Skip to content

Fix StartOS release SBOM generation - #6

Merged
keegreil merged 1 commit into
mainfrom
codex/publish-v0.2.2-beta.5
Sep 9, 2026
Merged

keegreil merged 1 commit into
mainfrom
codex/publish-v0.2.2-beta.5

Conversation

@keegreil

@keegreil keegreil commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • generate SPDX inventory from the tagged package source tree rather than asking Syft to parse the opaque S9PK archive
  • keep both architecture jobs running independently
  • increment the package revision to 0.2.2:4

The beta.4 workflow successfully constructed the arm64 package before Syft rejected the S9PK file format. This change keeps the SBOM meaningful and allows package checksums, provenance, and artifacts to complete.

@keegreil
keegreil merged commit bec3e23 into main Sep 9, 2026
2 checks passed
@keegreil
keegreil deleted the codex/publish-v0.2.2-beta.5 branch September 9, 2026 23:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant