[Buildroot] [RFC PATCH 0/5] Support SBOM in CycloneDX format

* [Buildroot] [RFC PATCH 0/5] Support SBOM in CycloneDX format
@ 2024-04-04 12:43 Thomas Perale via buildroot
  2024-04-04 12:43 ` [Buildroot] [RFC PATCH 1/5] package/pkg-generic.mk: add PURL package variable Thomas Perale via buildroot
                   ` (6 more replies)
  0 siblings, 7 replies; 17+ messages in thread
From: Thomas Perale via buildroot @ 2024-04-04 12:43 UTC (permalink / raw
  To: buildroot; +Cc: Thomas Perale, Thomas Petazzoni

This RFC patch series propose to add support for the CycloneDX
SBOM format.

There is a growing need to generate SBOM from buildroot
configurations. Right now, there are different solutions available
for buildroot users `show-info`, `legal-info` and `pkg-stats`.
They all generate similar information (`show-info` showing more) but
in a format that is specific to buildroot.

CycloneDX is a format already supported by tools such as
https://dependencytrack.org/ that helps track software,
vulnerabilities, etc ...

A DependencyTrack instance has been deployed at https://dependencytrack-lqgs7zhwmq-ew.a.run.app/
so you can play with CycloneDX and see the possibility. Be mindful
that I used a Google Cloud instance with cold start enabled so it can
take several minutes to initialize if no one has used the service.
Login with username `buildroot` and password `buildroot`.
All the project you create will be publicly accessible and removable,
just so you know.

To generate a CycloneDX SBOM compatible with DependencyTrack I found out
that one line minified JSON does not work and I had to format it. I
used the tool `json_reformat` to do it but tools are also available
online. I use the following command:

  make cyclonedx | json_reformat > sbom.json

This is a first sketch and I hope to gather comments on functionality
the community want me to include. I already have a todo list of feature
I plan to work on:

- [ ] Find a solution to handle versioning. The "version" property
      should be incremented every SBOM generation.
- [ ] Add more buildroot 'property' to components
  - [ ] Infrastructure (cmake, cargo etc).
  - [ ] Match the column of the `pkg-stat` command and add the missing
        one that don't have a place in the current CycloneDX spec to a
        corresponding property
- [ ] Make it configurable like pkg-stat
- [ ] Use PACKAGES_ALL if no .config
- [ ] Fix licenses list if there are commas inside parenthesis. Example
      of wrong license list:
              {
                  "license": {
                      "name": "LGPL-2.1+ (libblkid"
                  }
              },
              {
                  "license": {
                      "name": "libfdisk"
                  }
              },
              {
                  "license": {
                      "name": "libmount)"
                  }
              },
- [ ] Introduce a variable `_UPSTREAM_NAME` that defaults to `_RAWNAME`.
      For most python packages for instance, buildroot `python-` prefix
      shouldn't be in the upstream name. This `_UPSTREAM_NAME` can also be
      used e.g. for the default of CPE, PURL, and maybe in other places
      too.
- [ ] For patches downloaded using `_PATCH` variable (rarely used).
      Modify the pedigree to specify the URL instead of writting the
      content.
- [ ] Include the list of upstream URL with `externalReferences` the type
      will be `distribution`
      https://cyclonedx.org/docs/1.5/json/#components_items_externalReferences
- [ ] Add rule to the gitlab ci that check the SPDX licenses are up to
      date.
- [ ] Upstream changes to Dependency Track
  - [ ] Support 1-line minified JSON
  - [ ] Support showing patches and property

Thank you !

Thomas Perale (5):
  package/pkg-generic.mk: add PURL package variable
  package/pkg-utils.mk: urlencode/urldecode macros
  support/misc/cyclonedx.mk: support CycloneDX format
  support/misc/cyclonedx.mk: support spdx license check
  Makefile: add command to generate SBOM in CycloneDX format

 Makefile                       |  13 +
 package/pkg-generic.mk         |  12 +
 package/pkg-utils.mk           |  12 +
 support/misc/cyclonedx-spdx.mk | 617 +++++++++++++++++++++++++++++++++
 support/misc/cyclonedx.mk      | 230 ++++++++++++
 5 files changed, 884 insertions(+)
 create mode 100644 support/misc/cyclonedx-spdx.mk
 create mode 100644 support/misc/cyclonedx.mk

--
2.44.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 17+ messages in thread