From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 13 Sep 2023 17:42:31 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qgS0e-00DwJi-Or for lore@lore.pengutronix.de; Wed, 13 Sep 2023 17:42:31 +0200 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1qgS0c-0005EJ-E5; Wed, 13 Sep 2023 17:42:30 +0200 Received: from mail-zr0che01on2066.outbound.protection.outlook.com ([40.107.24.66] helo=CHE01-ZR0-obe.outbound.protection.outlook.com) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qgS0D-0005Dk-BH; Wed, 13 Sep 2023 17:42:06 +0200 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HgTjZ0eQiBLof64DNluWriGtNzNmc3OUU4WgOjAzZAwNIDhWlCxM9/L0on8M1U8E21euGoVydn0OE6soq1aikYFVCq7y39F441wl0ZScQtGnqNtIUnoAEr5YcSrz6UQH/R0MGokhWRYByA3oTF+IYlVhNHERYw9W+m0YRLTXzRPKzsJEKmfBekHYyDHtO6aG27fkJCHvb2zq+xT00tASMBdS4OoCV9VZA56HrN2c0goikDqwshtG3J5p4wjosvQ7YfFgGIzQZoVKt+TmUA5nuhc+Jw4sAoPm/3SPWuzXeNRmRsAvhdIWMBHpvB4FXyKI2uJZkAfqaL5DiUMtFTG2Pw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OeBKKK6OgFqrvldszrqC9c2HzffCIO1eHWfvlkD/BdA=; b=ICo2ZpjpnGNbk4VYghd9fYk0VkBzx/Lw6Z/4Cyxo1Ho7w9RGArgRy5b26nk88TrVdulqq2+Wg1BsZMAjKWV8+VZBfJOxxz7ZiKOM9afC/BIZsyeT3BlqoBtXdVCzyoKhefuQaAuLYo9gTCzwNlVK+yYrbAPSglg+cUW/+WKpbX8rGOdijW/+yuLOeLQB6Vs8LjQuohiB6TWkgaj22d76aWiznzwOe6rfJIK1d6g78a1Cmhr9VFsHaCKkZ3JKP3DFXQXwSFdm0kz0feQ3MAOwASVg364GeGWeGuNSjFY4atyU+dfb+y0PrpkCM6NSABd+0TDr5mZVmn0+55MD6D7h7g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=verity.net; dmarc=pass action=none header.from=verity.net; dkim=pass header.d=verity.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verity.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OeBKKK6OgFqrvldszrqC9c2HzffCIO1eHWfvlkD/BdA=; b=Eu15O95lL1cecCHhhVTWqDJEQWBAbly3JNB32eqVF0tGdEypMw5G8ROivswuy969LbabwhWQsaxDxAWP06mHqus8MTKtyaT/9kI1fXGJ+rbYGLF0Bl3ibaij/kqo3GPu89fQ8M811cl61eJeXhBrl5JxFmDT/9rTk2dq/JdD4etp3z4sS1pfDQzSVZ0w79cctrZBK94QvjN+5QjcBwJoM80VcbaMaczKZ7s15JmHruMXMlQwHzFKyaLx31YUa5Wxj1O4WiK/Sl5hmcCj+ZZVwhhC/0Znoh1HyBzOAS8GY9Bs+DoNkl0VcA6nMUAOUEc/ozcfTRVxC78wPRvA5Czyjw== Received: from GV0P278MB0784.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:53::9) by ZR0P278MB1041.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:56::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6745.34; Wed, 13 Sep 2023 15:42:02 +0000 Received: from GV0P278MB0784.CHEP278.PROD.OUTLOOK.COM ([fe80::a5a5:a491:679b:42e]) by GV0P278MB0784.CHEP278.PROD.OUTLOOK.COM ([fe80::a5a5:a491:679b:42e%6]) with mapi id 15.20.6792.019; Wed, 13 Sep 2023 15:42:01 +0000 From: Simon Falsig To: Michael Olbrich Thread-Topic: [ptxdist] SBOM support Thread-Index: AdnhnHsNiqon0zJeSR+/uNVF6SJp1AAC1pUAACJEHuAAFLD3AAD0ycDg Date: Wed, 13 Sep 2023 15:42:01 +0000 Message-ID: References: <20230907-jockstrap-dreamily-124aa43b7c7e@ifak-system.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=verity.net; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV0P278MB0784:EE_|ZR0P278MB1041:EE_ x-ms-office365-filtering-correlation-id: 3d4630da-b961-48a8-8c99-08dbb46ff931 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: YJuGlz6bOUfKV2JoMuJcoQLF9p6PaSJbAO7yOkUH3E23W0Azb7qc7TBLvcpZnQZlaTEeCPchBOwZs5+R5ZhxISmZG68LaeJVGXwogjCm4NgTx3CmgtmFvIeY5KcSD25NHCasf9EsX/8PNmjFjZYUWIz6c6VkSf6n+wdsFcNXBcZ3JP5FZpBZxvbeF0fMBPO4UMmVlIxbDdEQIvFHe6k3BMC4chTBZBkaddexDUwBTNkwryS0SPs8XJNVtV/brqLWB86+6QQPuAvl15ou+TEPOgBXB+96GrBuAwqYTcPAo+YvWbtW55MnoCAKf0J8/MBZGUxrCUI91fpUeXZX70BSgXY+lQ+U6Ei/W7wHFrxYdPLdElBwVak4dc1qjqfg83u9EcTD7HOQmguMPsHETlcT+JAiYcb5il44wTrkdEu+TmznqRd8jbXlXB66Hhl3PsOZLXhVVDJMtEY6Hq4orRMfR1gI7rkNEu5lcBZcdy6ek1RyYXQUHJxiM+E7Lnx+NsarYFn+8WGbBshWQ2NU8ptML8O1u5e8PWjlZiPo8evaHZpK2hpKbpGHZOFiCZMQVZlUX1PEKYhXyCXpIfKrLdI+u7fNZCPnDyPzDPBs6UER5FM= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:GV0P278MB0784.CHEP278.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(396003)(136003)(366004)(346002)(39840400004)(376002)(451199024)(186009)(1800799009)(76116006)(64756008)(54906003)(66556008)(66446008)(66476007)(8936002)(8676002)(4326008)(122000001)(38100700002)(38070700005)(6916009)(41300700001)(66946007)(9686003)(316002)(26005)(52536014)(83380400001)(5660300002)(7696005)(71200400001)(6506007)(478600001)(966005)(2906002)(86362001)(55016003)(33656002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-2?Q?vKcA4fRqiOLPhZSZIaFOtnBKTcMfkI1CIlU9Yi8EdIJ2yEVfFtqq8kBF8A?= =?iso-8859-2?Q?eri/zQWwbjNXDXKjHpzbFVuq/mN00r3IhKLmYivqJHzOKhpmKoUuzK7Vr/?= =?iso-8859-2?Q?nEXrk2E+cQK9ILxgFLEfa19vu2vW415L8xcBaGesgbD/elj5FC6yCBlTkT?= =?iso-8859-2?Q?j8pavZuMTfRPb6Vyp1cZejhuL94EwbIBLn5nkjBS4N4cK1Fgk91q8qD55J?= =?iso-8859-2?Q?etZXWKvUKwN04iIOILtg04TBjEolmkRavqund181mcOwfdG+OiqQpWs24i?= =?iso-8859-2?Q?VVydPczPbhFX5aC/KJrUiohsN6vmKYdiIz2FtRrsZfPNgiOlbBl9tdYbrx?= =?iso-8859-2?Q?wCy8vR41GnMa8bKvHUnvzJTf7RSbdF2j/vPGErXajcBUIcS8xO3iM8Myel?= =?iso-8859-2?Q?MKygJxJFvS6sMvNgZeRQmHI++QO64SXt2KX+kJbhBdtHx25bdWT/mFNUhE?= =?iso-8859-2?Q?f9pI2PurRWt0gp2v8IuuRKGqi73FF+ZMyE4R7TpuzbaIghAnqLN5x3pbY1?= =?iso-8859-2?Q?c76K/Fvfp6pTPb79y+TSkt1i8SGlqhLTdd3Mdb5WtFJCxKHFFMojO0N3DZ?= =?iso-8859-2?Q?6o/gbXu3FOtXOob73wdzmmu7n8VlAd9nLFzP6Xj2hnsgmteUQoM4JGqvkd?= =?iso-8859-2?Q?HS/2T01KX4AJ57fSAqqr8rLNUJmHeFkXeKL0r6nrAFBXoixBnFL9XXE+6c?= =?iso-8859-2?Q?l1u3D9NZsbBj8v6Rge3tq2DaWwBn5aoS1mjT1EiPfKthVfDDRiYG6Z4cO/?= =?iso-8859-2?Q?O8Wcmo6PdT4FSAQ0coZrbynolKuQQ2JgFC9bm8Hqr1tGd07TL3AaSpG/Zr?= =?iso-8859-2?Q?515U11++4ItyimYM1mYrmFP0CJkStMb4YbhfVXjb0JqBHOzbPDOxCESH6f?= =?iso-8859-2?Q?8GhylU7aoD6Fy4tSzquYtDv/cSd594jVYFVm4LVgBIrmkhrUR784VYhCY+?= =?iso-8859-2?Q?nCrP1G2B8EJzcgOYYBI+W0m+7PbQO25G4UJb25mP5SlCxFMXdBp2bzNjm6?= =?iso-8859-2?Q?cD7vNbeNVFvGmdYVqYqXirdvkLBMm14Pmd3HP22LURT4y7IMbhGu+jPak4?= =?iso-8859-2?Q?Nd52HYo7/+DSDVsuAKwS1f+7/jnILfiHxpRp4X8drv+HHH/0+eAmvwJCda?= =?iso-8859-2?Q?OW78N6LwgGRByT57MAAdm+S+yvWa+nrybphkVsrYILhoZIUJzVLHVgdPnF?= =?iso-8859-2?Q?38VrwB7RIS4cFi0Pa9UVKF7zikCrbWQylZ7xAoZd0AlwpLw0bhDmHcF+gq?= =?iso-8859-2?Q?AlInN5aeJM7hJnO1quEKReiHvQcEMrXpsmCyRjJXhbzZ+7ifU91IoeW6Q6?= =?iso-8859-2?Q?o/cYPyRdNJHrnE527pVK1bW8O/842y73pezuDfDsxHRS07kKUW76xwaUlZ?= =?iso-8859-2?Q?CTTdjqTewbSTGiZwKgKOyoRhNDSE98Mfd6PkCVJHpMe4lO+/8mFHfAqmXJ?= =?iso-8859-2?Q?g+jnhbg5fuOcscr1/RCjA4kW0d8utRBE7DsAcLaxWZsy45HSfPDQQw3MYU?= =?iso-8859-2?Q?oiisCgHU+aawsrzzfQfxa3kVqeSni9M2aTTg2AiwN8qLYx6hsZtNTSnglj?= =?iso-8859-2?Q?/Es5WIb3RrupMJ8gXuVtLoW0BjsI8gh4ONMIxzq0kIEz7dihIQnYBku3Ol?= =?iso-8859-2?Q?T2CLbI49KpjWk=3D?= Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: verity.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV0P278MB0784.CHEP278.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 3d4630da-b961-48a8-8c99-08dbb46ff931 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Sep 2023 15:42:01.7804 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 06487c72-7d88-4632-bf56-071603defa0a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cQccBFpR//PvRqkbVeDiGjaOQ03kdTBhvXHwvvW75hATWYxDtcb78nAQSEJFzcK1UZQk9QNC3xaClCctXe+Zuw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: ZR0P278MB1041 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-1.7 required=4.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] SBOM support X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl , "ptxdist@pengutronix.de" , =?iso-8859-2?Q?Ji=F8i_Van=ECk?