[ptxdist] SBOM support

[Simon Falsig <sfalsig@verity.net>]

Hi,

I saw a post from 2021 to the mailing list on generating SBOMs from ptxdist.
Has there been any further work on this?

We've been looking at implementing this internally - plan would be to generate
the SBOM in CycloneDX format, and consume it with Dependency-Track 
(https://dependencytrack.org) for automatic vulnerability and license monitoring.

Looks like we're quite close to having a working setup, but it'd make a lot more
sense to have it upstreamed rather than as local patches, so would like to get a
bit of input on the approach, and see if we can make that happen :)

We've identified two main steps:
1. Generate the SBOM itself. A minimal version of this can be created from the
   output of the existing fast-bsp-report in 40 lines of Python, using the
   CycloneDX library.
   I'd assume that such a script would just go into the scripts folder in ptxdist?
   Is there a common way of tracking / documenting dependencies of such scripts?

2. To track vulnerabilities, it's necessary to track the Common Platform
   Enumeration (CPE) name of each package (from https://nvd.nist.gov/products/cpe).
   This will allow matching packages to CVEs.
   My suggestion would be to add a _CPE variable to each package (built from
   whatever other variables make sense, typically _VERSION). I managed to add this
   for the fast report (extracting it to pkg_cpe in rules/post/ptxd_make_world_common.make,
   and adding it to the report in scripts/lib/ptxd_make_world_report.sh), but I
   wouldn't be surprised if there are other places/report that need to track this
   also for consistency?
   Packages that specify _CPE would then have this included in their report, and
   there'd be no change for the packages that don't specify it.


I'd be happy to get a bit of initial feedback on the approach. I'll have a look
at putting up some initial patches in the coming days too.

Thanks in advance and best regards,
Simon