feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) #157

2026-07-13T10:07:36Z

sharang commented

2026-07-13 10:07:36 +00:00

Phase 2 of the firmware SBOM — no half-measures: an actual reproducible build, not just static analysis.

What it does

analyze → NixBackend::detect() → tramiton_repro::seal_and_build → sealed lock (pinned libraries + firmware artifact hash) → Sbom::from_lock + binary::scan → mapped to SbomEntry rows (toolchain + every fetched library + firmware image; source-file components dropped).
Graceful fallback: no nix backend / build failure / >15m timeout → analysis-only components (phase-1 behaviour). A nix that can't run never breaks a scan.

Infra (action needed on orca)

Agent image now installs nix-portable (rootless, single binary; best-effort download).
The nix store lives under NP_LOCATION=/data/compliance-scanner — mount a persistent volume there, else every firmware scan re-fetches nixpkgs + cross-toolchains (GBs).
The container runtime must allow nix-portable (user namespaces / proot). If it can't, firmware SBOM degrades to analysis-only automatically.

Notes

Can't be exercised in CI (no nix in the runner) — the nix path is validated at runtime on the deployment; CI covers compile + fallback.
Adds tramiton-sbom dep (same git/tag; existing Dockerfile git-auth covers it).

Local: fmt + clippy (agent, mcp) clean.

Phase 2 of the firmware SBOM — **no half-measures**: an actual reproducible build, not just static analysis. ## What it does - `analyze` → `NixBackend::detect()` → `tramiton_repro::seal_and_build` → sealed lock (pinned libraries + firmware artifact hash) → `Sbom::from_lock` + `binary::scan` → mapped to `SbomEntry` rows (toolchain + every fetched library + firmware image; source-file components dropped). - **Graceful fallback:** no nix backend / build failure / >15m timeout → analysis-only components (phase-1 behaviour). A nix that can't run never breaks a scan. ## Infra (action needed on orca) - Agent image now installs **`nix-portable`** (rootless, single binary; best-effort download). - The nix store lives under **`NP_LOCATION=/data/compliance-scanner`** — **mount a persistent volume there**, else every firmware scan re-fetches nixpkgs + cross-toolchains (GBs). - The container runtime must allow nix-portable (user namespaces / proot). If it can't, firmware SBOM degrades to analysis-only automatically. ## Notes - Can't be exercised in CI (no nix in the runner) — the nix path is validated at runtime on the deployment; CI covers compile + fallback. - Adds `tramiton-sbom` dep (same git/tag; existing Dockerfile git-auth covers it). Local: fmt + clippy (agent, mcp) clean.

sharang added 1 commit 2026-07-13 10:07:37 +00:00

feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2)

CI / Check (pull_request) Successful in 6m49s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

3cedb488ac

Upgrade the firmware SBOM from analysis-only to a full reproducible build: run
tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a
sealed lock whose libraries are pinned and whose firmware artifact carries a
content hash, then render the SBOM from the lock plus deep binary SCA of any
pre-compiled inputs — the complete bill of materials (toolchain + every fetched
library + the firmware image), mapped into `SbomEntry` rows.

Graceful by design: when no nix backend is available (or the build fails / times
out at 15m), it falls back to the analysis-only components (toolchain +
resolvable libraries), so a nix that can't run in the deployment never breaks a
scan.

Infra: the agent image now installs `nix-portable` (rootless, single binary;
best-effort — a failed download just leaves the analysis-only path). The nix
store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT
volume there in the deployment, otherwise every firmware scan re-fetches
nixpkgs + cross toolchains.

Adds the `tramiton-sbom` dependency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit b12d18d99d into main

2026-07-13 10:15:07 +00:00

sharang referenced this pull request

2026-07-13 11:06:39 +00:00

fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) #158

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#157