PCSM-282: Adding PCSM package, tarball, and docker image SBOM tests

[keithquinnpercona]

No description provided.

[Copilot]

Pull request overview

This PR adds SBOM-focused validation for the Percona ClusterSync MongoDB (PCSM) deliverables across package installs, tarball artifacts, and published container images, and updates provisioning/molecule scenarios to ensure required tooling (Trivy + CycloneDX CLI) is present.

Changes:

• Add a tarball test to verify expected files/binaries exist and that the shipped CycloneDX SBOM validates and is vulnerability-scanned.
• Add package-level SBOM verification in the existing PCSM testinfra suite (rpm/deb), including Trivy + CycloneDX validation.
• Add Docker image SBOM checks for both embedded SBOM files and OCI-attached SBOM referrers; adjust molecule scenarios to use the Docker/Podman converge playbooks.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
tarball_checks/test_pcsm_tarball.py	New test to download/extract PCSM tarball, verify contents, scan/validate SBOM.
docker-sbom-check/test_pcsm_docker_sbom.py	New tests to validate embedded SBOM and OCI-attached SBOM for the PCSM image.
pcsm/tests/test_pcsm.py	Adds package-installed SBOM presence + Trivy + CycloneDX validation.
pcsm/install/playbooks/ubuntu.yml	Installs Trivy + CycloneDX CLI; Docker daemon tweak + Docker restart for runc workaround.
pcsm/install/playbooks/debian.yml	Installs Trivy + CycloneDX CLI; Docker daemon tweak + Docker restart for runc workaround.
pcsm/install/playbooks/redhat_docker.yml	Installs Trivy + CycloneDX CLI; Docker daemon tweak + Docker restart for runc workaround; PCSM yum version pattern update.
pcsm/install/playbooks/redhat_podman.yml	Installs Trivy + CycloneDX CLI; PCSM yum version pattern update for podman-based converge.
pcsm/install/molecule/rocky9/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rocky9-arm/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rocky8/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rocky8-arm/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rhel9/molecule.yml	Switch converge playbook to redhat_podman.yml.
pcsm/install/molecule/rhel9-arm/molecule.yml	Switch converge playbook to redhat_podman.yml.
pcsm/install/molecule/rhel8/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rhel8-arm/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/rhel10/molecule.yml	Switch converge playbook to redhat_podman.yml.
pcsm/install/molecule/rhel10-arm/molecule.yml	Switch converge playbook to redhat_podman.yml.
pcsm/install/molecule/al2023/molecule.yml	Switch converge playbook to redhat_docker.yml.
pcsm/install/molecule/al2023-arm/molecule.yml	Switch converge playbook to redhat_docker.yml.

Comments suppressed due to low confidence (6)

pcsm/install/playbooks/redhat_docker.yml:70

• Installing Trivy by piping a remote script from the main branch (curl ... | sh) is non-reproducible and creates a supply-chain risk for the provisioning step. Prefer installing a pinned Trivy version from the official package repository (yum/dnf) or pin the install script by commit and verify checksum/signature.
  pcsm/install/playbooks/redhat_docker.yml:76
• Downloading CycloneDX CLI from the releases/latest URL is non-deterministic and can break CI when an upstream release changes. Consider pinning an explicit CycloneDX CLI version and (ideally) providing a checksum for the downloaded binary.
  pcsm/install/playbooks/redhat_docker.yml:98
• This task overwrites /etc/docker/daemon.json completely, which can clobber any existing Docker daemon configuration (registry mirrors, log drivers, etc.). If you only need to disable features.time-namespaces, prefer merging that key into the existing JSON instead of replacing the whole file.
  pcsm/install/playbooks/redhat_docker.yml:131
• Docker is restarted unconditionally here. This adds avoidable disruption and time to provisioning when neither daemon.json nor the runc binary changed. Consider restarting only when the preceding configuration/binary tasks report changed (or use a handler notified by those tasks).
  pcsm/install/playbooks/redhat_podman.yml:39
• Installing Trivy by piping a remote script from the main branch (curl ... | sh) is non-reproducible and creates a supply-chain risk for the provisioning step. Prefer installing a pinned Trivy version from the official package repository (yum/dnf) or pin the install script by commit and verify checksum/signature.
  pcsm/install/playbooks/redhat_podman.yml:45
• Downloading CycloneDX CLI from the releases/latest URL is non-deterministic and can break CI when an upstream release changes. Consider pinning an explicit CycloneDX CLI version and (ideally) providing a checksum for the downloaded binary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.