GoogleContainerTools · loosebazooka · Sep 20, 2024 · Sep 20, 2024
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
diff --git a/private/pkg/test/oci_image/fat_image_sbom.spdx.json b/private/pkg/test/oci_image/fat_image_sbom.spdx.json
@@ -1 +1 @@
-{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"//private/pkg/test/oci_image:fat_image","documentNamespace":"http://spdx.org/spdxdocs/distroless/-slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","creationInfo":{"licenseListVersion":"NOASSERTION","creators":["Organization: distroless"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"//private/pkg/test/oci_image:fat_image","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"//private/pkg/test/oci_image:image_arm64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"base-files","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-base-files-underscore-12.4-p-deb12u7-underscore-arm64","versionInfo":"12.4+deb12u7","supplier":"Person: Santiago Vila \\\\[email protected]\\\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20240903T204216Z/pool/main/b/base-files/base-files_12.4+deb12u7_arm64.deb","checksums":[{"algorithm":"SHA256","checksumValue":"8af41973316565d7a7372f2307d8e4a1254d495fbe1260271b93e0ea8af38efc"}],"copyrightText":"This is the Debian prepackaged version of the Debian Base System\nMiscellaneous files. These files were written by Ian Murdock\n\[email protected]\u003e and Bruce Perens \[email protected]\u003e.\n\nThis package was first put together by Bruce Perens \[email protected]\u003e,\nfrom his own sources.\n\nThe GNU Public Licenses in /usr/share/common-licenses were taken from\nftp.gnu.org and are copyrighted by the Free Software Foundation, Inc.\n\nThe Artistic License in /usr/share/common-licenses is the one coming\nfrom Perl and its SPDX name is \"Artistic License 1.0 (Perl)\".\n\n\nCopyright (C) 1995-2011 Software in the Public Interest.\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nOn Debian systems, the complete text of the GNU General\nPublic License can be found in `/usr/share/common-licenses/GPL'.\n","summary":"Debian base system miscellaneous files","description":"Debian base system miscellaneous files\nThis package contains the basic filesystem hierarchy of a Debian system, and\nseveral important miscellaneous files, such as /etc/debian_version,\n/etc/host.conf, /etc/issue, /etc/motd, /etc/profile, and others,\nand the text of several common licenses in use on Debian systems.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/[email protected]+deb12u7?arch=arm64"}]},{"name":"@bookworm//base-files/arm64:spdx","SPDXID":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from [email protected]+deb12u7"},{"name":"//private/pkg/test/oci_image:image_amd64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"netbase","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","versionInfo":"6.4","supplier":"Person: Marco d'Itri \\\\[email protected]\\\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20240903T204216Z/pool/main/n/netbase/netbase_6.4_all.deb","checksums":[{"algorithm":"SHA256","checksumValue":"29b23c48c0fe6f878e56c5ddc9f65d1c05d729360f3690a593a8c795031cd867"}],"copyrightText":"Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/\nComment:\n This package was created by Peter Tobias [email protected] on\n Wed, 24 Aug 1994 21:33:28 +0200 and maintained by Anthony Towns\n \[email protected]\u003e until 2001.\n It is currently maintained by Marco d'Itri \[email protected]\u003e.\n\nFiles: *\nCopyright:\n Copyright (c) 1994-1998 Peter Tobias\n Copyright (c) 1998-2001 Anthony Towns\n Copyright (c) 2002-2022 Marco d'Itri\nLicense: GPL-2\n This program is free software; you can redistribute it and/or modify\n it under the terms of the GNU General Public License, version 2, as\n published by the Free Software Foundation.\n .\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n GNU General Public License for more details.\n .\n You should have received a copy of the GNU General Public License along\n with this program; if not, write to the Free Software Foundation,\n Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.\n .\n On Debian systems, the complete text of the GNU General Public License\n version 2 can be found in '/usr/share/common-licenses/GPL-2'.\n","summary":"Basic TCP/IP networking system","description":"Basic TCP/IP networking system\nThis package provides the necessary infrastructure for basic TCP/IP based\nnetworking.\n.\nIn particular, it supplies common name-to-number mappings in /etc/services,\n/etc/rpc, /etc/protocols and /etc/ethertypes.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/[email protected]?arch=all"}]},{"name":"@bookworm//netbase/amd64:spdx","SPDXID":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from [email protected]"}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relationshipType":"DESCRIBES"},{"spdxElementId":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-base-files-underscore-12.4-p-deb12u7-underscore-arm64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","relatedSpdxElement":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","relationshipType":"DEPENDS_ON"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","relationshipType":"CONTAINS"},{"spdxElementId":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relatedSpdxElement":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relationshipType":"DEPENDS_ON"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relationshipType":"CONTAINS"}]}
