Re: [Buildroot] [RFC PATCH 0/5] Support SBOM in CycloneDX format

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Thomas², All,

On 2024-04-07 23:15 +0200, Thomas Petazzoni via buildroot spake thusly:
> On Thu,  4 Apr 2024 14:43:24 +0200
> Thomas Perale <thomas.perale@essensium.com> wrote:
> 
> > This RFC patch series propose to add support for the CycloneDX
> > SBOM format.
> > 
> > There is a growing need to generate SBOM from buildroot
> > configurations. Right now, there are different solutions available
> > for buildroot users `show-info`, `legal-info` and `pkg-stats`.
> > They all generate similar information (`show-info` showing more) but
> > in a format that is specific to buildroot.
> 
> Thanks a lot for your work on this, this is really useful.
> 
> My initial reaction is whether it is really the right solution to have
> "make" spit out the CycloneDX format, or whether we should use "make
> show-info", and then process the JSON output using some Python script
> to generate the CycloneDX SBoM. Some of the mangling needed to generate
> the CycloneDX stuff is a bit tricky to write in make, and having a
> utility Python script doing that work based on a JSON input would I
> believe be simpler and easier to extend. Have you explored this idea?
> 
> Of course, if "make show-info" doesn't provide enough information in
> the generated JSON blurb, we can always extend that with more
> information.

This was also my reaction: when I introduced show-info, the goal was to
expose details about the current configuration, so that it could be
digested by various scripts to generate the required SBOM formats.

I would prefer that we do get a support/script/cyclonedx script (python
or whatever) that gets show-info output and generates CycloneDX SBOM.

> > This is a first sketch and I hope to gather comments on functionality
> > the community want me to include. I already have a todo list of feature
> > I plan to work on:
> > 
> > - [ ] Find a solution to handle versioning. The "version" property
> >       should be incremented every SBOM generation.
> 
> Perhaps easier to handle this with the Python script approach proposed
> above.

Also I don't see how that versioning works.

If it gets incremented everytime the SBOM is generated, then (with the
current state of this series):

    git clone blablabla/buildroot
    make -C buildroot foo_defconfig
    make -C buildroot cyclonedx
    make -C buildroot cyclonedx

would yield two different versions, although nothing changed in-between.

Also:

    git clone blablabla/buildroot
    make -C buildroot foo_defconfig
    make -C buildroot
    make -C buildroot cyclonedx
    rm -rf buildroot
    git clone blablabla/buildroot
    make -C buildroot foo_defconfig
    make -C buildroot
    make -C buildroot cyclonedx

would have to yield two different versions, but where would the "latest"
version be stored? Certainly not in the user's home directory.

And arguably, if two different people build the cyclonedx SBOM for the
same project, on two different machines (with an otherwise identical
environment), at different time, then how do they know the version used
by the other? This also applies to "two CI pipelines" instead of "two
users".

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot