Page MenuHomeFreeBSD

Generate SBOM files as part of the build
Needs ReviewPublic

Authored by khorben on Fri, Apr 17, 5:31 PM.
Tags
None
Referenced Files
F156343887: D56474.diff
Tue, May 12, 6:42 PM
Unknown Object (File)
Mon, May 11, 11:36 AM
Unknown Object (File)
Mon, May 11, 12:24 AM
Unknown Object (File)
Mon, May 11, 12:16 AM
Unknown Object (File)
Sat, May 9, 9:35 PM
Unknown Object (File)
Sat, May 9, 9:27 PM
Unknown Object (File)
Wed, May 6, 11:22 PM
Unknown Object (File)
Wed, May 6, 10:57 AM

Details

Reviewers
bapt
emaste
ivy
gnn
Summary

This introduces the following option:

  • MK_SBOM: enables the generation of SBOM files during the build.

This option uses bomtool(1) from the pkgconf project, as provided by the MK_PKGCONF option. Consequently, MK_SBOM is automatically disabled when MK_PKGCONF is disabled.

The following parameters are available as well:

  • BOMTOOL: Path to bomtool(1) (for SPDX version 2 files)
  • SBOMDIR: Source directory for pkg-config files (release/sbom/pkgconfig)
  • SPDXDIR: Destination for SPDX version 2 files (/usr/share/sbom/spdx)

Another tool from the pkgconf project, spdxtool(1), is planned for import and will use the following options:

  • JSONLDDIR: Destination for SPDX version 3 files (/usr/share/sbom/jsonld)
  • SPDXTOOL: Path to spdxtool(1) (for SPDX version 3 files)

Sponsored by: Alpha-Omega, Sovereign Tech Agency, The FreeBSD Foundation

Test Plan

Now that the corresponding .pc files in release/sbom/pkgconfig were imported from https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig:

$ make buildworld
[...]
$ ls obj/amd64.amd64/tmp/usr/share/sbom/spdx/*.spdx
lib80211.spdx           libelftc.spdx           libpfctl.spdx
lib9p.spdx              libevent1.spdx          libpjdlog.spdx
libalias.spdx           libexecinfo.spdx        libpmc.spdx
[...]

The SPDX files are also present in their respective packages:

$ make packages
[...]
$ pkg info -l -F /usr/obj/usr/src/repo/FreeBSD\:16\:amd64/latest/FreeBSD-zstd-lib-16.snap20260512151251.pkg
FreeBSD-zstd-lib-16.snap20260512151251:
      /usr/lib/libprivatezstd.so.5
      /usr/share/sbom/spdx/libzstd.spdx
$ pkg info -l -F /usr/obj/usr/src/repo/FreeBSD\:16\:amd64/latest/FreeBSD-zstd-16.snap20260512151251.pkg
FreeBSD-zstd-16.snap20260512151251:
      /usr/bin/unzstd
      /usr/bin/zstd
      /usr/bin/zstdcat
      /usr/bin/zstdmt
      /usr/share/man/man1/unzstd.1.gz
      /usr/share/man/man1/zstd.1.gz
      /usr/share/man/man1/zstdcat.1.gz
      /usr/share/man/man1/zstdmt.1.gz
      /usr/share/sbom/spdx/zstd.spdx

Also confirmed to work with CROSS_TOOLCHAIN=amd64-gcc14.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

khorben edited the summary of this revision. (Show Details)
khorben edited the test plan for this revision. (Show Details)
khorben edited reviewers, added: ivy; removed: philip.
  • The SPDX files are now placed in their respective base packages.
  • The source .pc files from illuusio were imported into release/sbom.
release/sbom/pkgconfig/FreeBSD.pc
9

This should probably be changed and set to 16.0 everywhere a library or binary is issued by FreeBSD.
Note that illuusio is currently working on a patch for pkgconf that will allow us to set the version dynamically.