From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Mon, 11 Sep 2023 15:11:44 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qfghd-00BWsD-Jw for lore@lore.pengutronix.de; Mon, 11 Sep 2023 15:11:44 +0200 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1qfghc-0000mA-5o; Mon, 11 Sep 2023 15:11:44 +0200 Received: from mail-fr2deu01on2042.outbound.protection.outlook.com ([40.107.135.42] helo=DEU01-FR2-obe.outbound.protection.outlook.com) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qfghC-0000ld-2D; Mon, 11 Sep 2023 15:11:18 +0200 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kZjt0iA/X40JA9pYtlQq9T7VL5Qo64oNIhKoTMhxUztagLff/mtpBcPZuD7vbagAx164VJHt1YzWD10X7YzRZ5g+bntBSsM21++F2El3UScKP+gOI7Dx9yV8fU/oJ2isJPx4wFMPfMg8gnphzihcoh4MkqoI7ZJFbmsX5ZqhZEKml5JpmYhn+N309VAPlUXQXVg3Tubdu96FnQXceAw5ZeUZxw5B3Iw+ty5hH1cFm57xzHyypPjWcLRmilyzpFRgz3qs/sK56CjbyIaly0VzbTPNkcFCtbOFf3crdPRK367XbNQKlSvEgwsccLWj8l7+VgPQSKeKXSScoiaijlJJZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2ZB5IhMtbU1zPc5mzFaTJdGflLosoTOieD9ZgjT1guU=; b=dRHhRq3s1JoWEfGJ+6ydorbSwNzlEfIZFcxDUwQNRctKhDrjR7PflHehKmOzijU7kAv0/+VGa0jOfd/sXqs2z4X8DpCEvrpO5oks/sNTr3NqivVpz3+KyzJUxXMkGNYPyp5s/ADp8zSlck4BAUYWoBdBAyB5Qf0PYDqcHUM0OUJYI9NAcdKo7+GPyDOPfQEziNnkBIvNk9mz5XBIin6jijZo7EkmeQtjT/Tt+KSsTA4eK5qCnDYliHPwb5ouL4JlH6n55zH5ybzhS6DbHkv8hPoU4IBmvuT8aKH37b4ZbpyF76DxEvYMkuCIxQ6/IuWGPe70ZdrWAdJqy8aw1if82Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=eckelmann.de; dmarc=pass action=none header.from=eckelmann.de; dkim=pass header.d=eckelmann.de; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=eckelmann.de; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2ZB5IhMtbU1zPc5mzFaTJdGflLosoTOieD9ZgjT1guU=; b=NA8SO0mOzeoMaB+szQWP6IcDYooD6yIhFaSYWG5YYtVFwvUXXkdVPEgL1KZsoszZcyqOtIZGmBNv7JHhbCDd+1D+VwB/tW1s10LMEhtibAx1hZWRSkaZhphtk6M3li9oWvngi1BNa2WL9UVAtcfBLVuKKTPAR2PKPvURvoVFyRs= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=eckelmann.de; Received: from BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:2e::7) by FR0P281MB3404.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:54::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6768.34; Mon, 11 Sep 2023 13:11:14 +0000 Received: from BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM ([fe80::1b43:5cc3:3a64:b2d9]) by BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM ([fe80::1b43:5cc3:3a64:b2d9%7]) with mapi id 15.20.6768.029; Mon, 11 Sep 2023 13:11:11 +0000 From: Gavin Schenk To: Michael Olbrich , Simon Falsig In-Reply-To: References: Date: Mon, 11 Sep 2023 15:11:09 +0200 Message-ID: <875y4g26tu.fsf@NB061.eckelmann.group> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: FR4P281CA0098.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:cb::15) To BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:2e::7) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BEZP281MB2997:EE_|FR0P281MB3404:EE_ X-MS-Office365-Filtering-Correlation-Id: 9ce47bbd-f04c-4588-2722-08dbb2c891c7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: VS+HdSliTSDFPanfPcxxfG6+rYo6KMvu3VZU0vJ0xvhs73RxNN1FZH/YLXGeMUnSzuHhDGz7UiUKee29ytOBU9rsLoRFxSoOhIvfZN1pwkgGW6SfMqbf2zwnzm0dEO+d58+AlK+fTZIpVDXanI+rLmdTYK1/vjX37LgGdHe7tsDt52YLhCBALviHIIx28BLKtEYEN8xL0X14qBGuvN3p+XjYh14QoPGLL7LvFffarhsEXl+fxEO75g2w9FglVJqWandZKrkNR6pc7ml0c+V77ZCWf6H7I6wHEIJglc9irgmXAzMexAx+aKSpPbl7ri2/3zDCMIXvepnpFJVvLHo3eq/ysnFTliHo1qI/VIrBaNCzV5J1M3xlc623tmgThXKQX5mUZRNiesmyiCKyZxKpfOQPugF0z8WjsTXnCB8+hxGvniwCknWSCrJSfycM1qXa35CcuTbdYq7PrsO37LTEqlF1sjSRSzbyNjWnnOMSktHCUJ2tSeppafXa1eLGOFuqRv/ohAMuydJuLqYmHvWbuzF8EvkTyzExH6XuSOgJWth+iPJ0S9nKKO15H5fId1UyncTnGx3K0YwvOCQ6fFKXeypeTddjaYVER89vanN1xSk= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(376002)(366004)(346002)(136003)(39850400004)(396003)(1800799009)(186009)(451199024)(6486002)(6506007)(6512007)(9686003)(966005)(478600001)(83380400001)(2906002)(54906003)(66476007)(66556008)(66946007)(110136005)(316002)(41300700001)(4326008)(8676002)(8936002)(86362001)(38100700002)(5660300002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VDJGRi9XWkhLdFFyaW1sbDZzVlpvcUorTnNGbm1tbFVEV3RTRUJ6c3FkRlVI?= =?utf-8?B?QkVsY2k2aWdKaHlRU1ZWWC94azJVb1Y4bUNCbUM0cUxIQVd0dTg5cFNVOWxr?= =?utf-8?B?NTFZc0xFYW9Uc2dkM3lqV0E2Rkx6dWs4dGxjdFQ5WDJ1dW4wanVsNVNLV1d3?= =?utf-8?B?L1I3OTN3bC9KTHhIOFBzNnZTWEw0dUxjQXVqOHNudVgweW8zUnc2a00vdUpG?= =?utf-8?B?c0pzK1lHeDZxd3Rha1ZBTzdFcW14Si9QTTd4em1YaXo5bGJzdzdMVzRxWklr?= =?utf-8?B?cWR6YklHb05nMC9rd0JnVHdKZWV6M0xzOTRlMWlEa094TTJIaWs0Vit1aUNE?= =?utf-8?B?Q1c3UzFkMXRkVEN4bVFDV2cyc205c01pQTRVR21wYjh6NmJmc1hsekdHTXJQ?= =?utf-8?B?dGdKRjVZYnY5SGgzMkh3L3RRMkhBbkx4bjYwVmdOUmc3cmFELzFacFNmSTB1?= =?utf-8?B?UnpZYUg3TWhrRjF1VVNMOFQwQnBMb2xkb2ZkOXRCaGxLK0ViM3BlWTZEcVVt?= =?utf-8?B?blJSVXFFM0R0anNiWUxNWEhWaFUwL2M1OFdqeENQWlhWdFFiRlBKQ2dOVUYz?= =?utf-8?B?M3RXNVN3b3lpdzVFTjZMMWF6ZjN4YUtPdnk0ZFpxem1aSDlKS0I2aFJ4MmhK?= =?utf-8?B?QVJaUGtrdkduVnJEaDk5dDU5Vk9JUmh5MGhYek51YmducnB4WnBhUUpuSFV5?= =?utf-8?B?UGE4MHpUTDREemJHWC9rZlp3ZUQxa1E0RS9qZ0FMZE52V2taYXcwaUZkRDAy?= =?utf-8?B?VWdXSnhCcSsxcGoyQ3N0RVozZUZIY1N3Z3M4NGJrYkJPbzVjUnFEQWFKcGda?= =?utf-8?B?eGl4NUJOaktIZXU4cWYzNWlQS00rOThaazBkNHZxMWxkWHVHbVV4VzZIRXVQ?= =?utf-8?B?NzMvS2VFZlJzY2swd3p2Ykt3cERkMDUrUmFaZTRDblM2ajdZS2xEZUJaT0Nl?= =?utf-8?B?aGlFY0s1Mmo0OHM4VXRuQXcvRW1YU0Uva3FpekFVNDNYOEg3WTNkS1lUSitZ?= =?utf-8?B?SGtKSnRlTUN3NmpsdENtTEFpa1NnbE1SVjg0cFJyaDMwMHkzYkxKeWcraGk2?= =?utf-8?B?c3BCdEd4OEFzSXphbmtsQ1B0YWZvaWdZVEdXbGphU1NFQnFiVmlHUXhqM1pU?= =?utf-8?B?S0wzSWd3SEFza0NybjBSZFJLNnZRVVMxY2txQ3h4Zm5QcnlOczE1WDVCVGZC?= =?utf-8?B?UDAvelB3a2xqaGhjY1puZ2ZmVVdjdllpQTAreHZuTEJjRk14S3JTM0JBcXdY?= =?utf-8?B?Y21kdkpHZkMrVGdXYVNOUjZaZm8vRzFGUisyNnp2WTEwME04R2RTcy9sOTNn?= =?utf-8?B?NXd4eFdCOGxwYlZuZnJOd3JjTEE5NDZNVkNmZnNTZUR0NFNMMk56aTNvc0Vq?= =?utf-8?B?SlU2WEh4aTVDTkdITWhCNXNtV0crN1RoeHRmeTcyeVo3TFFoMUlrKzd1c1hn?= =?utf-8?B?ZFlHQTZBT3hHb3ZZYjJqWVNyWEE2QnJqckZyZitCK1JFQ3NjVU9qdCtiZTNJ?= =?utf-8?B?anB1VSs4dk5jOVBtY3U2eVZjdHpvZXlMYkQyT0xsbms2Z3JwTnE3b0dXazZ5?= =?utf-8?B?ajJQUVMzRHBwRjlMMkhCUVZ3azQydW40dDJjQkRBYVJOeVZtcHlSMndpaGxp?= =?utf-8?B?eXZXT2lRWmorbnFaMDhiczhkeTlDaGtNUTRSUGYwL3JMT2svcnBGeUFLQmpP?= =?utf-8?B?RS9oNk5sd3AxV2tsOXF1cmJqK05XSGZwS3FBSmVnMExObDZ4ZWwvVTIxYTls?= =?utf-8?B?VHk2RDRPc3VaOVRuTkxyMzdwNXcwRXNBSm1oZkp5Y1RGSWZLdWU3bnpnK2NO?= =?utf-8?B?cDNaeUJOZEZEUDJ1YlU5NElXeGFPdXVQMkFXRjRVYmlUWG8rNXBJcXFzSXQy?= =?utf-8?B?QWNETnVtTHFkUUdyQ1dROURpUEpGaHNpYVkvb21GZEVjQkRtTU4xekxjYkxQ?