Page MenuHomeFreeBSD

Generate SBOM files as part of the build
Needs ReviewPublic

Authored by khorben on Apr 17 2026, 5:31 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, May 29, 1:56 PM
Unknown Object (File)
Tue, May 26, 1:59 PM
Unknown Object (File)
Wed, May 20, 11:45 PM
Unknown Object (File)
Tue, May 19, 4:07 AM
Unknown Object (File)
Thu, May 14, 8:10 PM
Unknown Object (File)
Thu, May 14, 1:39 PM
Unknown Object (File)
Wed, May 13, 4:42 PM
Unknown Object (File)
Tue, May 12, 6:42 PM

Details

Reviewers
bapt
emaste
ivy
gnn
Summary

This introduces the following option:

  • MK_SBOM: enables the generation of SBOM files during the build.

This option uses bomtool(1) from the pkgconf project, as provided by the MK_PKGCONF option. Consequently, MK_SBOM is automatically disabled when MK_PKGCONF is disabled.

The following parameters are available as well:

  • BOMTOOL: Path to bomtool(1) (for SPDX version 2 files)
  • SBOMDIR: Source directory for pkg-config files (release/sbom/pkgconfig)
  • SPDXDIR: Destination for SPDX version 2 files (/usr/share/sbom/spdx)

Another tool from the pkgconf project, spdxtool(1), is planned for import and will use the following options:

  • JSONLDDIR: Destination for SPDX version 3 files (/usr/share/sbom/jsonld)
  • SPDXTOOL: Path to spdxtool(1) (for SPDX version 3 files)

Sponsored by: Alpha-Omega, Sovereign Tech Agency, The FreeBSD Foundation

Test Plan

Now that the corresponding .pc files in release/sbom/pkgconfig were imported from https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig:

$ make buildworld
[...]
$ ls obj/amd64.amd64/tmp/usr/share/sbom/spdx/*.spdx
lib80211.spdx           libelftc.spdx           libpfctl.spdx
lib9p.spdx              libevent1.spdx          libpjdlog.spdx
libalias.spdx           libexecinfo.spdx        libpmc.spdx
[...]

The SPDX files are also present in their respective packages:

$ make packages
[...]
$ pkg info -l -F /usr/obj/usr/src/repo/FreeBSD\:16\:amd64/latest/FreeBSD-zstd-lib-16.snap20260512151251.pkg
FreeBSD-zstd-lib-16.snap20260512151251:
      /usr/lib/libprivatezstd.so.5
      /usr/share/sbom/spdx/libzstd.spdx
$ pkg info -l -F /usr/obj/usr/src/repo/FreeBSD\:16\:amd64/latest/FreeBSD-zstd-16.snap20260512151251.pkg
FreeBSD-zstd-16.snap20260512151251:
      /usr/bin/unzstd
      /usr/bin/zstd
      /usr/bin/zstdcat
      /usr/bin/zstdmt
      /usr/share/man/man1/unzstd.1.gz
      /usr/share/man/man1/zstd.1.gz
      /usr/share/man/man1/zstdcat.1.gz
      /usr/share/man/man1/zstdmt.1.gz
      /usr/share/sbom/spdx/zstd.spdx

Also confirmed to work with CROSS_TOOLCHAIN=amd64-gcc14.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

khorben edited the summary of this revision. (Show Details)
khorben edited the test plan for this revision. (Show Details)
khorben edited reviewers, added: ivy; removed: philip.
  • The SPDX files are now placed in their respective base packages.
  • The source .pc files from illuusio were imported into release/sbom.
release/sbom/pkgconfig/FreeBSD.pc
9 ↗(On Diff #177720)

This should probably be changed and set to 16.0 everywhere a library or binary is issued by FreeBSD.
Note that illuusio is currently working on a patch for pkgconf that will allow us to set the version dynamically.

a couple of comments:

  • i'm not sure this should be in release/, since it doesn't seem specific to building releases. iiuc, any src build will include the SBOM data if enabled.
  • this adds nearly 1,000 files which contain (among other things) manually listed shared library dependencies. who/what will be responsible for keeping these up to date?
  • we already have PCFILES set in bsd.lib.mk; adding another variable called PCFILE seems potentially confusing.

One thing we may want to investigate is building the SBOM files into the ELF headers instead. Sony has compiler extensions to do that -- https://github.com/sony/esstra/tree/poc/rust-llvm

release/sbom/pkgconfig/CC.pc
1 ↗(On Diff #177720)

I don't understand how this works. This file makes it seem like we're claiming that Clang is copyright by the FreeBSD Foundation?

release/sbom/pkgconfig/CC.pc
1 ↗(On Diff #177720)

the copyright header applies to the file it's in. CC.pc, which is not part of clang, was written by the Foundation, who therefore own the copyright on it.

One thing we may want to investigate is building the SBOM files into the ELF headers instead. Sony has compiler extensions to do that -- https://github.com/sony/esstra/tree/poc/rust-llvm

I wasn't aware of this project and approach; it's a possible avenue indeed. It doesn't seem to support the SPDX format nor LLVM yet though.

In D56474#1308969, @ivy wrote:

a couple of comments:

  • i'm not sure this should be in release/, since it doesn't seem specific to building releases. iiuc, any src build will include the SBOM data if enabled.

That's correct, and thank you for clarifying the distinction. Should we move it to e.g., share/sbom?

  • this adds nearly 1,000 files which contain (among other things) manually listed shared library dependencies. who/what will be responsible for keeping these up to date?

That is also a good point; at the moment there is no magic solution, and this information has to be maintained manually.
However, we could progressively switch to .pc files for storing compilation rules (outside of each Makefile) and merge that upstream when it is not us.
The same issue goes with version numbers, which we are working on automating already.

  • we already have PCFILES set in bsd.lib.mk; adding another variable called PCFILE seems potentially confusing.

That's also a valid concern; suggestions welcome. SBOMFILE comes to mind but AFAICT pkgconf expects the .pc extension, which could also be confusing.

stephane.rochoy_stormshield.eu added inline comments.
release/sbom/pkgconfig/libmd.pc
10 ↗(On Diff #177720)

This is invalid according to the SPDX Python Tools[1]:

ERROR:root:The document is invalid. The following issues have been found:
Unrecognized license reference: Beeware. license_expression must only use IDs from the license list or extracted licensing info, but is: BSD-4-Clause AND BSD-2-Clause AND Beeware AND RSA-MD

[1] https://github.com/spdx/tools-python

release/sbom/pkgconfig/libmd.pc
10 ↗(On Diff #177720)

s/Beeware/Beerware should be enough as PHK registered this license on SPDX.org ;)

For info, I reported a few minor problems to the pkgconf project: #516.

  • Avoid file conflicts in the -lib32 base packages (no duplicate installation of SPDX files)
  • Rename the PCFILE variable to SBOMFILE to avoid confusion with PCFILES
  • Fix typo in libmd.pc (thanks stephane.rochoy_stormshield.eu for the heads up!)