feat(pipeline): analysis-based firmware SBOM from tramiton #156

2026-07-13T08:24:07Z

sharang commented

2026-07-13 08:24:07 +00:00

Firmware targets got no SBOM (syft finds nothing in a C/CMake/west tree). Derive it from tramiton instead — phase 1 (analysis-based, no build) per the agreed plan.

New pipeline::firmware_sbom: tramiton_core::provider::analyze over the already-ingested source (reuses the classify pass — no second clone) → maps resolved libraries (tramiton_repro::lock::libraries_from_inputs) + cross-toolchain into SbomEntry records keyed by the target id.
No binary upload, no nix toolchain in the agent image. Empty when tramiton can't form a build plan.
Wired into classify_and_store for firmware target types; entries land in sbom_entries → show on the SBOM page + feed CVE matching.
Adds tramiton-repro dep (same git/tag as tramiton-core; existing Dockerfile git-auth covers it).

Phase 2 (later, opt-in): full reproducible build (tramiton-repro seal_and_build) → sealed tramiton.lock with artifact-level hashes → tramiton-sbom CycloneDX, once the nix build toolchain is available to the agent.

Local: fmt + clippy (agent, mcp) clean; agent lib tests 267 passed.

Firmware targets got no SBOM (syft finds nothing in a C/CMake/west tree). Derive it from tramiton instead — **phase 1 (analysis-based, no build)** per the agreed plan. - New `pipeline::firmware_sbom`: `tramiton_core::provider::analyze` over the already-ingested source (reuses the classify pass — no second clone) → maps resolved libraries (`tramiton_repro::lock::libraries_from_inputs`) + cross-toolchain into `SbomEntry` records keyed by the target id. - No binary upload, no nix toolchain in the agent image. Empty when tramiton can't form a build plan. - Wired into `classify_and_store` for firmware target types; entries land in `sbom_entries` → show on the SBOM page + feed CVE matching. - Adds `tramiton-repro` dep (same git/tag as tramiton-core; existing Dockerfile git-auth covers it). **Phase 2 (later, opt-in):** full reproducible build (`tramiton-repro seal_and_build`) → sealed `tramiton.lock` with artifact-level hashes → `tramiton-sbom` CycloneDX, once the nix build toolchain is available to the agent. Local: fmt + clippy (agent, mcp) clean; agent lib tests 267 passed.

sharang added 1 commit 2026-07-13 08:24:07 +00:00

feat(pipeline): analysis-based firmware SBOM from tramiton

CI / Check (pull_request) Successful in 6m57s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

9b47b6419a

Firmware/embedded targets got no SBOM: syft finds no package manifest in a
C/CMake/west source tree, and the real firmware bill-of-materials lives in the
build, not a lockfile. Derive it from tramiton's build-plan analysis instead.

New `pipeline::firmware_sbom`: runs `tramiton_core::provider::analyze` over the
already-ingested source (reusing the classification pass — no second clone) and
maps the plan's resolved libraries (`libraries_from_inputs`) + cross-toolchain
into `SbomEntry` records keyed by the target id. No binary upload, no nix build
toolchain in the agent image. Empty when tramiton can't form a build plan.

Wired into `classify_and_store` for firmware target types; the entries land in
`sbom_entries` so they show on the SBOM page and feed CVE matching like any
other SBOM. A full reproducible-build SBOM (sealed tramiton.lock with
artifact-level hashes) is the planned opt-in second phase.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit eaaafc0621 into main

2026-07-13 08:31:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#156