= =?utf-8?B?bkt6Nm92UlFZUzR1dkJoa3BQNlhTMWxPa0tZZVlqT2l3MHV1b0RwODZYbEZw?= =?utf-8?B?Qk55VU5pWUIrdGJjMFBpZVBjQkpsWFAxNFJlQ1dLU2pWVlU3UVZOTEtQb0VC?= =?utf-8?B?NnIxNHdUczhzRHpqaTYyaHNvdE5qdnhLRDFNOXVQblEvMFU3M3dMMUFWZjdC?= =?utf-8?B?VXpkb0JTTEx1Q1lEWUlsMElnYVozVGFDcXBUYWk0aUpBUlB6ZXROWGcrR3dN?= =?utf-8?Q?TE/YlG58jgxT1aVwYRytMsl7sToRi+nN7P19hAfbs0LW?= X-OriginatorOrg: eckelmann.de X-MS-Exchange-CrossTenant-Network-Message-Id: 9ce47bbd-f04c-4588-2722-08dbb2c891c7 X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2997.DEUP281.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Sep 2023 13:11:11.4214 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 62e24f58-823c-4d73-8ff2-db0a5f20156c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: qhJg4mYC8FYrQVQOvjmUi4UCX9Es7FGbFvynu3ZcMp2wJcPmW6GoAnxRri1t8iGpc6BmoM9Iki58BLE3xeIUvw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR0P281MB3404 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-101.3 required=4.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,USER_IN_WELCOMELIST, USER_IN_WHITELIST autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] SBOM support X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: "ptxdist@pengutronix.de" , =?utf-8?B?SmnFmWkgVmFuxJtr?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hi, > On Thu, Sep 07, 2023 at 03:03:47PM +0000, Simon Falsig wrote: >> I saw a post from 2021 to the mailing list on generating SBOMs from ptxd= ist. >> Has there been any further work on this? > > I've not worked on this and I'm not aware of any other efforts in this > direction. > >> We've been looking at implementing this internally - plan would be to ge= nerate >> the SBOM in CycloneDX format, and consume it with Dependency-Track=20 >> (https://dependencytrack.org) for automatic vulnerability and license mo= nitoring. >>=20 >> Looks like we're quite close to having a working setup, but it'd make a = lot more >> sense to have it upstreamed rather than as local patches, so would like = to get a >> bit of input on the approach, and see if we can make that happen :) we have a similar task. There is a rudimentary prototype running on our site. It uses licencse-complicance.yaml and a CPE-Dictionary from https://nvd.nist.gov/products/cpe to generate a bom.json. This bom.json can than be feed into dependency tracker (We are using docker-compose for demonstration). { "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:f20af5d1-0480-477d-8bea-8cbcf6d9268c", "components": [ { "name": "attr", "version": "2.4.47", "cpe": "cpe:2.3:a:attr_project:attr:2.4.47:*:*:*:*:*:*:*", "licenses": [ { "license": { "id": "GPL-2.0-only" } }, { "license": { "id": "LGPL-2.0-only" } } ], "hashes": [ { "alg": "MD5", "content": "84f58dec00b60f2dc8fd1c9709291cc7" } ] }, ... > I know very little about this stuff, but I'm open to add support for this= . > So please sent patches once they are ready. > >> We've identified two main steps: >> 1. Generate the SBOM itself. A minimal version of this can be created fr= om the >> output of the existing fast-bsp-report in 40 lines of Python, using t= he >> CycloneDX library. >> I'd assume that such a script would just go into the scripts folder i= n ptxdist? > > Yes, just put it in the scripts/ folder. > Our script has 110 lines python. It patches some package names that does not match with the db e.g. expat -> libexpat gdbserver -> gdb kernel -> linux_kernel libmod -> kmod ... I am unsure, if this is too error prone. Adding CPE vars to the recepies, where only the VERSION is variable, should be more robust. >> Is there a common way of tracking / documenting dependencies of such = scripts? > > You mean Python packages used by the script? Not directly. ptxdist-cyclonedx-bom master=20 =E2=9D=AF cat requirements.txt=20 pyyaml=3D=3D6.0.0 lxml=3D=3D4.9.2 > Is the SBOM something that should be created for an image or for the > BSP as a whole? It should be per image imho. Because depending on configuration, layers, collectionconfig, content of images differs a lot. Starting from the image, should generate data that is 100% consistent. Not much of a difference to licence reports, I think. > For the license stuff I have plans to created documents for images. Becau= se > those are delivered to customers, so license compliance really needs to b= e > done for each image. And this is the same for SBOMi, as mentioned before. > I'm not sure what makes sense. So you could either create a global option > and then generate the SBOM with each image. And then select > HOST_SYSTEM_PYTHON3_* in that option. > Or create an SBOM "image" for the whole BSP and select the options there. One thing to keep in mind is that cyclonedx is one format, but not the only one. Today it is one of the most common used. But there are alternatives. So there might be other users who might need the sbom in different formats. I wonder if it is easier to adapt to other formats using the one, or other approach? >> 2. To track vulnerabilities, it's necessary to track the Common Platform >> Enumeration (CPE) name of each package (from https://nvd.nist.gov/pro= ducts/cpe). >> This will allow matching packages to CVEs. >> My suggestion would be to add a _CPE variable to each package (built = from >> whatever other variables make sense, typically _VERSION). > > Makes sense to me. From what I understand, the CPE is machine readable an= d > can be split into its components if needed, right? I think it is. Here CPE number example for package expat: "cpe:2.3:a:attr_project:attr:2.4.47:*:*:*:*:*:*:*" ^- PTXCONF_EXPAT_VERSION >> I managed to add this >> for the fast report (extracting it to pkg_cpe in rules/post/ptxd_make= _world_common.make, >> and adding it to the report in scripts/lib/ptxd_make_world_report.sh)= , but I >> wouldn't be surprised if there are other places/report that need to t= rack this >> also for consistency? > > Just the fast and full reports are enough. Anything else in that directio= n > is legacy anyways and should be replaced with stuff based on these report= s > anyways. > >> Packages that specify _CPE would then have this included in their rep= ort, and >> there'd be no change for the packages that don't specify it. >>=20 >>=20 >> I'd be happy to get a bit of initial feedback on the approach. I'll have= a look >> at putting up some initial patches in the coming days too. I like it a lot. Need reviewers, testers, 1 mio Euro? We are willing to contribute. Regards Gavin