sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2)
CI / Check (pull_request) Successful in 6m49s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details

Browse Source 
Upgrade the firmware SBOM from analysis-only to a full reproducible build: run
tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a
sealed lock whose libraries are pinned and whose firmware artifact carries a
content hash, then render the SBOM from the lock plus deep binary SCA of any
pre-compiled inputs — the complete bill of materials (toolchain + every fetched
library + the firmware image), mapped into `SbomEntry` rows.

Graceful by design: when no nix backend is available (or the build fails / times
out at 15m), it falls back to the analysis-only components (toolchain +
resolvable libraries), so a nix that can't run in the deployment never breaks a
scan.

Infra: the agent image now installs `nix-portable` (rootless, single binary;
best-effort — a failed download just leaves the analysis-only path). The nix
store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT
volume there in the deployment, otherwise every firmware scan re-fetches
nixpkgs + cross toolchains.

Adds the `tramiton-sbom` dependency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
2026-07-13 12:07:23 +02:00
co-authored by Claude Opus 4.8
parent eaaafc0621
commit 3cedb488ac
4 changed files with 153 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compliance-agent/Cargo.toml
+4 -2
View File
@@ -15,9 +15,11 @@ compliance-dast = { path = "../compliance-dast" }
# available to the onboarding classifier. NOTE: CI must be able to fetch this
# private repo (see the git-auth step in .gitea/workflows/ci.yml).
tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
# tramiton-repro's `libraries_from_inputs` turns a build plan's fetched inputs
# into the SBOM-friendly library list (analysis-based firmware SBOM, no build).
# tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
# yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
# tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
serde = { workspace = true }
serde_json = { workspace = true }
tokio = { workspace = true }