655,11 @@ buildvariants:
       - ubuntu2004-small
     tasks:
       - name: .smoke-test .generate .repo .atlascli
+  - name: ssdlc
+    display_name: Compliance [ssdlc]
+    run_on:
+      - ubuntu2204-small
+    expansions:
+      <<: *go_linux_version
+    tasks:
+      - name: generate_and_upload_sbom
diff --git a/build/package/.goreleaser.yml b/build/package/.goreleaser.yml
index 302c5f2c261..905efe962a2 100644
--- a/build/package/.goreleaser.yml
+++ b/build/package/.goreleaser.yml
@@ -142,4 +142,5 @@ release:
   name_template: "MongoDB Atlas CLI {{.Version}}"
   extra_files:
     - glob: ./bin/*.msi
-version: 2
\ No newline at end of file
+    - glob: compliance/**/*
+version: 2
diff --git a/build/package/generate-sbom.sh b/build/package/generate-sbom.sh
new file mode 100755
index 00000000000..97393a40b36
--- /dev/null
+++ b/build/package/generate-sbom.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+# Authenticate Docker to AWS ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
+echo "Generating SBOMs..."
+docker run --rm \
+  -v "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli:/pwd" \
+  901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 \
+  update \
+  --purls /pwd/build/package/purls.txt \
+  --sbom-out /pwd/sbom.json
+  
\ No newline at end of file
diff --git a/build/package/purls.txt b/build/package/purls.txt
new file mode 100644
index 00000000000..9c9060be37c
--- /dev/null
+++ b/build/package/purls.txt
@@ -0,0 +1,122 @@
+pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8
+pkg:golang/cloud.google.com/go/auth@v0.16.0
+pkg:golang/cloud.google.com/go/compute/metadata@v0.6.0
+pkg:golang/cloud.google.com/go/iam@v1.5.0
+pkg:golang/cloud.google.com/go/kms@v1.21.2
+pkg:golang/cloud.google.com/go/longrunning@v0.6.6
+pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.18.0
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.9.0
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.1
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.3.1
+pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.1.1
+pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.4.2
+pkg:golang/github.com/Masterminds/semver/v3@v3.3.1
+pkg:golang/github.com/PaesslerAG/gval@v1.0.0
+pkg:golang/github.com/PaesslerAG/jsonpath@v0.1.1
+pkg:golang/github.com/ProtonMail/go-crypto@v1.2.0
+pkg:golang/github.com/STARRY-S/zip@v0.2.1
+pkg:golang/github.com/andybalholm/brotli@v1.1.1
+pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.29.14
+pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.17.67
+pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.16.30
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.3.34
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.6.34
+pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.12.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.12.15
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.38.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.25.3
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.30.1
+pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.33.19
+pkg:golang/github.com/aws/aws-sdk-go-v2@v1.36.3
+pkg:golang/github.com/aws/smithy-go@v1.22.2
+pkg:golang/github.com/bodgit/plumbing@v1.3.0
+pkg:golang/github.com/bodgit/sevenzip@v1.6.0
+pkg:golang/github.com/bodgit/windows@v1.0.1
+pkg:golang/github.com/briandowns/spinner@v1.23.2
+pkg:golang/github.com/cloudflare/circl@v1.6.0
+pkg:golang/github.com/denisbrodbeck/machineid@v1.0.1
+pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707
+pkg:golang/github.com/fatih/color@v1.14.1
+pkg:golang/github.com/felixge/httpsnoop@v1.0.4
+pkg:golang/github.com/fsnotify/fsnotify@v1.8.0
+pkg:golang/github.com/go-logr/logr@v1.4.2
+pkg:golang/github.com/go-logr/stdr@v1.2.2
+pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1
+pkg:golang/github.com/golang-jwt/jwt/v5@v5.2.2
+pkg:golang/github.com/golang/mock@v1.6.0
+pkg:golang/github.com/golang/snappy@v0.0.4
+pkg:golang/github.com/google/go-github/v61@v61.0.0
+pkg:golang/github.com/google/go-querystring@v1.1.0
+pkg:golang/github.com/google/s2a-go@v0.1.9
+pkg:golang/github.com/google/uuid@v1.6.0
+pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.6
+pkg:golang/github.com/googleapis/gax-go/v2@v2.14.1
+pkg:golang/github.com/hashicorp/errwrap@v1.1.0
+pkg:golang/github.com/hashicorp/go-multierror@v1.1.1
+pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7
+pkg:golang/github.com/iancoleman/strcase@v0.3.0
+pkg:golang/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51
+pkg:golang/github.com/klauspost/compress@v1.18.0
+pkg:golang/github.com/klauspost/pgzip@v1.2.6
+pkg:golang/github.com/kylelemons/godebug@v1.1.0
+pkg:golang/github.com/mattn/go-colorable@v0.1.13
+pkg:golang/github.com/mattn/go-isatty@v0.0.20
+pkg:golang/github.com/mgutz/ansi@v0.0.0-20170206155736-9520e82c474b
+pkg:golang/github.com/mholt/archives@v0.1.1
+pkg:golang/github.com/minio/minlz@v1.0.0
+pkg:golang/github.com/mongodb-forks/digest@v1.1.0
+pkg:golang/github.com/montanaflynn/stats@v0.7.1
+pkg:golang/github.com/nwaples/rardecode/v2@v2.1.0
+pkg:golang/github.com/pelletier/go-toml/v2@v2.2.3
+pkg:golang/github.com/pelletier/go-toml@v1.9.5
+pkg:golang/github.com/pierrec/lz4/v4@v4.1.21
+pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c
+pkg:golang/github.com/sagikazarmark/locafero@v0.7.0
+pkg:golang/github.com/shirou/gopsutil/v4@v4.25.3
+pkg:golang/github.com/sorairolake/lzip-go@v0.3.5
+pkg:golang/github.com/sourcegraph/conc@v0.3.0
+pkg:golang/github.com/spf13/afero@v1.14.0
+pkg:golang/github.com/spf13/cast@v1.7.1
+pkg:golang/github.com/spf13/cobra@v1.9.1
+pkg:golang/github.com/spf13/pflag@v1.0.6
+pkg:golang/github.com/spf13/viper@v1.20.1
+pkg:golang/github.com/subosito/gotenv@v1.6.0
+pkg:golang/github.com/tangzero/inflector@v1.0.0
+pkg:golang/github.com/therootcompany/xz@v1.0.1
+pkg:golang/github.com/tklauser/go-sysconf@v0.3.12
+pkg:golang/github.com/tklauser/numcpus@v0.6.1
+pkg:golang/github.com/ulikunitz/xz@v0.5.12
+pkg:golang/github.com/xdg-go/pbkdf2@v1.0.0
+pkg:golang/github.com/xdg-go/scram@v1.1.2
+pkg:golang/github.com/xdg-go/stringprep@v1.0.4
+pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78
+pkg:golang/go.mongodb.org/atlas-sdk/v20240530005@v20240530005.0.0
+pkg:golang/go.mongodb.org/atlas-sdk/v20250312002@v20250312002.0.0
+pkg:golang/go.mongodb.org/atlas@v0.38.0
+pkg:golang/go.mongodb.org/mongo-driver@v1.17.3
+pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0
+pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.60.0
+pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.60.0
+pkg:golang/go.opentelemetry.io/otel/metric@v1.35.0
+pkg:golang/go.opentelemetry.io/otel/trace@v1.35.0
+pkg:golang/go.opentelemetry.io/otel@v1.35.0
+pkg:golang/go4.org@v0.0.0-20230225012048-214862532bf5
+pkg:golang/golang.org/x/crypto@v0.37.0
+pkg:golang/golang.org/x/exp@v0.0.0-20241004190924-225e2abe05e6
+pkg:golang/golang.org/x/mod@v0.24.0
+pkg:golang/golang.org/x/net@v0.39.0
+pkg:golang/golang.org/x/oauth2@v0.29.0
+pkg:golang/golang.org/x/sync@v0.13.0
+pkg:golang/golang.org/x/sys@v0.32.0
+pkg:golang/golang.org/x/term@v0.31.0
+pkg:golang/golang.org/x/text@v0.24.0
+pkg:golang/golang.org/x/time@v0.11.0
+pkg:golang/google.golang.org/api@v0.229.0
+pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20250414145226-207652e42e2e
+pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250414145226-207652e42e2e
+pkg:golang/google.golang.org/genproto@v0.0.0-20250303144028-a0af3efb3deb
+pkg:golang/google.golang.org/grpc@v1.72.0
+pkg:golang/google.golang.org/protobuf@v1.36.6
+pkg:golang/gopkg.in/yaml.v3@v3.0.1
diff --git a/scripts/pre-commit.sh b/scripts/pre-commit.sh
index 539319c74a1..6e3fdfdb895 100755
--- a/scripts/pre-commit.sh
+++ b/scripts/pre-commit.sh
@@ -39,6 +39,13 @@ if [[ -n "${STAGED_GO_FILES}" ]]; then
     git add docs
 fi
 
