ONB-10 · Firmware / Yocto onboarding specifics (Tramiton + EMBA/binwalk) #128

New Issue

2026-07-10T08:34:46Z

sharang commented

2026-07-10 08:34:46 +00:00

Part of #118.

Context

Firmware (bare-metal/RTOS) and Embedded Linux/Yocto are the hardest target families and are exactly Tramiton's domain. Onboarding should lean on Tramiton for build/SBOM/repro rather than reimplement.

Scope

Wire firmware-image and firmware-source artifacts to Tramiton detect → BuildPlan; surface MCU/board/toolchain in onboarding.
SBOM/CVE for firmware via EMBA + binwalk + cve-bin-tool (ties to CS-A2); Yocto SBOM via layer/manifest ingest.
Record Tramiton tramiton.lock / provenance as evidence artifacts on the target.
Define what SAST means for firmware (source-archaeology static analysis) vs. a raw image (unpack + component CVE).

Acceptance criteria

A bare-metal firmware repo fixture onboards with correct MCU/arch via Tramiton.
A firmware image fixture produces an SBOM + CVE findings.
Yocto/BSP fixture ingests layers and yields an SBOM.

Depends on

ONB-02, ONB-03. Integrates Tramiton (tramiton-core, tramiton-sbom) and CS-A2.

Part of #118. ## Context Firmware (bare-metal/RTOS) and Embedded Linux/Yocto are the hardest target families and are exactly Tramiton's domain. Onboarding should lean on Tramiton for build/SBOM/repro rather than reimplement. ## Scope - Wire firmware-image and firmware-source artifacts to Tramiton `detect` → BuildPlan; surface MCU/board/toolchain in onboarding. - SBOM/CVE for firmware via EMBA + binwalk + cve-bin-tool (ties to CS-A2); Yocto SBOM via layer/manifest ingest. - Record Tramiton `tramiton.lock` / provenance as evidence artifacts on the target. - Define what SAST means for firmware (source-archaeology static analysis) vs. a raw image (unpack + component CVE). ## Acceptance criteria - A bare-metal firmware repo fixture onboards with correct MCU/arch via Tramiton. - A firmware image fixture produces an SBOM + CVE findings. - Yocto/BSP fixture ingests layers and yields an SBOM. ## Depends on ONB-02, ONB-03. Integrates Tramiton (`tramiton-core`, `tramiton-sbom`) and CS-A2.

sharang added this to the Onboarding v1 milestone 2026-07-10 08:34:46 +00:00

sharang added the enhancement onboarding labels 2026-07-10 08:34:46 +00:00

sharang referenced this issue

2026-07-10 08:41:02 +00:00

ONB-Epic · Multi-target artifact-aware onboarding wizard #118

sharang referenced this issue

2026-07-10 10:32:30 +00:00

ONB-16 · Tramiton evidence reconciliation (detect handoff + local evidence + entitlement) #135

sharang referenced this issue

2026-07-12 21:56:21 +00:00

ONB · FirmwareStatic scanner: EMBA + binwalk + cve-bin-tool (firmware image analysis) #151

sharang referenced this issue