Fix SBOM generation inconsistency, take 2

[damdo]

Builds on top of #65

Fixes #64
by adopting approach 1.

Seems to be working well for all the commands I tested: sbom, update, overwrite (full,gaf).

Testing:

$ make gaf 2>&1 >/dev/null
$ unzip -p /tmp/disk.gaf sbom.json | jq -r '.sbom_hash'
23c08ae3b4c009e179f46fe8e812617771c39d1540042d79c11848015dec86b9

$ make sbom | jq -r '.sbom_hash'
23c08ae3b4c009e179f46fe8e812617771c39d1540042d79c11848015dec86b9

$ make overwrite 2>&1 >/dev/null # creates a full.img
$ make test & # launches a qemu test machine from the full.img at (192.168.64.2)
$ curl -sL -H 'Accept: application/json' "http://gokrazy:[email protected]/" | jq -r '.SBOMHash'
23c08ae3b4c009e179f46fe8e812617771c39d1540042d79c11848015dec86b9

$ make update
$ curl -sL -H 'Accept: application/json' "http://gokrazy:[email protected]/" | jq -r '.SBOMHash'
23c08ae3b4c009e179f46fe8e812617771c39d1540042d79c11848015dec86b9

$ vim config.json
$ git diff config.json
+++ b/config.json
@@ -7,7 +7,8 @@
     },
     "Packages": [
         "github.com/gokrazy/serial-busybox",
-        "github.com/gokrazy/breakglass"
+        "github.com/gokrazy/breakglass",
+        "github.com/gokrazy/hello"

$ make sbom | jq -r '.sbom_hash'
1ab7db66f5b0a0d3253d3e104c0b375e7ae4af7449bae635c7554e0b0b596e21

$ make update
$ curl -sL -H 'Accept: application/json' "http://gokrazy:[email protected]/" | jq -r '.SBOMHash'
1ab7db66f5b0a0d3253d3e104c0b375e7ae4af7449bae635c7554e0b0b596e21

[stapelberg]

Looks good overall!

[stapelberg]

This breaks tests, though. Can you take a look please?

[damdo]

Yes I was just looking at it.
It throws:

gokrpacker_test.go:107: [overwrite --root=root.squashfs --boot=boot.fat]: open /tmp/TestGokrPacker3940063376/001/hello/builddir/github.com/gokrazy/gokrazy/go.mod: no such file or directory

[damdo]

@stapelberg The issue was caused by the fact that GenerateSBOM() looks for go.mod files in builddir, which are not populated early in the gok processing for newly created instances.

Thus I changed it slighly by holding an untouched copy of the config file in the pack struct and use that as a reference to GenerateSBOM() later when it is needed.