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hi Michael, > From: Michael Olbrich > Sent: Friday, September 8, 2023 20:39 >=20 > Hi, >=20 > On Fri, Sep 08, 2023 at 09:05:26AM +0000, Simon Falsig wrote: > > Thanks for your reply! I've never used Buildroot, so really good with > > some hints as to how others solve this. > > > > >> My suggestion would be to add a _CPE variable to each package > (built from > > >> whatever other variables make sense, typically _VERSION). I > managed to add this > > >> for the fast report (extracting it to pkg_cpe in > rules/post/ptxd_make_world_common.make, > > >> and adding it to the report in > scripts/lib/ptxd_make_world_report.sh), but I > > >> wouldn't be surprised if there are other places/report that need > to track this > > >> also for consistency? > > >> Packages that specify _CPE would then have this included in their > report, and > > >> there'd be no change for the packages that don't specify it. > > > > > > As far as I know buildroot [1] already has support for this. They > > > construct this from defaults and override it with several different > > > variables if defaults are not sufficient for a particular project: > > > > > > _CPE_ID_VENDOR > > > _CPE_ID_VERSION > > > _CPE_ID_UPDATE > > > _CPE_ID_PRODUCT > > > > > > And maybe more? Some quirks handling like this is probably necessary > in ptxdist, too? > > > > > > Greets > > > Alex > > > > I see - Buildroot essentially automatically creates the CPE based on > > existing data in the package, and that can then be overridden if > > needed. I guess the benefit is that this in many cases works directly > > out of the box without any further configuration - but with the risk > that a wrong CPE is generated. >=20 > What would be a wrong CPE? I know very little about this, but I assume, > that would be something like the wrong string for vendor/product, etc. We > need to use the same as everybody else, so matching is possible, right? In our usecase, I guess mainly a false sense of security. You expect to get notified of any CVEs issued for your deployed software, but if your SBOM uses the wrong CPEs, they won't be correctly matched (by tools such as dependency-track). =20 > Are there any machine readable list we can use to validate this? That > would help with review and maintenance. The current database can be downloaded from https://nvd.nist.gov/products/c= pe It's an 18 MB download, but unpacks to a 500+MB file, so not sure if it mak= es sense to fully automate the validation. Adding a script that can download t= he database and check any specified CPEs on demand should be doable though. > Anyways, the report should not included any automatically created CPE. It > should contain all the data to assemble those anyways, so it could be an > optional part of the SBOM creation. >=20 > > (From what I can see, ptxdist doesn't really provide any variable that > > can be extracted for the VENDOR field though?) >=20 > For open source projects, a vendor often makes very little sense. What is > used in such cases anyways? >>From the packages I looked at, it's either $PACKAGE_project, just $PACKAGE, or something else entirely. I'll send an RFC patch with examples in a bit. >=20 > > Explicitly specifying the CPE in each package would lower the risk of > > getting wrong CPEs, as you'd instead just not get a CPE for packages > that don't specify it. >=20 > As I said, it could be optional. I don't know enough about this to decide > either way. >=20 > > Personally, I'd probably lean towards the latter (rather no CVE than a > > wrong one) for our usecase, but would be open to other ways if that can > mean getting this upstreamed? >=20 > I think an option would be good to start with. That way we can see if > anything useful is created and you can disable it without any patches. >=20 > Michael >=20 Thanks for the input! I'll send an initial (very simple) implementation along, and we can then take it from there... - Simon