+STAGED_GO_MOD_FILES=$(git diff --cached --name-only | grep -E "^go\.(mod|sum)$" || true)
+
+if [[ -n "${STAGED_GO_MOD_FILES}" ]]; then
+    make gen-purls > /dev/null
+    git add build/package/purls.txt
+fi
+
 STAGED_EVG_FILES=$(git diff --cached --name-only | grep "evergreen.yml$")
 
 for FILE in ${STAGED_EVG_FILES}


Reviews:
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-29T14:07:49Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-29T14:23:42Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-29T16:47:49Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T09:15:23Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T09:17:54Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T09:24:04Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T09:28:44Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T10:41:07Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T10:44:38Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T10:47:01Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T10:48:51Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T12:22:39Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T12:23:58Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T12:25:10Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T12:27:20Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T13:28:52Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T14:39:33Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-30T14:42:31Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T15:23:22Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T15:24:36Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T15:25:53Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T08:37:26Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T08:50:29Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T09:14:34Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T10:58:20Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:11:29Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:11:48Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:13:45Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:13:54Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:15:30Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:16:36Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:18:21Z
user: login: fmenezes
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T13:19:17Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-02T08:48:10Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T10:42:36Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T10:44:32Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T10:47:52Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T10:48:44Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-02T11:01:19Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-02T11:03:52Z
user: login: gssbzn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T11:06:07Z
user: login: cveticm
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-02T12:11:43Z
user: login: fmenezes
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-02T13:16:40Z

Review comments:
diff_hunk: @@ -43,6 +43,12 @@ variables:
     working_dir: src/github.com/mongodb/mongodb-atlas-cli
     env:
       <<: *go_env
+  - &silkbomb_container_config
path: build/ci/evergreen.yml
user: login: fmenezes
body: this is for all tasks, can you move it to each task to have it's own env vars?
created_at: 2025-04-29T14:07:49Z
author_association: COLLABORATOR
diff_hunk: @@ -43,6 +43,12 @@ variables:
     working_dir: src/github.com/mongodb/mongodb-atlas-cli
     env:
       <<: *go_env
+  - &silkbomb_container_config
path: build/ci/evergreen.yml
user: login: cveticm
body: Good point! Moved
created_at: 2025-04-29T14:23:41Z
author_association: COLLABORATOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: cveticm
body: This directory currently holds the generated SBOM.
It will also hold the generated SSDLC report after future work.
created_at: 2025-04-29T16:47:48Z
author_association: COLLABORATOR
diff_hunk: @@ -70,6 +70,40 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: shell.exec
path: build/ci/release.yml
user: login: gssbzn
body: https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Best-Practices#subprocessexec

