pack on platform 0.9 should download legacy boms from buildpacks from /layers/sbom/launch

[natalieparellano]

Description

When using lifecycle 0.14.0+ and platform api 0.9, the legacy unstructured bom will no longer be included in the io.buildpacks.build.metadata label. Instead, it can be downloaded from the build container at /layers/sbom/launch.

[sambhav]

I believe this already works in pack v0.24.0. Do we want to close this issue?

[natalieparellano]

@samj1912 you are right - those files are going to come along with the /layers/sbom/launch directory that is already downloaded.

I do wonder what will happen when pack inspect --bom is run. Is it going to break if the label is not found? That might be worth verifying before closing this out.

[natalieparellano]

Confirmed that it doesn't break, it just returns null:

$  pack inspect test-launch-cache --bom
Warning: Using the '--bom' flag with 'pack inspect-image <image-name>' is deprecated. Users are encouraged to use 'pack sbom download <image-name>'.
{
  "remote": null,
  "local": null
}

I think this issue can be closed.