Create a SBOM of an Operating System Image (Debian)

[fraviofii]

Hello,

I need to create a SBOM file of an operating system image. As far as I could see, there is no such option on the tool. The most similar situation is the SBOM of a Docker container.

In this case, what is the suggested approach?

Best regards,

Flavio

[prabhu]

-t os

[prabhu]

Can you run cdxgen with export CDXGEN_DEBUG_MODE=debug and share the full log? It is possible that linux arm64 is untested.

[fraviofii]

Hello @prabhu , thank you for your response,

Here is the full command set:

root@raspberrypi:/# export CDXGEN_DEBUG_MODE=debug
root@raspberrypi:/# cdxgen -t os
cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin
About to generate OBOM for the current OS installation. This will take several minutes ...
Obtained 0 components and 0 dependencies after dedupe.
===== WARNINGS =====
[
  'metadata.component is missing. Run cdxgen with both --project-name and --project-version argument.'
]
root@raspberrypi:/# cdxgen -t os --project-name TEST_PI --project-version 1.0
cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin
About to generate OBOM for the current OS installation. This will take several minutes ...
Obtained 0 components and 0 dependencies after dedupe.
root@raspberrypi:/# npm install -g @cyclonedx/cdxgen-plugins-bin
npm error code EBADPLATFORM
npm error notsup Unsupported platform for @cyclonedx/[email protected]: wanted {"cpu":"x64"} (current: {"cpu":"arm"})
npm error notsup Valid cpu:  x64
npm error notsup Actual cpu: arm
npm error A complete log of this run can be found in: /root/.npm/_logs/2024-10-21T17_22_08_706Z-debug-0.log

I added the debug support, and realized that some parameters were missing. I added them.

Then, it was notified that a npm component is missing, but when I tried to install it, I got the response that ARM support is not available.

Is there any way to overcome this issue?

[prabhu]

Can you install @cyclonedx/cdxgen-plugins-bin-arm64?

[fraviofii]

I tried, but it did not work:

root@raspberrypi:~# npm install @cyclonedx/cdxgen-plugins-bin-arm64
npm error code EBADPLATFORM
npm error notsup Unsupported platform for @cyclonedx/[email protected]: wanted {"os":"linux","cpu":"arm64"} (current: {"os":"linux","cpu":"arm"})
npm error notsup Valid os:   linux
npm error notsup Actual os:  linux
npm error notsup Valid cpu:  arm64
npm error notsup Actual cpu: arm
npm error A complete log of this run can be found in: /root/.npm/_logs/2024-10-21T20_05_24_329Z-debug-0.log

[prabhu]

ah, you are on 32bit. We need to create a new package similar to this. Will you be interested in sending a PR? It is a bit involved.

[fraviofii]

@prabhu , I am interested in sending a PR, for sure.

But I need some advice on how to setup my local environment here to build and test the customization.

[prabhu]

We can create the 32 bit for dosai, but osquery would be a challenge. The alternative is to make cdxgen use the trivy plugin, which can help.

[prabhu]

CycloneDX/cdxgen-plugins-bin#25

[fraviofii]

Hey @prabhu , I saw that you have done the port for linux-arm. That was great.

I could download and tested here. It worked, but with a problem: I could not scan the file for vulnerabilities.

I tried using bomber and osv-scanner. None returned an output of my project. No components were detected.

When I generate using 64 bits, it works as expected.

I realized that the generated output file is different. Should I use a different tool to analyze too?

[prabhu]

Give us some more time. We have to implement a version on top of trivy for arm architecture.

[fraviofii]

Hello @prabhu ,

When I execute cdxgen for a project in my ARM 32 bits setup and set the output to file version 1.5, it works. Components are detected, json file is generated and I can scan for vulnerabilities using osv-scanner and/or bomber.

But when I try to create a SBOM for the whole operating system, it is not working.

Here is what I have:

root@raspberrypi:~# CDXGEN_DEBUG_MODE=debug cdxgen -t os -p
cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin
About to generate OBOM for the current OS installation. This will take several minutes ...
Obtained 0 components and 0 dependencies after dedupe.
===== WARNINGS =====
[
  'metadata.component is missing. Run cdxgen with both --project-name and --project-version argument.'
]
╔═══════════════════════════╤═════════════════════════════════════╤═══════════════════════════╤═════════════════╤═══════════════════════════╗
║ Group                     │ Name                                │                   Version │ Scope           │ Tags                      ║
╚═══════════════════════════╧═════════════════════════════════════╧═══════════════════════════╧═════════════════╧═══════════════════════════╝
BOM includes 0 components and 0 dependencies
root@raspberrypi:~# 

Can you give some advice on how to have it working?