Support for child SBOM injection needed

[borkra]

Few programming languages (NodeJS, Rust) using not buildroot modules.

I am aware, that there is custom CSV support but it's hard to use and it is not per package, and none of them have standard support for generation of SBOM is CSV... All of the above mentioned languages support native SBOM generation, thus a request.

Could you please add support for per-package custom SBOM ingestion.

[harish-bansal]

Hi @borkra. Thank you for the request.

To better understand how we could support per-package custom SBOM ingestion, could you please share the following details:

• A sample NodeJS SBOM, along with the corresponding Buildroot package name it should be associated with
• A sample Rust SBOM, along with the corresponding Buildroot package name it should be associated with
• Your preferred SBOM input formats to be supported (e.g., CycloneDX JSON, SPDX)

[borkra]

sbom.cdx.json
sbom.spdx.json
Here are nodejs SBOMS for one of my projects in CycloneDX and SPDX format

[harish-bansal]

Hi @borkra. As an initial step, we are evaluating a workflow to merge externally provided child SBOMs with the SBOM generated by vigiles-buildroot. Specifically, we have:

• Generated a CycloneDX SBOM using vigiles-buildroot
• Merged it with a child CycloneDX SBOM
• Uploaded the combined SBOM into Vigiles to validate successful ingestion and vulnerability report generation

I have attached a sample merged SBOM, created using the child CycloneDX SBOM you provided, for your review .

We would appreciate your feedback on whether the structure and content of the merged SBOM align with your expectations, and whether you foresee any issues with this approach.

merged_sbom.json

[borkra]

Hi @harish-bansal it merged there is an potential issue though.

NodeJS list packages as "libconfig-borkra@1.1.3|define-data-property@1.1.4"

where "libconfig-borkra@1.1.3" is my project and "define-data-property@1.1.4" is upstream npm module this project is using, I would like to get CVEs on.

We just need to be sure server side can understand this format and create proper CVE report.

[harish-bansal]

NodeJS list packages as "libconfig-borkra@1.1.3|define-data-property@1.1.4"

From our observations, the package naming is consistent across the external SBOM, merged SBOM, and Vigiles, and there is no project-specific prefix applied on the package name.

The bom-ref field does include the project prefix (libconfig-borkra@1.1.3|...), but this field is only used as a unique identifier within the SBOM and does not impact CVE reporting or package matching.

Original external SBOM
{ "type": "library", "name": "define-data-property", "version": "1.1.4", "bom-ref": "libconfig-borkra@1.1.3|define-data-property@1.1.4", "author": "Jordan Harband", "description": "Define a data property on an object. Will fall back to assignment in an engine without descriptors.", "licenses": [ { "license": { "id": "MIT", "acknowledgement": "declared" } } ], "purl": "pkg:npm/define-data-property@1.1.4", "externalReferences": [ { "url": "git+[https://github.com/ljharb/define-data-property.git"](https://github.com/ljharb/define-data-property.git%22), "type": "vcs", "comment": "as detected from PackageJson property \"repository.url\"" }, { "url": "[https://github.com/ljharb/define-data-property#readme"](https://github.com/ljharb/define-data-property#readme%22), "type": "website", "comment": "as detected from PackageJson property \"homepage\"" }, { "url": "[https://github.com/ljharb/define-data-property/issues"](https://github.com/ljharb/define-data-property/issues%22), "type": "issue-tracker", "comment": "as detected from PackageJson property \"bugs.url\"" }, { "url": "[https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz"](https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz%22), "type": "distribution", "hashes": [ { "alg": "SHA-512", "content": "ac132f23396903cbfa13e489668a3ef87018aac2eb920ecc49f2229cc3c5866928af0ed7f9d39754942cf904faf731a4cccc9f0e720c3765a2775f8d6cbdd3f8" } ], "comment": "as detected from npm-ls property \"resolved\" and property \"integrity\"" } ], "properties": [ { "name": "cdx:npm:package:development", "value": "true" }, { "name": "cdx:npm:package:path", "value": "node_modules/define-data-property" } ] },

Merged SBOM
{ "type": "library", "bom-ref": "libconfig-borkra@1.1.3|define-data-property@1.1.4", "author": "Jordan Harband", "name": "define-data-property", "version": "1.1.4", "description": "Define a data property on an object. Will fall back to assignment in an engine without descriptors.", "licenses": [ { "license": { "id": "MIT" } } ], "purl": "pkg:npm/define-data-property@1.1.4", "externalReferences": [ { "url": "git\u002B[https://github.com/ljharb/define-data-property.git"](https://github.com/ljharb/define-data-property.git%22), "type": "vcs", "comment": "as detected from PackageJson property \u0022repository.url\u0022" }, { "url": "[https://github.com/ljharb/define-data-property#readme"](https://github.com/ljharb/define-data-property#readme%22), "type": "website", "comment": "as detected from PackageJson property \u0022homepage\u0022" }, { "url": "[https://github.com/ljharb/define-data-property/issues"](https://github.com/ljharb/define-data-property/issues%22), "type": "issue-tracker", "comment": "as detected from PackageJson property \u0022bugs.url\u0022" }, { "url": "[https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz"](https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz%22), "type": "distribution", "comment": "as detected from npm-ls property \u0022resolved\u0022 and property \u0022integrity\u0022", "hashes": [ { "alg": "SHA-512", "content": "ac132f23396903cbfa13e489668a3ef87018aac2eb920ecc49f2229cc3c5866928af0ed7f9d39754942cf904faf731a4cccc9f0e720c3765a2775f8d6cbdd3f8" } ] } ], "properties": [ { "name": "cdx:npm:package:development", "value": "true" }, { "name": "cdx:npm:package:path", "value": "node_modules/define-data-property" } ] },

Vigiles

Could you please clarify which tool or step in your workflow is showing the project name prefix (e.g., libconfig-borkra)?

[borkra]

Oh, ok, I guess it’s expectedl by CycloneDX, so all is good.
It would be nice though to see parent project on server side report.

We would need similar featurein Yocto as well. Do I need to open an issue over there?

[harish-bansal]

Thanks @borkra for the clarification. We’ll map this feature request to the meta-timesys project as well, so there’s no need to open a separate issue.

[borkra]

summit-rcm.cdx.json
summit-rcm.spdx.json

Here are the SBOMs generated from rust.

Similar thing is probably available in go, but I am not a go user at this time.

[borkra]

summit-rcm.cdx.json
summit-rcm.spdx.json

Here are updated rust SBOMs, generated by different tool