CODESYS doesn't export libraries to PLCopen XML, so the control app's deps live
in the .projectarchive — which turns out to be a ZIP bundling the project, its
referenced libraries, and the target runtime. Each library is an entry named Name, X.Y.Z.W (Company); the runtime is a device-descriptor entry. So the SBOM
needs no binary parsing — just enumerate the zip entries.
run_plc_scan → persist_control_app_sbom — stores the SBOM (scoped to codesys so it coexists with firmware/source SBOM) and matches it against known
CVEs (the Cmp* / 3SLicense components carry real CODESYS advisories).
Grounded in real data
Verified against a real 9.9 MB.projectarchive from Proemion/codesys-examples (Apache-2.0): 37 components extracted incl. Standard 3.5.18.0, Util 3.5.21.0, CmpCodeMeter 3.5.18.0, 3SLicense 3.5.20.0, and the runtime CODESYS Control for Linux ARM SL 4.17.0.0. Tests build a synthetic archive
mirroring that exact naming (no big binary fixture committed).
Follow-ons (not here)
CVE notifications for the PLC SBOM (alerts are stored; the bell UX is next).
Ingesting a .projectarchivecommitted in a git repo + running the PLC
scanner over a git clone (git-ingest for PLC).
Implements **#166** (CODESYS-on-Yocto tracker **#167**).
CODESYS **doesn't export libraries to PLCopen XML**, so the control app's deps live
in the `.projectarchive` — which turns out to be a **ZIP** bundling the project, its
referenced libraries, and the target runtime. Each library is an entry named
`Name, X.Y.Z.W (Company)`; the runtime is a device-descriptor entry. So the SBOM
needs **no binary parsing** — just enumerate the zip entries.
## Changes
- `plc::sbom::projectarchive_sbom` — parses library + runtime components into
`SbomEntry` (package_manager `codesys`, `purl pkg:codesys/<name>@<ver>`).
- `run_plc_scan` → `persist_control_app_sbom` — stores the SBOM (scoped to
`codesys` so it coexists with firmware/source SBOM) and matches it against known
CVEs (the `Cmp*` / `3SLicense` components carry real CODESYS advisories).
## Grounded in real data
Verified against a real **9.9 MB** `.projectarchive` from
[Proemion/codesys-examples](https://github.com/Proemion/codesys-examples) (Apache-2.0):
**37 components** extracted incl. `Standard 3.5.18.0`, `Util 3.5.21.0`,
`CmpCodeMeter 3.5.18.0`, `3SLicense 3.5.20.0`, and the runtime
`CODESYS Control for Linux ARM SL 4.17.0.0`. Tests build a synthetic archive
mirroring that exact naming (no big binary fixture committed).
## Follow-ons (not here)
- CVE **notifications** for the PLC SBOM (alerts are stored; the bell UX is next).
- Ingesting a `.projectarchive` **committed in a git repo** + running the PLC
scanner over a git clone (git-ingest for PLC).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
CODESYS does not export libraries to PLCopen XML, so the control application's
dependencies live in the .projectarchive — which is a ZIP bundling the project,
its referenced libraries, and the target runtime. Each library is an entry named
`Name, X.Y.Z.W (Company)` and the runtime is a device-descriptor entry
`CODESYS Control … <version> …`, so the SBOM needs no binary parsing: enumerate
the zip entries.
- plc::sbom::projectarchive_sbom: parses library + runtime components from a
.projectarchive's entry names into SbomEntry rows (package_manager `codesys`,
purl `pkg:codesys/<name>@<ver>`). Verified against a real 9.9 MB archive
(Proemion/codesys-examples, Apache-2.0): 37 components incl. Standard/Util/
CmpCodeMeter/3SLicense and the CODESYS Control for Linux ARM SL 4.17.0.0 runtime.
- run_plc_scan: after control-logic findings, extract the SBOM from the PlcProject
artifact and persist it via persist_control_app_sbom — scoped to
package_manager `codesys` (coexists with firmware/source SBOM) and matched
against known CVEs (the Cmp*/3SLicense components carry real CODESYS advisories).
Implements #166. Follow-ons: CVE notifications for the PLC SBOM, and ingesting a
.projectarchive committed in a git repo (see the git-ingest discussion). Tracker #167.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang
merged commit 7369e031c4 into main2026-07-16 15:28:43 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #166 (CODESYS-on-Yocto tracker #167).
CODESYS doesn't export libraries to PLCopen XML, so the control app's deps live
in the
.projectarchive— which turns out to be a ZIP bundling the project, itsreferenced libraries, and the target runtime. Each library is an entry named
Name, X.Y.Z.W (Company); the runtime is a device-descriptor entry. So the SBOMneeds no binary parsing — just enumerate the zip entries.
Changes
plc::sbom::projectarchive_sbom— parses library + runtime components intoSbomEntry(package_managercodesys,purl pkg:codesys/<name>@<ver>).run_plc_scan→persist_control_app_sbom— stores the SBOM (scoped tocodesysso it coexists with firmware/source SBOM) and matches it against knownCVEs (the
Cmp*/3SLicensecomponents carry real CODESYS advisories).Grounded in real data
Verified against a real 9.9 MB
.projectarchivefromProemion/codesys-examples (Apache-2.0):
37 components extracted incl.
Standard 3.5.18.0,Util 3.5.21.0,CmpCodeMeter 3.5.18.0,3SLicense 3.5.20.0, and the runtimeCODESYS Control for Linux ARM SL 4.17.0.0. Tests build a synthetic archivemirroring that exact naming (no big binary fixture committed).
Follow-ons (not here)
.projectarchivecommitted in a git repo + running the PLCscanner over a git clone (git-ingest for PLC).
🤖 Generated with Claude Code