sbom-embedded 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- sbom_embedded-0.1.0/.gitignore +26 -0
- sbom_embedded-0.1.0/CHANGELOG.md +39 -0
- sbom_embedded-0.1.0/DESIGN.md +720 -0
- sbom_embedded-0.1.0/LICENSE +21 -0
- sbom_embedded-0.1.0/PKG-INFO +313 -0
- sbom_embedded-0.1.0/README.md +297 -0
- sbom_embedded-0.1.0/pyproject.toml +59 -0
- sbom_embedded-0.1.0/src/sbom_embedded/__init__.py +3 -0
- sbom_embedded-0.1.0/src/sbom_embedded/cli.py +153 -0
- sbom_embedded-0.1.0/src/sbom_embedded/models.py +63 -0
- sbom_embedded-0.1.0/src/sbom_embedded/parsers/__init__.py +0 -0
- sbom_embedded-0.1.0/src/sbom_embedded/parsers/buildroot.py +125 -0
- sbom_embedded-0.1.0/src/sbom_embedded/parsers/detect.py +109 -0
- sbom_embedded-0.1.0/src/sbom_embedded/parsers/yocto.py +347 -0
- sbom_embedded-0.1.0/src/sbom_embedded/py.typed +0 -0
- sbom_embedded-0.1.0/src/sbom_embedded/writer.py +147 -0
- sbom_embedded-0.1.0/tests/__init__.py +0 -0
- sbom_embedded-0.1.0/tests/conftest.py +10 -0
- sbom_embedded-0.1.0/tests/fixtures/PROVENANCE.md +170 -0
- sbom_embedded-0.1.0/tests/fixtures/buildroot-2023.02/legal-info/manifest.csv +6 -0
- sbom_embedded-0.1.0/tests/fixtures/buildroot-2026.08/legal-info/manifest.csv +45 -0
- sbom_embedded-0.1.0/tests/fixtures/buildroot-minimal-quoting/legal-info/manifest.csv +93 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-5.0.9/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.manifest +36 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-5.1-styhead/licenses/qemux86_64/core-image-minimal-qemux86-64.rootfs-20250610090225/image_license.manifest +5 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-5.1-styhead/licenses/qemux86_64/core-image-minimal-qemux86-64.rootfs-20250610090225/license.manifest +185 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2/images/qemux86-64/core-image-full-cmdline-qemux86-64.rootfs.manifest +444 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.manifest +38 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2-ipk/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.manifest +38 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2-live/images/qemux86-64/core-image-minimal-qemux86-64.rootfs-20260902171159.manifest +37 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2-live/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.manifest +37 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2-live/licenses/qemux86_64/core-image-minimal-qemux86-64.rootfs-20260902171159/image_license.manifest +5 -0
- sbom_embedded-0.1.0/tests/fixtures/yocto-6.0.2-live/licenses/qemux86_64/core-image-minimal-qemux86-64.rootfs-20260902171159/license.manifest +195 -0
- sbom_embedded-0.1.0/tests/support.py +11 -0
- sbom_embedded-0.1.0/tests/test_buildroot.py +146 -0
- sbom_embedded-0.1.0/tests/test_cli.py +190 -0
- sbom_embedded-0.1.0/tests/test_detect.py +105 -0
- sbom_embedded-0.1.0/tests/test_writer.py +205 -0
- sbom_embedded-0.1.0/tests/test_yocto.py +476 -0
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# Python
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[cod]
|
|
4
|
+
*.egg-info/
|
|
5
|
+
.pytest_cache/
|
|
6
|
+
|
|
7
|
+
# Environments
|
|
8
|
+
.venv/
|
|
9
|
+
venv/
|
|
10
|
+
|
|
11
|
+
# Build output
|
|
12
|
+
dist/
|
|
13
|
+
build/
|
|
14
|
+
|
|
15
|
+
# Generated SBOMs -- this tool's own output, never source
|
|
16
|
+
sbom.json
|
|
17
|
+
*.sbom.json
|
|
18
|
+
|
|
19
|
+
# Build trees and downloaded artifacts used for manual testing.
|
|
20
|
+
# Fixtures under tests/fixtures/ are committed on purpose; see its PROVENANCE.md.
|
|
21
|
+
buildroot/
|
|
22
|
+
output/
|
|
23
|
+
grype
|
|
24
|
+
*.tar.gz
|
|
25
|
+
*.tar.xz
|
|
26
|
+
*.tar.zst
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to this project are documented here. The format follows
|
|
4
|
+
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project
|
|
5
|
+
follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
|
+
|
|
7
|
+
## [Unreleased]
|
|
8
|
+
|
|
9
|
+
## [0.1.0] - 2026-09-02
|
|
10
|
+
|
|
11
|
+
First release.
|
|
12
|
+
|
|
13
|
+
### Added
|
|
14
|
+
|
|
15
|
+
- CycloneDX 1.6 SBOM generation from Yocto and Buildroot build output, reading
|
|
16
|
+
manifests a finished build already wrote. No build is started.
|
|
17
|
+
- Yocto: reads `licenses/**/license.manifest` where present -- it carries
|
|
18
|
+
licenses and recipe names -- and falls back to
|
|
19
|
+
`images/<machine>/*.rootfs.manifest` otherwise.
|
|
20
|
+
- Buildroot: reads `legal-info/manifest.csv`, locating columns by header name
|
|
21
|
+
so six- and seven-column eras both parse.
|
|
22
|
+
- Automatic build-system detection from the directory, refusing to guess when
|
|
23
|
+
a directory looks like both or holds several images.
|
|
24
|
+
- `--image`, `--name`, `--product-version`, `--output` and `--format`.
|
|
25
|
+
- Every component carries a `pkg:generic` purl by construction.
|
|
26
|
+
- A `yocto:recipe` property mapping each package back to the recipe that
|
|
27
|
+
produced it, where a license manifest is available.
|
|
28
|
+
|
|
29
|
+
### Notes
|
|
30
|
+
|
|
31
|
+
- Package revisions (`-r0`) and epochs are stripped from Yocto versions so the
|
|
32
|
+
same image yields the same SBOM whichever package backend built it.
|
|
33
|
+
- Buildroot's `custom` and `unknown` placeholders become absent fields rather
|
|
34
|
+
than invented data. No CPEs, suppliers or hashes are generated.
|
|
35
|
+
- A `pkg:generic` purl is not resolved to a vulnerability namespace by Grype,
|
|
36
|
+
Trivy or Dependency-Track. See the README before trusting a clean scan.
|
|
37
|
+
|
|
38
|
+
[Unreleased]: https://github.com/RchrdWrd/sbom-embedded/compare/v0.1.0...HEAD
|
|
39
|
+
[0.1.0]: https://github.com/RchrdWrd/sbom-embedded/releases/tag/v0.1.0
|