Support Ruby lockfile generation on Alpine image #2926
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: lshindelman <[email protected]>
lirshindalman
force-pushed
the
support_generate_ruby_lock_alpine
branch
from
cc9302d to
1555929
Compare
Collaborator
|
Is there a reason you didn't just add these to packages to the existing |
Contributor
Author
|
hi @malice00 thanks for the response and the merge. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This MR updates the cdxgen-alpine-ruby34 Docker image by adding the ruby-dev and build-base packages.
Motivation:
Previously, running bundle install or generating a Gemfile.lock inside the Alpine-based image would fail due to missing build tools and development headers. This prevented accurate dependency scanning for Ruby projects, especially when a Gemfile.lock is not present.
Changes:
Added ruby-dev and build-base to the Alpine image.
This enables proper compilation of native extensions required by gems like date, nio4r, and websocket-driver.
Allows cdxgen to scan Ruby projects and generate SBOMs reliably, even in projects without an existing lock file.
Impact:
Users can now run CDXGen on Ruby projects in the Alpine image without encountering build failures.
Ruby dependency resolution and SBOM generation are accurate and complete.
Minimal change to the existing image: only the required development packages are added.
Testing:
Verified bundle install runs successfully inside the updated image.
Generated SBOMs include all Ruby dependencies, including those that require native compilation.