Create a SBOM of an Operating System Image (Debian)

[fraviofii]

Hello,

I need to create a SBOM file of an operating system image. As far as I could see, there is no such option on the tool. The most similar situation is the SBOM of a Docker container.

In this case, what is the suggested approach?

Best regards,

Flavio

[prabhu]

-t os

[prabhu]

Can you run cdxgen with export CDXGEN_DEBUG_MODE=debug and share the full log? It is possible that linux arm64 is untested.

[fraviofii]

Hello @prabhu , thank you for your response,

Here is the full command set:

root@raspberrypi:/# export CDXGEN_DEBUG_MODE=debug
root@raspberrypi:/# cdxgen -t os
cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin
About to generate OBOM for the current OS installation. This will take several minutes ...
Obtained 0 components and 0 dependencies after dedupe.
===== WARNINGS =====
[
  'metadata.component is missing. Run cdxgen with both --project-name and --project-version argument.'
]
root@raspberrypi:/# cdxgen -t os --project-name TEST_PI --project-version 1.0
cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin
About to generate OBOM for the current OS installation. This will take several minutes ...
Obtained 0 components and 0 dependencies after dedupe.
root@raspberrypi:/# npm install -g @cyclonedx/cdxgen-plugins-bin
npm error code EBADPLATFORM
npm error notsup Unsupported platform for @cyclonedx/[email protected]: wanted {"cpu":"x64"} (current: {"cpu":"arm"})
npm error notsup Valid cpu:  x64
npm error notsup Actual cpu: arm
npm error A complete log of this run can be found in: /root/.npm/_logs/2024-10-21T17_22_08_706Z-debug-0.log

I added the debug support, and realized that some parameters were missing. I added them.

Then, it was notified that a npm component is missing, but when I tried to install it, I got the response that ARM support is not available.

Is there any way to overcome this issue?

[prabhu]

Can you install @cyclonedx/cdxgen-plugins-bin-arm64?

[fraviofii]

I tried, but it did not work:

root@raspberrypi:~# npm install @cyclonedx/cdxgen-plugins-bin-arm64
npm error code EBADPLATFORM
npm error notsup Unsupported platform for @cyclonedx/[email protected]: wanted {"os":"linux","cpu":"arm64"} (current: {"os":"linux","cpu":"arm"})
npm error notsup Valid os:   linux
npm error notsup Actual os:  linux
npm error notsup Valid cpu:  arm64
npm error notsup Actual cpu: arm
npm error A complete log of this run can be found in: /root/.npm/_logs/2024-10-21T20_05_24_329Z-debug-0.log

[prabhu]

ah, you are on 32bit. We need to create a new package similar to this. Will you be interested in sending a PR? It is a bit involved.

[fraviofii]

@prabhu , I am interested in sending a PR, for sure.

But I need some advice on how to setup my local environment here to build and test the customization.

[prabhu]

@aryan-rajoria can you kindly help?

[aryan-rajoria]

Hello @fraviofii,

Inorder to setup your local environment you can do the following:

1. you would need nodejs v20 or later for cdxgen, can be installed from here for armv7: https://nodejs.org/en/download/prebuilt-binaries
2. After that please follow the instructions for installing and running cdxgen https://github.com/CycloneDX/cdxgen#contributing.
3. The function used to create OS bom is present in the lib/cli/index.js:

   cdxgen/lib/cli/index.js

   Line 4208 in b309cff

   export function createOSBom(_path, options) {

Cdxgen requires osquery binary inorder to query some information about the os.
After looking osquery binary used by cdxgen it seems it does not contain a arm32 binary, we would need that as it is used by cdxgen and the scripts in cdxgen-plugin-binary help provide that.

[fraviofii]

Thank you for you response @aryan-rajoria .

But taking a closer look at the source code, I'm afraid it will not be possible to migrate.

Looking at this file: https://github.com/CycloneDX/cdxgen-plugins-bin/blob/main/packages/linux-arm64/build-linux-arm64.sh, I searched for the ARM 32 bit versions for OSQuery and Dosai components and I could not find them. They only have ARM64 versions too.

I understand that these components are mandatory, right?

[prabhu]

We can create the 32 bit for dosai, but osquery would be a challenge. The alternative is to make cdxgen use the trivy plugin, which can help.

[prabhu]

CycloneDX/cdxgen-plugins-bin#25