dasharo/coreboot
0
0
Fork 0
mirror of https://github.com/Dasharo/coreboot.git synced 2026-06-13 10:16:48 -07:00
Code Issues Packages Projects Releases Wiki Activity

src/sbom: add iPXE revision to SBOM

Browse Source 
Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
This commit is contained in:
Filip Lewiński
2026-03-18 08:29:40 +01:00
committed by Sergii Dmytruk
parent cf7f668ef1
commit 7630a13713
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/sbom/Kconfig
+28
View File
@@ -352,4 +352,32 @@ config SBOM_VBOOT_GENERATE
If disabled, the pkgconfig .pc files generated during the vboot
build are used instead (original behaviour).
config SBOM_IPXE
bool "Include iPXE metadata in SBOM"
default n
depends on BUILD_IPXE
help
Select this option if you want to include a
coswid (Concise Software Identification Tag) of the
iPXE network boot firmware into the SBOM
(Software Bill of Materials) File in your build.
config SBOM_IPXE_GENERATE
bool "Auto-generate iPXE revision in SBOM"
depends on SBOM_IPXE
default y
help
When enabled, coreboot reads the git commit hash of the iPXE
source tree (payloads/external/iPXE/ipxe) and records it as the
SBOM version, with the tree hash stored as colloquial-version.
If disabled, set SBOM_IPXE_PATH to a custom file.
config SBOM_IPXE_PATH
string "Path to SBOM file for iPXE"
depends on SBOM_IPXE && !SBOM_IPXE_GENERATE
default "src/sbom/payload-iPXE.json"
help
The path of the SBOM file describing the Software included in the build
File can be a .json, .xml, .cbor, .uswid, or .pc
endif
src/sbom/Makefile.mk
+11
View File
@@ -36,6 +36,7 @@ CONFIG_INTEL_TXT_CBFS_BIOS_ACM := $(call strip_quotes, $(CONFIG_INTEL_TXT_CBFS
CONFIG_INTEL_TXT_CBFS_SINIT_ACM := $(call strip_quotes, $(CONFIG_INTEL_TXT_CBFS_SINIT_ACM))
CONFIG_SBOM_COMPILER_PATH := $(call strip_quotes, $(CONFIG_SBOM_COMPILER_PATH))
CONFIG_EDK2_REPOSITORY := $(call strip_quotes, $(CONFIG_EDK2_REPOSITORY))
CONFIG_SBOM_IPXE_PATH := $(call strip_quotes, $(CONFIG_SBOM_IPXE_PATH))
# Select the correct payload directory for the used payload. Ideally we could just make this
# a one-liner, but since the payload is generated externally (with an extra make command), we
@@ -107,6 +108,8 @@ swid-files-$(CONFIG_SBOM_SINIT_ACM) += \
$(if $(wildcard $(obj)/coreboot.rom),$(build-dir)/intel-sinit-acm.json,), \
$(CONFIG_SBOM_SINIT_ACM_PATH))
swid-files-$(CONFIG_SBOM_IPXE) += $(if $(CONFIG_SBOM_IPXE_GENERATE),$(build-dir)/payload-iPXE.json,$(CONFIG_SBOM_IPXE_PATH))
vboot-pkgconfig-files = $(obj)/external/vboot_reference-bootblock/vboot_host.pc $(obj)/external/vboot_reference-ramstage/vboot_host.pc $(obj)/external/vboot_reference-postcar/vboot_host.pc
ifeq ($(CONFIG_SEPARATE_ROMSTAGE),y)
vboot-pkgconfig-files += $(obj)/external/vboot_reference-romstage/vboot_host.pc
@@ -367,6 +370,14 @@ $(build-dir)/vboot.json: $(src-dir)/vboot.json $(if $(vboot-gitdir),$(vboot-gitd
git_comm_hash=$$(git -C 3rdparty/vboot log -n 1 --format=%H); \
sed -i -e "s/<colloquial_version>/$$git_tree_hash/" -e "s/<software_version>/$$git_comm_hash/" $@
ipxe-gitdir := $(shell git -C payloads/external/iPXE/ipxe rev-parse --absolute-git-dir 2>/dev/null)
$(build-dir)/payload-iPXE.json: $(src-dir)/payload-iPXE.json $(if $(ipxe-gitdir),$(ipxe-gitdir)/HEAD,) | $(build-dir)
cp $< $@
git_tree_hash=$$(git --git-dir payloads/external/iPXE/ipxe/.git log -n 1 --format=%T); \
git_comm_hash=$$(git --git-dir payloads/external/iPXE/ipxe/.git log -n 1 --format=%H); \
sed -i -e "s/<colloquial_version>/$$git_tree_hash/" -e "s/<software_version>/$$git_comm_hash/" $@
# Order-only dep on the .git dir ensures the payload is cloned before we try
# to read it. We do NOT depend on the payload binary ($(CONFIG_PAYLOAD_FILE))
# because: (a) the recipe never reads the binary, only .git; (b) with make -B