>In general, use [subprocess.exec](https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Project-Commands#subprocessexec) instead of shell.exec.
created_at: 2025-04-30T09:15:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -317,6 +351,19 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
+    commands:  
+      - func: "generate sbom"
+      - func: "write kondukto credentials"
+      - func: "run silkbomb"
+        vars:
+          CONTAINER_COMMAND: docker
+          CONTAINER_IMAGE: 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
+          CONTAINER_OPTIONS: --pull=always --platform="linux/amd64" --rm
+          CONTAINER_ENV_FILES: --env-file ${workdir}/kondukto_credentials.env
+          CONTAINER_VOLUMES: -v ${workdir}:/workdir
+          SILKBOMB_COMMAND: upload
+          SILKBOMB_ARGS: --sbom-in /workdir/src/github.com/mongodb/mongodb-atlas-cli/compliance/sbom.json --repo mongodb_mongodb-atlas-cli  --branch ${branch_name}
path: build/ci/release.yml
user: login: gssbzn
body: would you call `"run silkbomb"` with different values for these vars? if no then they don't need to be argrs for the function 
created_at: 2025-04-30T09:17:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: gssbzn
body: there are no expectations to produce this report with the release, any reason we are including it?
created_at: 2025-04-30T09:24:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+echo "Generating PURLs..."
+cd "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli"
+
+go list -json -mod=mod all | jq -r '.Module // empty | "pkg:golang/" + .Path + "@" + .Version // empty' | sort -u  > purls.txt
path: build/package/generate-sbom.sh
user: login: gssbzn
body: this report is not accurate, this is what I get 
```
pkg:golang/cloud.google.com/go/auth@v0.16.0
pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8
pkg:golang/cloud.google.com/go/compute/metadata@v0.6.0
pkg:golang/cloud.google.com/go/iam@v1.5.0
pkg:golang/cloud.google.com/go/kms@v1.21.2
pkg:golang/cloud.google.com/go/longrunning@v0.6.6
pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7
pkg:golang/github.com/andybalholm/brotli@v1.1.1
pkg:golang/github.com/aws/aws-sdk-go-v2@v1.36.3
pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.29.14
pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.17.67
pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.16.30
pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.3.34
pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.6.34
pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.3
pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.12.3
pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.12.15
pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.38.3
pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.25.3
pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.30.1
pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.33.19
pkg:golang/github.com/aws/smithy-go@v1.22.2
pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.18.0
pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.9.0
pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.1
pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.3.1
pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.1.1
pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.4.2
pkg:golang/github.com/bodgit/plumbing@v1.3.0
pkg:golang/github.com/bodgit/sevenzip@v1.6.0
pkg:golang/github.com/bodgit/windows@v1.0.1
pkg:golang/github.com/bradleyjkemp/cupaloy/v2@v2.8.0
pkg:golang/github.com/briandowns/spinner@v1.23.2
pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0
pkg:golang/github.com/cloudflare/circl@v1.6.0
pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
pkg:golang/github.com/denisbrodbeck/machineid@v1.0.1
pkg:golang/github.com/dprotaso/go-yit@v0.0.0-20191028211022-135eb7262960
pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707
pkg:golang/github.com/ebitengine/purego@v0.8.2
pkg:golang/github.com/evergreen-ci/shrub@v0.0.0-20241002130202-d2f0f3752474
pkg:golang/github.com/fatih/color@v1.14.1
pkg:golang/github.com/felixge/httpsnoop@v1.0.4
pkg:golang/github.com/fsnotify/fsnotify@v1.8.0
pkg:golang/github.com/getkin/kin-openapi@v0.131.0
pkg:golang/github.com/go-logr/logr@v1.4.2
pkg:golang/github.com/go-logr/stdr@v1.2.2
pkg:golang/github.com/go-openapi/jsonpointer@v0.21.0
pkg:golang/github.com/go-openapi/swag@v0.23.0
pkg:golang/github.com/go-test/deep@v1.1.1
pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1
pkg:golang/github.com/golang-jwt/jwt/v5@v5.2.2
pkg:golang/github.com/golang/snappy@v0.0.4
pkg:golang/github.com/google/go-github/v52@v52.0.0
pkg:golang/github.com/google/go-github/v61@v61.0.0
pkg:golang/github.com/google/go-querystring@v1.1.0
pkg:golang/github.com/google/s2a-go@v0.1.9
pkg:golang/github.com/google/uuid@v1.6.0
pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.6
pkg:golang/github.com/googleapis/gax-go/v2@v2.14.1
pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.26.1
pkg:golang/github.com/hashicorp/errwrap@v1.1.0
pkg:golang/github.com/hashicorp/go-multierror@v1.1.1
pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7
pkg:golang/github.com/iancoleman/strcase@v0.3.0
pkg:golang/github.com/josharian/intern@v1.0.0
pkg:golang/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51
pkg:golang/github.com/klauspost/compress@v1.18.0
pkg:golang/github.com/klauspost/pgzip@v1.2.6
pkg:golang/github.com/kylelemons/godebug@v1.1.0
pkg:golang/github.com/mailru/easyjson@v0.7.7
pkg:golang/github.com/Masterminds/semver/v3@v3.3.1
pkg:golang/github.com/mattn/go-colorable@v0.1.13
pkg:golang/github.com/mattn/go-isatty@v0.0.20
pkg:golang/github.com/mgutz/ansi@v0.0.0-20170206155736-9520e82c474b
pkg:golang/github.com/mholt/archives@v0.1.1
pkg:golang/github.com/minio/minlz@v1.0.0
pkg:golang/github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826
pkg:golang/github.com/mongodb-forks/digest@v1.1.0
pkg:golang/github.com/mongodb-labs/cobra2snooty@v1.19.1
pkg:golang/github.com/mongodb/mongodb-atlas-cli/atlascli@
pkg:golang/github.com/montanaflynn/stats@v0.7.1
pkg:golang/github.com/nwaples/rardecode/v2@v2.1.0
pkg:golang/github.com/oasdiff/yaml@v0.0.0-20250309154309-f31be36b4037
pkg:golang/github.com/oasdiff/yaml3@v0.0.0-20250309153720-d2182401db90
pkg:golang/github.com/PaesslerAG/gval@v1.0.0
pkg:golang/github.com/PaesslerAG/jsonpath@v0.1.1
pkg:golang/github.com/pelletier/go-toml@v1.9.5
pkg:golang/github.com/pelletier/go-toml/v2@v2.2.3
pkg:golang/github.com/perimeterx/marshmallow@v1.1.5
pkg:golang/github.com/pierrec/lz4/v4@v4.1.21
pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c
pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2
pkg:golang/github.com/ProtonMail/go-crypto@v1.2.0
pkg:golang/github.com/sagikazarmark/locafero@v0.7.0
pkg:golang/github.com/shirou/gopsutil/v4@v4.25.3
pkg:golang/github.com/sorairolake/lzip-go@v0.3.5
pkg:golang/github.com/sourcegraph/conc@v0.3.0
pkg:golang/github.com/speakeasy-api/jsonpath@v0.6.0
pkg:golang/github.com/speakeasy-api/openapi-overlay@v0.10.1
pkg:golang/github.com/spf13/afero@v1.14.0
pkg:golang/github.com/spf13/cast@v1.7.1
pkg:golang/github.com/spf13/cobra@v1.9.1
pkg:golang/github.com/spf13/pflag@v1.0.6
pkg:golang/github.com/spf13/viper@v1.20.1
pkg:golang/github.com/STARRY-S/zip@v0.2.1
pkg:golang/github.com/stretchr/testify@v1.10.0
pkg:golang/github.com/subosito/gotenv@v1.6.0
pkg:golang/github.com/tangzero/inflector@v1.0.0
pkg:golang/github.com/therootcompany/xz@v1.0.1
pkg:golang/github.com/tklauser/go-sysconf@v0.3.12
pkg:golang/github.com/ulikunitz/xz@v0.5.12
pkg:golang/github.com/vmware-labs/yaml-jsonpath@v0.3.2
pkg:golang/github.com/xdg-go/pbkdf2@v1.0.0
pkg:golang/github.com/xdg-go/scram@v1.1.2
pkg:golang/github.com/xdg-go/stringprep@v1.0.4
pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78
pkg:golang/github.com/yuin/goldmark@v1.7.11
pkg:golang/go.mongodb.org/atlas-sdk/v20240530005@v20240530005.0.0
pkg:golang/go.mongodb.org/atlas-sdk/v20250312002@v20250312002.0.0
pkg:golang/go.mongodb.org/atlas@v0.38.0
pkg:golang/go.mongodb.org/mongo-driver@v1.17.3
pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0
pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.60.0
pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.60.0
pkg:golang/go.opentelemetry.io/otel@v1.35.0
pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.35.0
pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.35.0
pkg:golang/go.opentelemetry.io/otel/metric@v1.35.0
pkg:golang/go.opentelemetry.io/otel/sdk@v1.35.0
pkg:golang/go.opentelemetry.io/otel/trace@v1.35.0
pkg:golang/go.opentelemetry.io/proto/otlp@v1.5.0
pkg:golang/go.uber.org/mock@v0.5.2
pkg:golang/go4.org@v0.0.0-20230225012048-214862532bf5
pkg:golang/golang.org/x/crypto@v0.37.0
pkg:golang/golang.org/x/exp@v0.0.0-20241004190924-225e2abe05e6
pkg:golang/golang.org/x/mod@v0.24.0
pkg:golang/golang.org/x/net@v0.39.0
pkg:golang/golang.org/x/oauth2@v0.29.0
pkg:golang/golang.org/x/sync@v0.13.0
pkg:golang/golang.org/x/sys@v0.32.0
pkg:golang/golang.org/x/term@v0.31.0
pkg:golang/golang.org/x/text@v0.24.0
pkg:golang/golang.org/x/time@v0.11.0
pkg:golang/golang.org/x/tools@v0.32.0
pkg:golang/google.golang.org/api@v0.230.0
pkg:golang/google.golang.org/genproto@v0.0.0-20250303144028-a0af3efb3deb
pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20250414145226-207652e42e2e
pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250414145226-207652e42e2e
pkg:golang/google.golang.org/grpc@v1.72.0
pkg:golang/google.golang.org/protobuf@v1.36.6
pkg:golang/gopkg.in/yaml.v3@v3.0.1
```

