sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB · SBOM: control-application dependency SBOM (CODESYS libraries + runtime version) -> CVE #166

New Issue
Open
opened 2026-07-16 10:40:47 +00:00 by sharang · 0 comments
sharang commented 2026-07-16 10:40:47 +00:00
Owner
Copy Link
Copy Source

Problem

We produce firmware/source SBOMs, but nothing captures the control application's
own dependencies: the referenced CODESYS libraries (Standard, Util, OSCAT,
vendor libs) and the CODESYS runtime version. These are exactly the components
with ICS CVEs (e.g. the CODESYS V3 runtime "CoDe16" cluster), so without them CVE
matching for the PLC layer is blind.

Work

  1. Extract referenced libraries + versions from the project's library manager
    (PLCopen XML <addData> library placeholders / .library refs / projectarchive
    library list).
  2. Capture the CODESYS runtime/target version (from device info or the firmware
    image's runtime binary).
  3. Emit these as CycloneDX SBOM components (reuse the existing SBOM model) tagged
    pkg:codesys/... so the existing CVE pipeline (NVD) matches them.
  4. Reconcile with the device firmware SBOM (the runtime binary on the Yocto image)
    so the runtime isn't double-counted — same reconcile-don't-recompute approach as
    the tramiton firmware path.

Files

  • compliance-agent/src/pipeline/plc/ (library/runtime extraction → SbomEntry)
  • SBOM/CVE models + pipeline (reuse)

Depends on the CODESYS native + graphical-language SAST issue for richer project parsing but the library-ref list is available from
PLCopen XML addData today. Part of the CODESYS-on-Yocto tracker.

### Problem We produce firmware/source SBOMs, but nothing captures the **control application's own dependencies**: the referenced CODESYS **libraries** (Standard, Util, OSCAT, vendor libs) and the **CODESYS runtime version**. These are exactly the components with ICS CVEs (e.g. the CODESYS V3 runtime "CoDe16" cluster), so without them CVE matching for the PLC layer is blind. ### Work 1. Extract referenced libraries + versions from the project's **library manager** (PLCopen XML `<addData>` library placeholders / `.library` refs / projectarchive library list). 2. Capture the **CODESYS runtime/target version** (from device info or the firmware image's runtime binary). 3. Emit these as **CycloneDX** SBOM components (reuse the existing SBOM model) tagged `pkg:codesys/...` so the existing **CVE** pipeline (NVD) matches them. 4. **Reconcile** with the device firmware SBOM (the runtime binary on the Yocto image) so the runtime isn't double-counted — same reconcile-don't-recompute approach as the tramiton firmware path. ### Files - `compliance-agent/src/pipeline/plc/` (library/runtime extraction → SbomEntry) - SBOM/CVE models + pipeline (reuse) Depends on the CODESYS native + graphical-language SAST issue for richer project parsing but the library-ref list is available from PLCopen XML `addData` today. Part of the CODESYS-on-Yocto tracker.
sharang added this to the Onboarding v1 milestone 2026-07-16 10:40:47 +00:00
sharang added the enhancementonboarding labels 2026-07-16 10:40:47 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#166