feat(pipeline): analysis-based firmware SBOM from tramiton #156

Merged

sharang merged 1 commits from feat/firmware-sbom-tramiton into main

2026-07-13 08:31:34 +00:00

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Opus 4.8	9b47b6419a	feat(pipeline): analysis-based firmware SBOM from tramiton CI / Check (pull_request) Successful in 6m57s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details Firmware/embedded targets got no SBOM: syft finds no package manifest in a C/CMake/west source tree, and the real firmware bill-of-materials lives in the build, not a lockfile. Derive it from tramiton's build-plan analysis instead. New `pipeline::firmware_sbom`: runs `tramiton_core::provider::analyze` over the already-ingested source (reusing the classification pass — no second clone) and maps the plan's resolved libraries (`libraries_from_inputs`) + cross-toolchain into `SbomEntry` records keyed by the target id. No binary upload, no nix build toolchain in the agent image. Empty when tramiton can't form a build plan. Wired into `classify_and_store` for firmware target types; the entries land in `sbom_entries` so they show on the SBOM page and feed CVE matching like any other SBOM. A full reproducible-build SBOM (sealed tramiton.lock with artifact-level hashes) is the planned opt-in second phase. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 10:23:55 +02:00

Author

SHA1

Message

Date

Sharang ParnerkarandClaude Opus 4.8

9b47b6419a

feat(pipeline): analysis-based firmware SBOM from tramiton

CI / Check (pull_request) Successful in 6m57s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

Firmware/embedded targets got no SBOM: syft finds no package manifest in a
C/CMake/west source tree, and the real firmware bill-of-materials lives in the
build, not a lockfile. Derive it from tramiton's build-plan analysis instead.

New `pipeline::firmware_sbom`: runs `tramiton_core::provider::analyze` over the
already-ingested source (reusing the classification pass — no second clone) and
maps the plan's resolved libraries (`libraries_from_inputs`) + cross-toolchain
into `SbomEntry` records keyed by the target id. No binary upload, no nix build
toolchain in the agent image. Empty when tramiton can't form a build plan.

Wired into `classify_and_store` for firmware target types; the entries land in
`sbom_entries` so they show on the SBOM page and feed CVE matching like any
other SBOM. A full reproducible-build SBOM (sealed tramiton.lock with
artifact-level hashes) is the planned opt-in second phase.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 10:23:55 +02:00