notice how it includes test libraries like evergreen or mocks, now compare with the result of a proper sbom for the actual ship binary (`go version -m $(which atlas)`)
```
 	path	github.com/mongodb/mongodb-atlas-cli/atlascli/cmd/atlas
	mod	github.com/mongodb/mongodb-atlas-cli/atlascli	v1.22.1-0.20250429142005-9e9e3808a11c+dirty	
	dep	cloud.google.com/go/auth	v0.16.0	h1:Pd8P1s9WkcrBE2n/PhAwKsdrR35V3Sg2II9B+ndM3CU=
	dep	cloud.google.com/go/auth/oauth2adapt	v0.2.8	h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
	dep	cloud.google.com/go/compute/metadata	v0.6.0	h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
	dep	cloud.google.com/go/iam	v1.5.0	h1:QlLcVMhbLGOjRcGe6VTGGTyQib8dRLK2B/kYNV0+2xs=
	dep	cloud.google.com/go/kms	v1.21.2	h1:c/PRUSMNQ8zXrc1sdAUnsenWWaNXN+PzTXfXOcSFdoE=
	dep	cloud.google.com/go/longrunning	v0.6.6	h1:XJNDo5MUfMM05xK3ewpbSdmt7R2Zw+aQEMbdQR65Rbw=
	dep	github.com/AlecAivazis/survey/v2	v2.3.7	h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
	dep	github.com/Azure/azure-sdk-for-go/sdk/azcore	v1.18.0	h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
	dep	github.com/Azure/azure-sdk-for-go/sdk/azidentity	v1.9.0	h1:OVoM452qUFBrX+URdH3VpR299ma4kfom0yB0URYky9g=
	dep	github.com/Azure/azure-sdk-for-go/sdk/internal	v1.11.1	h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4=
	dep	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys	v1.3.1	h1:Wgf5rZba3YZqeTNJPtvqZoBu1sBN/L4sry+u2U3Y75w=
	dep	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal	v1.1.1	h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI=
	dep	github.com/AzureAD/microsoft-authentication-library-for-go	v1.4.2	h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
	dep	github.com/Masterminds/semver/v3	v3.3.1	h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
	dep	github.com/PaesslerAG/gval	v1.0.0	h1:GEKnRwkWDdf9dOmKcNrar9EA1bz1z9DqPIO1+iLzhd8=
	dep	github.com/PaesslerAG/jsonpath	v0.1.1	h1:c1/AToHQMVsduPAa4Vh6xp2U0evy4t8SWp8imEsylIk=
	dep	github.com/ProtonMail/go-crypto	v1.2.0	h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
	dep	github.com/STARRY-S/zip	v0.2.1	h1:pWBd4tuSGm3wtpoqRZZ2EAwOmcHK6XFf7bU9qcJXyFg=
	dep	github.com/andybalholm/brotli	v1.1.1	h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
	dep	github.com/aws/aws-sdk-go-v2	v1.36.3	h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
	dep	github.com/aws/aws-sdk-go-v2/config	v1.29.14	h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
	dep	github.com/aws/aws-sdk-go-v2/credentials	v1.17.67	h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
	dep	github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.16.30	h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
	dep	github.com/aws/aws-sdk-go-v2/internal/configsources	v1.3.34	h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
	dep	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.6.34	h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
	dep	github.com/aws/aws-sdk-go-v2/internal/ini	v1.8.3	h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
	dep	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.12.3	h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
	dep	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.12.15	h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
	dep	github.com/aws/aws-sdk-go-v2/service/kms	v1.38.3	h1:RivOtUH3eEu6SWnUMFHKAW4MqDOzWn1vGQ3S38Y5QMg=
	dep	github.com/aws/aws-sdk-go-v2/service/sso	v1.25.3	h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
	dep	github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.30.1	h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
	dep	github.com/aws/aws-sdk-go-v2/service/sts	v1.33.19	h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
	dep	github.com/aws/smithy-go	v1.22.2	h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
	dep	github.com/bodgit/plumbing	v1.3.0	h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
	dep	github.com/bodgit/sevenzip	v1.6.0	h1:a4R0Wu6/P1o1pP/3VV++aEOcyeBxeO/xE2Y9NSTrr6A=
	dep	github.com/bodgit/windows	v1.0.1	h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
	dep	github.com/briandowns/spinner	v1.23.2	h1:Zc6ecUnI+YzLmJniCfDNaMbW0Wid1d5+qcTq4L2FW8w=
	dep	github.com/cloudflare/circl	v1.6.0	h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
	dep	github.com/denisbrodbeck/machineid	v1.0.1	h1:geKr9qtkB876mXguW2X6TU4ZynleN6ezuMSRhl4D7AQ=
	dep	github.com/dsnet/compress	v0.0.2-0.20230904184137-39efe44ab707	h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
	dep	github.com/ebitengine/purego	v0.8.2	h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
	dep	github.com/fatih/color	v1.14.1	h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
	dep	github.com/felixge/httpsnoop	v1.0.4	h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
	dep	github.com/fsnotify/fsnotify	v1.8.0	h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
	dep	github.com/go-logr/logr	v1.4.2	h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
	dep	github.com/go-logr/stdr	v1.2.2	h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
	dep	github.com/go-viper/mapstructure/v2	v2.2.1	h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
	dep	github.com/golang-jwt/jwt/v5	v5.2.2	h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
	dep	github.com/golang/snappy	v0.0.4	h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
	dep	github.com/google/go-github/v61	v61.0.0	h1:VwQCBwhyE9JclCI+22/7mLB1PuU9eowCXKY5pNlu1go=
	dep	github.com/google/go-querystring	v1.1.0	h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
	dep	github.com/google/s2a-go	v0.1.9	h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
	dep	github.com/google/uuid	v1.6.0	h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
	dep	github.com/googleapis/enterprise-certificate-proxy	v0.3.6	h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
	dep	github.com/googleapis/gax-go/v2	v2.14.1	h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
	dep	github.com/hashicorp/errwrap	v1.1.0	h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
	dep	github.com/hashicorp/go-multierror	v1.1.1	h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
	dep	github.com/hashicorp/golang-lru/v2	v2.0.7	h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
	dep	github.com/iancoleman/strcase	v0.3.0	h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
	dep	github.com/kballard/go-shellquote	v0.0.0-20180428030007-95032a82bc51	h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
	dep	github.com/klauspost/compress	v1.18.0	h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
	dep	github.com/klauspost/pgzip	v1.2.6	h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
	dep	github.com/kylelemons/godebug	v1.1.0	h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
	dep	github.com/mattn/go-colorable	v0.1.13	h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
	dep	github.com/mattn/go-isatty	v0.0.20	h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
	dep	github.com/mgutz/ansi	v0.0.0-20170206155736-9520e82c474b	h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
	dep	github.com/mholt/archives	v0.1.1	h1:c7J3qXN1FB54y0qiUXiq9Bxk4eCUc8pdXWwOhZdRzeY=
	dep	github.com/minio/minlz	v1.0.0	h1:Kj7aJZ1//LlTP1DM8Jm7lNKvvJS2m74gyyXXn3+uJWQ=
	dep	github.com/mongodb-forks/digest	v1.1.0	h1:7eUdsR1BtqLv0mdNm4OXs6ddWvR4X2/OsLwdKksrOoc=
	dep	github.com/montanaflynn/stats	v0.7.1	h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
	dep	github.com/nwaples/rardecode/v2	v2.1.0	h1:JQl9ZoBPDy+nIZGb1mx8+anfHp/LV3NE2MjMiv0ct/U=
	dep	github.com/pelletier/go-toml	v1.9.5	h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
	dep	github.com/pelletier/go-toml/v2	v2.2.3	h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
	dep	github.com/pierrec/lz4/v4	v4.1.21	h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
	dep	github.com/pkg/browser	v0.0.0-20240102092130-5ac0b6a4141c	h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
	dep	github.com/sagikazarmark/locafero	v0.7.0	h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
	dep	github.com/shirou/gopsutil/v4	v4.25.3	h1:SeA68lsu8gLggyMbmCn8cmp97V1TI9ld9sVzAUcKcKE=
	dep	github.com/sorairolake/lzip-go	v0.3.5	h1:ms5Xri9o1JBIWvOFAorYtUNik6HI3HgBTkISiqu0Cwg=
	dep	github.com/sourcegraph/conc	v0.3.0	h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
	dep	github.com/spf13/afero	v1.14.0	h1:9tH6MapGnn/j0eb0yIXiLjERO8RB6xIVZRDCX7PtqWA=
	dep	github.com/spf13/cast	v1.7.1	h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
	dep	github.com/spf13/cobra	v1.9.1	h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
	dep	github.com/spf13/pflag	v1.0.6	h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
	dep	github.com/spf13/viper	v1.20.1	h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
	dep	github.com/subosito/gotenv	v1.6.0	h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
	dep	github.com/tangzero/inflector	v1.0.0	h1:933dvPwRUUOAl98hyeeXuzFix3HwDt5j+45lleu8oh0=
	dep	github.com/therootcompany/xz	v1.0.1	h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
	dep	github.com/tklauser/go-sysconf	v0.3.12	h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
	dep	github.com/ulikunitz/xz	v0.5.12	h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
	dep	github.com/xdg-go/pbkdf2	v1.0.0	h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
	dep	github.com/xdg-go/scram	v1.1.2	h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
	dep	github.com/xdg-go/stringprep	v1.0.4	h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
	dep	github.com/youmark/pkcs8	v0.0.0-20240726163527-a2c0da244d78	h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
	dep	go.mongodb.org/atlas	v0.38.0	h1:zfwymq20GqivGwxPZfypfUDry+WwMGVui97z1d8V4bU=
	dep	go.mongodb.org/atlas-sdk/v20240530005	v20240530005.0.0	h1:d/gbYJ+obR0EM/3DZf7+ZMi2QWISegm3mid7Or708cc=
	dep	go.mongodb.org/atlas-sdk/v20250312002	v20250312002.0.0	h1:KX8PrYp3/PCSxG4NbGLcc3+EsNcfyhcvylGbe/oRlx8=
	dep	go.mongodb.org/mongo-driver	v1.17.3	h1:TQyXhnsWfWtgAhMtOgtYHMTkZIfBTpMTsMnd9ZBeHxQ=
	dep	go.opentelemetry.io/auto/sdk	v1.1.0	h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
	dep	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.60.0	h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
	dep	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.60.0	h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
	dep	go.opentelemetry.io/otel	v1.35.0	h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
	dep	go.opentelemetry.io/otel/metric	v1.35.0	h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
	dep	go.opentelemetry.io/otel/trace	v1.35.0	h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
	dep	go.uber.org/mock	v0.5.2	h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
	dep	go4.org	v0.0.0-20230225012048-214862532bf5	h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
	dep	golang.org/x/crypto	v0.37.0	h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
	dep	golang.org/x/exp	v0.0.0-20241004190924-225e2abe05e6	h1:1wqE9dj9NpSm04INVsJhhEUzhuDVjbcyKH91sVyPATw=
	dep	golang.org/x/mod	v0.24.0	h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
	dep	golang.org/x/net	v0.39.0	h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
	dep	golang.org/x/oauth2	v0.29.0	h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
	dep	golang.org/x/sync	v0.13.0	h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
	dep	golang.org/x/sys	v0.32.0	h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
	dep	golang.org/x/term	v0.31.0	h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
	dep	golang.org/x/text	v0.24.0	h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
	dep	golang.org/x/time	v0.11.0	h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
	dep	google.golang.org/api	v0.230.0	h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM=
	dep	google.golang.org/genproto	v0.0.0-20250303144028-a0af3efb3deb	h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
	dep	google.golang.org/genproto/googleapis/api	v0.0.0-20250414145226-207652e42e2e	h1:UdXH7Kzbj+Vzastr5nVfccbmFsmYNygVLSPk1pEfDoY=
	dep	google.golang.org/genproto/googleapis/rpc	v0.0.0-20250414145226-207652e42e2e	h1:ztQaXfzEXTmCBvbtWYRhJxW+0iJcz2qXfd38/e9l7bA=
	dep	google.golang.org/grpc	v1.72.0	h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
	dep	google.golang.org/protobuf	v1.36.6	h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
	dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
```

