Added inline SBOM for binaries downloaded outside package manager

.gitignore

@@ -1 +1,2 @@
 .jq-template.awk
+template-helper-functions.jq

Dockerfile-cli.template

@@ -1,5 +1,6 @@
 {{ include "shared" -}}
-FROM alpine:3.18
+{{ include "template-helper-functions" }}
+FROM alpine:{{ .alpine }}
 
 RUN apk add --no-cache \
 		ca-certificates \
@@ -34,7 +35,21 @@ RUN set -eux; \
 	; \
 	rm docker.tgz; \
 	\
-	docker --version
+	docker --version; \
+	\
+	echo '{{
+		{
+			name: "docker",
+			version: .version,
+			params: {
+				os_name: "alpine",
+				os_version: .alpine
+			},
+			licenses: [
+				"Apache-2.0"
+			]
+		} | sbom | tostring
+	}}' > /usr/local/bin/docker.spdx.json ;
 {{
 	{
 		buildx: .buildx,
@@ -65,6 +80,20 @@ RUN set -eux; \
 {{ if $key == "compose" then ( -}}
 	ln -sv "$plugin" /usr/local/bin/; \
 	docker-{{ $key }} --version; \
+	\
+	echo '{{
+		{
+			name: ("docker-" + $key),
+			version: .version,
+			params: {
+				os_name: "alpine",
+				os_version: "3.18"
+			},
+			licenses: [
+				"Apache-2.0"
+			]
+		} | sbom | tostring
+	}}' > /usr/local/bin/docker-{{ $key }}.spdx.json ; \
 {{ ) else "" end -}}
 	docker {{ $key }} version
 {{

apply-templates.sh

@@ -11,6 +11,11 @@ elif [ "$BASH_SOURCE" -nt "$jqt" ]; then
 	wget -qO "$jqt" 'https://github.com/docker-library/bashbrew/raw/9f6a35772ac863a0241f147c820354e4008edf38/scripts/jq-template.awk'
 fi
 
+jqf='template-helper-functions.jq'
+if [ "$BASH_SOURCE" -nt "$jqf" ]; then
+	wget -qO "$jqf" 'https://github.com/docker-library/bashbrew/raw/master/scripts/template-helper-functions.jq'
+fi
+
 if [ "$#" -eq 0 ]; then
 	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
 	eval "set -- $versions"

versions.json

@@ -1,5 +1,6 @@
 {
   "24": {
+    "alpine": "3.18",
     "arches": {
       "amd64": {
         "dockerUrl": "https://download.docker.com/linux/static/stable/x86_64/docker-24.0.6.tgz",

versions.sh

@@ -14,6 +14,8 @@ declare -A dockerArches=(
 
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
+defaultAlpine='3.18'
+
 versions=( "$@" )
 if [ ${#versions[@]} -eq 0 ]; then
 	versions=( */ )
@@ -203,9 +205,11 @@ for version in "${versions[@]}"; do
 	echo "$version: $fullVersion (buildx $buildxVersion, compose $composeVersion)"
 
 	export fullVersion dindLatest
+	export defaultAlpine
 	doc="$(
 		jq -nc --argjson buildx "$buildx" --argjson compose "$compose" '{
 			version: env.fullVersion,
+			alpine: env.defaultAlpine,
 			arches: {},
 			dindCommit: env.dindLatest,
 			buildx: $buildx,