sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(plc): control-application SBOM from CODESYS .projectarchive (+CVE) [#166] #170

Merged
sharang merged 1 commits from feat/plc-projectarchive-sbom into main 2026-07-16 15:28:43 +00:00
Conversation 0 Commits 1 Files Changed 3
+293 -5
1 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Opus 4.8 0aec6fdd4a feat(plc): control-application SBOM from CODESYS .projectarchive (+ CVE)
CI / Check (pull_request) Successful in 5m53s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details 
CODESYS does not export libraries to PLCopen XML, so the control application's
dependencies live in the .projectarchive — which is a ZIP bundling the project,
its referenced libraries, and the target runtime. Each library is an entry named
`Name, X.Y.Z.W (Company)` and the runtime is a device-descriptor entry
`CODESYS Control … <version> …`, so the SBOM needs no binary parsing: enumerate
the zip entries.

- plc::sbom::projectarchive_sbom: parses library + runtime components from a
  .projectarchive's entry names into SbomEntry rows (package_manager `codesys`,
  purl `pkg:codesys/<name>@<ver>`). Verified against a real 9.9 MB archive
  (Proemion/codesys-examples, Apache-2.0): 37 components incl. Standard/Util/
  CmpCodeMeter/3SLicense and the CODESYS Control for Linux ARM SL 4.17.0.0 runtime.
- run_plc_scan: after control-logic findings, extract the SBOM from the PlcProject
  artifact and persist it via persist_control_app_sbom — scoped to
  package_manager `codesys` (coexists with firmware/source SBOM) and matched
  against known CVEs (the Cmp*/3SLicense components carry real CODESYS advisories).

Implements #166. Follow-ons: CVE notifications for the PLC SBOM, and ingesting a
.projectarchive committed in a git repo (see the git-ingest discussion). Tracker #167.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-16 17:22:05 +02:00