Hello everyone and thank you for attending this presentation.
My name is Benjamin Hober, I am a embedded Linux engineer working at Boutin in
this talk ends to present this new tools that I developed, named SBOMCV check. SBOMCV check is a
standalone and lightweight Python tooling. We're going to see later what it's for, it
takes as inputs and SBOMCV in SBOMCV to or in SBOMCV formats. Optionally, the
laptop VX manifest generated by the VX DB class. This tool takes also values CV databases and
annotation databases. Then this tool, the goal of this tool, is to find vulnerability
associated with each components listed in the SBOMCV and then compute assessments for
each vulnerability phones. So why we are developing yet another tool? In today's
basically landscape-mettoning awareness of non-virti is essential. This process is
becoming even more critical with emergency regulation, with emerging regulation such
as the CI. So we are developing, we are developing this new tool to serve the following
problems. Euctose CV check, the VV class integrated in Euctose is right, but it has some
flows. CV analysis is tied to the build and cannot be replicated, based only on the SBOMCV
files. So our effect is, we need the world build source to run again the build.
So we wanted to process and generate an XPDX three-fives, which most of the existing CV tooling
are not designed or does not support this format yet. We wanted something vague like
weights, not complex, without any web service or something like that. We wanted a very simple
tool that takes fuel inputs and generates fuel inputs. And we wanted to build to use multiple
CV databases at the same time and to merge all of the information and to be able to use
all of these information at the same time. So SBOMCV check has a following design. So tools
text has inputs and SPDX three on SBOMCV files, which could be in SPDX three formats. In this
camera, represented in yellow, it sort of takes values, CV databases, on annotation databases,
represented in pink, yeah. Some SBOM format can contain an annotation. For example, this is the case
for SPDX three-file. That's why in this camera, you can see the annotation database,
which included in the yellow parts. Then, again, for each SBOMCV command, the tool is going to
find all associated CV and then compute CV assessments. And finally, the tool are going to
generate one of multiple export files representing in blue sky. The tool spools by default from
several CV databases, currently we support NVD and CV lists. It's also support multiple
annotation format, like OpenVax, Yucto Custom Format, generated from the vaguely big class,
also a very simple annotation format in YAML file. For the export, it supports the following format
XPDX three, but only if the input file currently is also in SPDX three-file. For now, we plan later
to be able to generate SPDX three-file, whatever the input formats. For the export format, we will
support the VcBolt, CSV format, and also the Yucto Civic, check out the two formats.
The tool, as the following extra functionality, it can be extended by loading external plugin.
It's for the report, it's possible to add a new type or format that is not currently
supported by the tool. For example, if you want to generate a custom report format, for example,
pdf or web page, whatever. Also, the tools can automatically, automatically, mark the
CV as ignored, if effective source are not compiled. This free curve on the Yucto side
to set the SPDX include compiled source by able to one, in each recipe that need this extra
processing. Also, you need a CV databases that provide the list of affected files. Hopefully,
this is mostly the case for the CV, which provides this kind of information, but
yeah, you don't have a lot of provider for that, sadly. The source code is available on Github
on the RGPL V2, contribution of course welcome, and the documentation can be consulted on the
hit-the-doc website. If you want to try it, you can follow this step. First, you have to
install the tool using thick. If you want to install the tool with all optional dependency,
you can execute the following command with pip install, it's bomb cv check with the extra flag.
This is recommended to install the tools inside the Python environment, but you can do whatever
you want, then you need an SBOM file and optionate again the VX, managed generated by the
VXDB cloud phase. For more detail on the reason the bots are, you can take a look about the
documentation. Also, since JOTO 5.2, this bomb generated by default in xpdx3 formats,
so you don't need to do any extra configuration on the JOTO site. All the artifacts that you need,
the ZBOM and the VX manifest can be obtained from the deploy directory of JOTO.
Finally, you just need to execute this command line, which is going to
generate, in this example, the same G1 file that you also need to check the
night. Thank you all, if you have any questions, you can send it later.