+{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"//private/pkg/test/oci_image:fat_image","documentNamespace":"http://spdx.org/spdxdocs/distroless/-slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","creationInfo":{"licenseListVersion":"NOASSERTION","creators":["Organization: distroless"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"//private/pkg/test/oci_image:fat_image","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"//private/pkg/test/oci_image:image_arm64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"base-files","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-base-files-underscore-12.4-p-deb12u7-underscore-arm64","versionInfo":"12.4+deb12u7","supplier":"Person: Santiago Vila \\\\[email protected]\\\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20240919T203314Z/pool/main/b/base-files/base-files_12.4+deb12u7_arm64.deb","checksums":[{"algorithm":"SHA256","checksumValue":"8af41973316565d7a7372f2307d8e4a1254d495fbe1260271b93e0ea8af38efc"}],"copyrightText":"This is the Debian prepackaged version of the Debian Base System\nMiscellaneous files. These files were written by Ian Murdock\n\[email protected]\u003e and Bruce Perens \[email protected]\u003e.\n\nThis package was first put together by Bruce Perens \[email protected]\u003e,\nfrom his own sources.\n\nThe GNU Public Licenses in /usr/share/common-licenses were taken from\nftp.gnu.org and are copyrighted by the Free Software Foundation, Inc.\n\nThe Artistic License in /usr/share/common-licenses is the one coming\nfrom Perl and its SPDX name is \"Artistic License 1.0 (Perl)\".\n\n\nCopyright (C) 1995-2011 Software in the Public Interest.\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nOn Debian systems, the complete text of the GNU General\nPublic License can be found in `/usr/share/common-licenses/GPL'.\n","summary":"Debian base system miscellaneous files","description":"Debian base system miscellaneous files\nThis package contains the basic filesystem hierarchy of a Debian system, and\nseveral important miscellaneous files, such as /etc/debian_version,\n/etc/host.conf, /etc/issue, /etc/motd, /etc/profile, and others,\nand the text of several common licenses in use on Debian systems.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/[email protected]+deb12u7?arch=arm64"}]},{"name":"@bookworm//base-files/arm64:spdx","SPDXID":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from [email protected]+deb12u7"},{"name":"//private/pkg/test/oci_image:image_amd64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"netbase","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","versionInfo":"6.4","supplier":"Person: Marco d'Itri \\\\[email protected]\\\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20240919T203314Z/pool/main/n/netbase/netbase_6.4_all.deb","checksums":[{"algorithm":"SHA256","checksumValue":"29b23c48c0fe6f878e56c5ddc9f65d1c05d729360f3690a593a8c795031cd867"}],"copyrightText":"Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/\nComment:\n This package was created by Peter Tobias [email protected] on\n Wed, 24 Aug 1994 21:33:28 +0200 and maintained by Anthony Towns\n \[email protected]\u003e until 2001.\n It is currently maintained by Marco d'Itri \[email protected]\u003e.\n\nFiles: *\nCopyright:\n Copyright (c) 1994-1998 Peter Tobias\n Copyright (c) 1998-2001 Anthony Towns\n Copyright (c) 2002-2022 Marco d'Itri\nLicense: GPL-2\n This program is free software; you can redistribute it and/or modify\n it under the terms of the GNU General Public License, version 2, as\n published by the Free Software Foundation.\n .\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n GNU General Public License for more details.\n .\n You should have received a copy of the GNU General Public License along\n with this program; if not, write to the Free Software Foundation,\n Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.\n .\n On Debian systems, the complete text of the GNU General Public License\n version 2 can be found in '/usr/share/common-licenses/GPL-2'.\n","summary":"Basic TCP/IP networking system","description":"Basic TCP/IP networking system\nThis package provides the necessary infrastructure for basic TCP/IP based\nnetworking.\n.\nIn particular, it supplies common name-to-number mappings in /etc/services,\n/etc/rpc, /etc/protocols and /etc/ethertypes.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/[email protected]?arch=all"}]},{"name":"@bookworm//netbase/amd64:spdx","SPDXID":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from [email protected]"}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relationshipType":"DESCRIBES"},{"spdxElementId":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-base-files-underscore-12.4-p-deb12u7-underscore-arm64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","relatedSpdxElement":"SPDXRef--at-bookworm-slash--slash-base-files-slash-arm64-colon-spdx","relationshipType":"DEPENDS_ON"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-arm64","relationshipType":"CONTAINS"},{"spdxElementId":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relatedSpdxElement":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relationshipType":"DEPENDS_ON"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-fat-underscore-image","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relationshipType":"CONTAINS"}]}