no test libs in that sbom which is correct since those are not shipped

created_at: 2025-04-30T09:28:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: cveticm
body: In the scope we have as a goal to include SSDLC report as a part of release.
The rationale is that releases provide a convenient place to store the report and enable customers to access the report on release. And then up-to-date reports with augmented SBOMs can be provided to customers on request.
created_at: 2025-04-30T10:41:07Z
author_association: COLLABORATOR
diff_hunk: @@ -70,6 +70,40 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: shell.exec
path: build/ci/release.yml
user: login: cveticm
body: Thanks for pointing me to this doc! 
Removed this command and moved the script from it into generate-sbom.sh since the auth is only being used by the logic in this script anyway.
created_at: 2025-04-30T10:44:38Z
author_association: COLLABORATOR
diff_hunk: @@ -317,6 +351,19 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
+    commands:  
+      - func: "generate sbom"
+      - func: "write kondukto credentials"
+      - func: "run silkbomb"
+        vars:
+          CONTAINER_COMMAND: docker
+          CONTAINER_IMAGE: 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
+          CONTAINER_OPTIONS: --pull=always --platform="linux/amd64" --rm
+          CONTAINER_ENV_FILES: --env-file ${workdir}/kondukto_credentials.env
+          CONTAINER_VOLUMES: -v ${workdir}:/workdir
+          SILKBOMB_COMMAND: upload
+          SILKBOMB_ARGS: --sbom-in /workdir/src/github.com/mongodb/mongodb-atlas-cli/compliance/sbom.json --repo mongodb_mongodb-atlas-cli  --branch ${branch_name}
path: build/ci/release.yml
user: login: cveticm
body: Good point. Was following the [SIlkbomb CI code example](https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/docs/CONTINUOUS_INTEGRATION) which uses vars likely to keep the functions flexible for other uses. Arg values are now directly used in the command 👍 
created_at: 2025-04-30T10:47:01Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+echo "Generating PURLs..."
+cd "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli"
+
+go list -json -mod=mod all | jq -r '.Module // empty | "pkg:golang/" + .Path + "@" + .Version // empty' | sort -u  > purls.txt
path: build/package/generate-sbom.sh
user: login: cveticm
body: Good catch, thank you! Was hoping to use go.mod to avoid building a binary at this point but I see now that won't work. Adjusted logic to create a binary and create the purls list from this binary. 
created_at: 2025-04-30T10:48:50Z
author_association: COLLABORATOR
path: build/package/generate-sbom.sh
user: login: gssbzn
body: general design comment, can we commit the purl file and make it a CI check (GH or EVG no preference) that is kept up to date, this is similar to how other repos manage this file
created_at: 2025-04-30T12:22:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+# Authenticate Docker to AWS ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
+echo "Generating PURLs..."
+cd "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli"
+
+go build -C cmd/atlas -o tmp_binary
path: build/package/generate-sbom.sh
user: login: gssbzn
body: you can use `make build` git is already set up to ignore the files generated by that command, and that build process is hook to generate a similar binary to what we ship with go releaser
created_at: 2025-04-30T12:23:58Z
author_association: CONTRIBUTOR
path: build/package/generate-sbom.sh
user: login: gssbzn
body: check the library owners check which is kind of similar
created_at: 2025-04-30T12:25:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: gssbzn
body: I have questions about the utility of packaging it with the bin, I don't see any other binary doing it, AKO for example is commited to the repo and not shipped

Then if we really want to ship it then I wonder why not use https://goreleaser.com/customization/sbom/#usage
created_at: 2025-04-30T12:27:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: cveticm
body: @fmenezes any opinion on shifting approach of where we store the report?
created_at: 2025-04-30T13:28:52Z
author_association: COLLABORATOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: fmenezes
body: Just got off a call with @cveticm basically there are 3 approaches:

- Store on main/master (used by https://github.com/mongodb/mongodb-atlas-kubernetes)
- Store in the release package (used by ops manager)
- Store in github releases page (which it would be used by CLI/LocalDev)

The reason why we wanted to do on releases page was to make it same for CLI and Local Dev, also bear in mind our policy does not specify where to store these and most projects simply upload to S3.
created_at: 2025-04-30T14:39:33Z
author_association: COLLABORATOR
path: build/package/generate-sbom.sh
user: login: fmenezes
body: I would't go for this approach we would jump from 2 files storing dependency information (library_owners.json and go.mod) to 3 files (library_owners.json, go.mod and purls.txt).

I would prefer for the tooling to translate dependencies into purls and later json on the fly as needed.

I'm inclined to even remove library_owners.json, given only our team has code in atlasCLI since the kubernetes plugin extraction.
created_at: 2025-04-30T14:42:31Z
author_association: COLLABORATOR
path: build/package/generate-sbom.sh
user: login: gssbzn
body: I'm ok to remove lib owners (same reason) but I see value on purls being committed given shipped dependencies are not the same as the ones in go.mod and this raises awareness when adding new libs and the implications, this also comes with the comment that I'd like if purls are auto generated by the precommit hook, similar to mms 
created_at: 2025-04-30T15:23:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: gssbzn
body: >also bear in mind our policy does not specify where to store these

Yes and my initial point, there's no expectation to be proactive about these and only to make it available upon request 
created_at: 2025-04-30T15:24:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: gssbzn
body: >Store in the release package (used by ops manager)

Thanks for reminding me of this I downloaded OM to see where they are but since it's 2GB package I forgot to check 

in ops manager they are included in the notices folder, which in the CLI is the thirdparty notice folder
created_at: 2025-04-30T15:25:53Z
author_association: CONTRIBUTOR
path: build/package/generate-sbom.sh
user: login: cveticm
body: I have no strong opinion here. Having the purl file committed could definitely help with making dependencies more visible, but I see @fmenezes's point about not wanting to manage yet another file.

I can create a make command to generate purls from the binary and set up a GH action to check that it's up-to-date similar to how we do the docs check.

@fmenezes, any strong feelings about this idea?
created_at: 2025-05-01T08:37:26Z
author_association: COLLABORATOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: cveticm
body: I think putting the compliance report on the GitHub release page makes the most sense. It allows customers to grab the report easily before downloading any packages.
I also think that being proactive about making these reports available could reflect well on our SSDLC policy to customers. 

Let me know if either of you have strong objections
created_at: 2025-05-01T08:50:28Z
author_association: COLLABORATOR
path: build/package/generate-sbom.sh
user: login: fmenezes
body: sure that is fine, we can commit it but bear in mind the extra checks
created_at: 2025-05-01T09:14:34Z
author_association: COLLABORATOR
diff_hunk: @@ -55,6 +55,7 @@ archives:
       - LICENSE
       - LICENSING-NOTES.txt
       - third_party_notices/**/*
+      - compliance/**/*
path: build/package/.goreleaser.yml
user: login: fmenezes
body: Let's proceed with the releases page we might amend README/docs about it
created_at: 2025-05-01T10:58:20Z
author_association: COLLABORATOR
diff_hunk: @@ -317,6 +367,11 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
path: build/ci/release.yml
user: login: fmenezes
body: does it upload?
created_at: 2025-05-01T13:11:29Z
author_association: COLLABORATOR
diff_hunk: @@ -317,6 +367,11 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
path: build/ci/release.yml
user: login: fmenezes
body: ```suggestion
  - name: generate_sbom
```
created_at: 2025-05-01T13:11:48Z
author_association: COLLABORATOR
diff_hunk: @@ -70,6 +70,56 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - workdir
+        binary: make
+        args:
+          - gen-purls
path: build/ci/release.yml
user: login: fmenezes
body: I think we shouldn't do it anymore, we should make sure the file is fully updated
created_at: 2025-05-01T13:13:45Z
author_association: COLLABORATOR
diff_hunk: @@ -317,6 +367,11 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
path: build/ci/release.yml
user: login: cveticm
body: it uploads the sbom to kondukto.
created_at: 2025-05-01T13:13:54Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+# Authenticate Docker to AWS ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
+cd "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli"
path: build/package/generate-sbom.sh
user: login: fmenezes
body: I don't think we need this we can set working dir at evergreen function
created_at: 2025-05-01T13:15:30Z
author_association: COLLABORATOR
diff_hunk: @@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+export WORKDIR=${workdir:?}
+
+# Authenticate Docker to AWS ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
+cd "$WORKDIR/src/github.com/mongodb/mongodb-atlas-cli"
+mkdir ./compliance
path: build/package/generate-sbom.sh
user: login: fmenezes
body: nit: for empty folders you can commit a `complicance/.gitkeep` empty file to keep folder on source code
created_at: 2025-05-01T13:16:36Z
author_association: COLLABORATOR
diff_hunk: @@ -70,6 +70,56 @@ functions:
       params:
         <<: *go_options
         binary: build/package/generate-notices.sh
+  "generate sbom":  
+    - command: ec2.assume_role
+      params:
+        role_arn: ${ecr_role_arn}
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - workdir
+        binary: make
+        args:
+          - gen-purls
+    - command: subprocess.exec
+      params:
+        <<: *go_options
+        include_expansions_in_env:
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
+          - workdir
+        binary: build/package/generate-sbom.sh 
+  "write kondukto credentials": 
path: build/ci/release.yml
user: login: fmenezes
body: I think we should merge `"write kondukto credentials"` and `"run silkbomb"` and make sure to add a `rm kondukto_credentials.env` in the end
created_at: 2025-05-01T13:18:21Z
author_association: COLLABORATOR
diff_hunk: @@ -317,6 +367,11 @@ tasks:
           permissions: public-read
           content_type: ${content_type|application/octet-stream}
           display_name: unsigned
+  - name: generate_and_upload_sbom
path: build/ci/release.yml
user: login: fmenezes
body: nvm this is about uploading to kondukto
created_at: 2025-05-01T13:19:17Z
author_association: COLLABORATOR
diff_hunk: @@ -533,6 +533,21 @@ functions:
         binary: make
         args:
           - otel
+  "check purls":
path: build/ci/evergreen.yml
user: login: cveticm
body: Example of check failing if purls.txt is not up-to-date:
https://spruce.mongodb.com/task/mongodb_atlas_cli_master_code_health_check_purls_patch_36f21cd8defe25ad9c89cf4d1d09f424e62cff55_681485dc659ffc00070b41ef_25_05_02_08_44_17/logs?execution=0&logtype=all
created_at: 2025-05-02T08:48:10Z
author_association: COLLABORATOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
+	@echo "==> Generating purls"
+	GOOS=linux GOARCH=amd64 go build -trimpath -mod=readonly -o bin/atlas-linux ./cmd/atlas
path: Makefile
user: login: gssbzn
body: why hardcode to linux?
created_at: 2025-05-02T10:42:36Z
author_association: CONTRIBUTOR
path: build/ci/check-purls.sh
user: login: gssbzn
body: move to `/scripts`
created_at: 2025-05-02T10:44:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
path: Makefile
user: login: gssbzn
body: will hooking this to the pre commit be a separate task?
created_at: 2025-05-02T10:47:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
+	@echo "==> Generating purls"
+	GOOS=linux GOARCH=amd64 go build -trimpath -mod=readonly -o bin/atlas-linux ./cmd/atlas
+	go version -m ./bin/atlas-linux | \
+		awk '$$1 == "dep" || $$1 == "=>" { print "pkg:golang/" $$2 "@" $$3 }' | \
+		LC_ALL=C sort > build/package/purls.txt
+	rm bin/atlas-linux
path: Makefile
user: login: gssbzn
body: you don't need to rm, the folder is ignored and it doesn't hurt to keep them around
created_at: 2025-05-02T10:48:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
path: Makefile
user: login: cveticm
body: I didn't intended to since, as a part of CI, we do a check to see if purls.txt is up-to-date. Devs would have to manually run this command. My intent here was to give devs visual on changes to sbom because of their work.

I'm happy to include this command in pre commit. To verify @gssbzn, this would make the CI check is redundant, correct? 
created_at: 2025-05-02T11:01:19Z
author_association: COLLABORATOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
+	@echo "==> Generating purls"
+	GOOS=linux GOARCH=amd64 go build -trimpath -mod=readonly -o bin/atlas-linux ./cmd/atlas
path: Makefile
user: login: cveticm
body: there are some dependencies which are used only by some builds. For the moment, we will only generate purls for linux (in the interest of reducing this PRs scope) and will include generation for all builds, compiling them into one list which will be used for sbom generation in [CLOUDP-316920](https://jira.mongodb.org/browse/CLOUDP-316920)
created_at: 2025-05-02T11:03:52Z
author_association: COLLABORATOR
diff_hunk: @@ -149,6 +149,15 @@ gen-docs: gen-docs-metadata ## Generate docs for atlascli commands
 	@echo "==> Generating docs"
 	go run -ldflags "$(LINKER_FLAGS)" ./tools/cmd/docs
 
+.PHONY: gen-purls
+gen-purls: # Generate purls on linux os
path: Makefile
user: login: gssbzn
body: >this would make the CI check is redundant, correct?

No cause having the pre commit installed is opt-in, and you can also do `git commit --no-verify` so you still need to check the files is up to date on the CI

Also just inc ase, ideally this should only run if the go.mod is modified

created_at: 2025-05-02T11:06:07Z
author_association: CONTRIBUTOR
path: build/ci/check-purls.sh
user: login: cveticm
body: This script is only run as part of CI and other scripts live in this dir such as check-licenses.sh so IMO it makes more sense to keep this script within ./build/ci
created_at: 2025-05-02T12:11:43Z
author_association: COLLABORATOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-05-02T12:20:09Z
body: Coverage Report 📈
| Branch | Commit | Coverage |
|--------|--------|----------|
| CLOUDP-227276_ssdlc_phase_2 | 36f21cd8defe25ad9c89cf4d1d09f424e62cff55 | 37.1% |
| CLOUDP-315271_onboard_silkbomb_kundukto_to_ci | 3633dd40f9882bfd82db7e854396f1fe5b1c5c67 | 37.8% |
|        | Difference | .7% |

<!-- Sticky Pull Request Comment -->
author_association: CONTRIBUTOR