From cee1b0c6685068b26a1e2fda0f0600d4c7886c38 Mon Sep 17 00:00:00 2001 From: castrojo Date: Tue, 8 Sep 2026 14:28:09 +0000 Subject: [PATCH] fix(sbom): add Bluefin LTS NVIDIA stream and retire dx/gdx package queries The bluefin-dx and bluefin-gdx GHCR packages are retired and return 404s, but STREAM_SPECS in fetch-github-sbom.js still had eight stream entries querying them. Meanwhile fetch-github-images.js and fetch-github-driver-versions.js already expected a bluefin-lts-nvidia SBOM stream (nvidiaSbomStreamId / buildNvidiaMapFromSbomStream lookups), which STREAM_SPECS never defined, so the LTS NVIDIA driver version had no SBOM source. Replace the eight retired bluefin-dx*/bluefin-gdx* stream entries with a single bluefin-lts-nvidia entry pointed at the active ghcr.io/projectbluefin/bluefin-lts-nvidia package's :stable tag (confirmed live on GHCR and via bluefin-lts's execute-release.yml promotion workflow, which promotes both bluefin-lts and bluefin-lts-nvidia from testing to stable). Signed-off-by: castrojo --- scripts/fetch-github-sbom.js | 73 +++--------------------------------- 1 file changed, 5 insertions(+), 68 deletions(-) diff --git a/scripts/fetch-github-sbom.js b/scripts/fetch-github-sbom.js index 85550190..e457e42a 100644 --- a/scripts/fetch-github-sbom.js +++ b/scripts/fetch-github-sbom.js @@ -32,7 +32,7 @@ * parsed for RPM artifacts to extract packageVersions. * - SBOM cache: keyed by image digest — if the digest hasn't changed AND * packageVersions is non-null, the existing cache entry is reused. - * - NVIDIA: present in GDX (bluefin-gdx-lts) SBOM as nvidia-driver RPM. + * - NVIDIA: present in bluefin-lts-nvidia SBOM as nvidia-driver RPM. * Absent from base bluefin-stable/lts SBOMs (akmod, built separately). * fetch-github-driver-versions.js uses null for nvidia on stable/lts streams. * - Atomic write: output is written to a temp file then renamed to avoid @@ -203,77 +203,14 @@ const RAW_STREAM_SPECS = [ keyRepo: "projectbluefin/bluefin-lts", }, { - id: "bluefin-dx-stable", - label: "Bluefin DX Stable", + id: "bluefin-lts-nvidia", + label: "Bluefin LTS Nvidia", org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "stable", - keyRepo: "projectbluefin/bluefin", - }, - { - id: "bluefin-dx-latest", - label: "Bluefin DX Latest", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "latest", - keyRepo: "projectbluefin/bluefin", - }, - { - id: "bluefin-dx-lts", - label: "Bluefin DX LTS", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "lts", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-hwe-testing", - label: "Bluefin DX LTS HWE Testing", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "lts-hwe-testing", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-hwe-testing-50", - label: "Bluefin DX LTS HWE Testing 50", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "lts-hwe-testing-50", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-dx-lts-testing-50", - label: "Bluefin DX LTS Testing 50", - org: "projectbluefin", - package: "bluefin-dx", - releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "lts-testing-50", - keyRepo: "projectbluefin/bluefin-lts", - }, - { - id: "bluefin-gdx-lts", - label: "Bluefin GDX LTS", - org: "projectbluefin", - package: "bluefin-gdx", + package: "bluefin-lts-nvidia", releasesRepo: "projectbluefin/bluefin-lts", - streamPrefix: "lts", + streamPrefix: "stable", keyRepo: "projectbluefin/bluefin-lts", }, - { - id: "bluefin-gdx-latest", - label: "Bluefin GDX Latest", - org: "projectbluefin", - package: "bluefin-gdx", - releasesRepo: "projectbluefin/bluefin", - streamPrefix: "latest", - keyRepo: "projectbluefin/bluefin", - }, { id: "bluefin-nvidia-open-stable", label: "Bluefin Nvidia Open Stable",