Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gitBOM support via environment variable GITBOM_BUILD_MODE #4

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

yonhan3
Copy link

@yonhan3 yonhan3 commented Oct 24, 2022

Signed-off-by: Yongkui Han [email protected]

@yonhan3
Copy link
Author

yonhan3 commented Oct 24, 2022

This commit adds gitBOM support for GCC compiler.
This aligns with binutils's gitBOM support.

  1. support of below environmental variables to turn on gitBOM feature:
    GITBOM_BUILD_MODE=sha1,sha256,create_adg,embed_bomid,record_hash
    GITBOM_ADG_DIR=/any/directory

Each of those features can be individually turned on/off with the GITBOM_BUILD_MODE environment variable.
Refer to omnibor/spec#22 for details on the proposal.

  1. support of the same symlink farm feature as Bomsh, to persist the artifact-id to ADG-doc mappings in the file system.
    all the symlinks are created in $GITBOM_ADG_DIR/symlinks/ directory.

  2. when create_adg is configured, all the ADG docs are created in $GITBOM_ADG_DIR/objects/ directory, and the symlink for the output file is created.

  3. when embed_bomid is configured, then create_adg feature is also enabled.
    all the ADG docs are created in $GITBOM_ADG_DIR/objects/ directory, and the symlink for the output file is created.
    and correct bom-ids are embedded in the output ELF file.

  4. the new .note.gitbom NOTE ELF section format is used, with NT_GITBOM_SHA1=1, and NT_GITBOM_SHA256=2.
    the binutils' readelf tool has been enhanced to recognize the new .note.gitbom section.

  5. when record_hash is enabled, it records the hashes of output/input files in the $GITBOM_ADG_DIR/metadata/gcc/*.gitbom_raw_logfile,
    in the same format as Bomsh's /tmp/bomsh_hook_raw_logfile file, so Bomsh scripts can process these *.gitbom_raw_logfile directly.

  6. The combinations of sha1-only, sha256-only, or sha1+sha256 are all supported.

  7. all gcc compilations are supported, even with non-ELF files as output file, like:
    gcc -S -o hello.s hello.c
    gcc -c -o hello.o hello.s
    gcc -o hello hello.o
    gcc -S -o hello2.s hello2.c
    gcc -o hello2 hello2.s myfunc2.c libhello.a

  8. "unset GITBOM_BUILD_MODE" or "GITBOM_BUILD_MODE=" will turn off gitBOM support.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant