SBOM strace #3613
Merged
SBOM strace #3613
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thank you for creating a pull request! |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
A block has been put on this Pull Request as this repository is temporarily under a code freeze due to an ongoing release cycle.
If this pull request needs to be merged during the release cycle then please comment /merge and a PMC member will be able to remove the block.
If the code freeze is over you can remove this block by commenting /thaw.
karianna
requested changes
Jan 15, 2024
Co-authored-by: Martijn Verburg <[email protected]>
Co-authored-by: Martijn Verburg <[email protected]>
|
|
|
Note: |
sxa
reviewed
Jan 16, 2024
There was a problem hiding this comment.
It looks like this is only tracing exec operations, so it is not recording anything that's pulled in from, say, development packages / header files on the machine. Is that intentional?
I also wonder if it's worth stripping out the package name from the version of the packages so e.g. the name field would just be bash instead of the package name of bash-4.2.46-35.el7_9.x86_6
It is using openat: Do you have an example ? |
andrew-m-leonard
requested changes
Feb 21, 2024
Thanks @sxa yes, sorry that was my debug, those "no pkg" ones are checked and versions found in the 2nd phase as per your suggestion. |
sxa
reviewed
Feb 29, 2024
| } | ||
| Formula formula = new Formula(); | ||
| System.err.println("SXAECW: " + name); |
There was a problem hiding this comment.
This line can be removed as it was just for debug :-)
I could do it in a separate PR but it might be easier to just remove it in yours to avoid a merge conflict.
There was a problem hiding this comment.
Sure, I fix it :)
This comment was marked as resolved.
This comment was marked as resolved.
|
If I run a build with |
Your SBOM should have the formulation dependencies, eg: https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk21u/job/jdk21u-linux-x64-temurin/124/artifact/workspace/target/OpenJDK21U-sbom_x64_linux_hotspot_2024-02-29-17-15.json |
My output posted above was from my debug branch, not this PR |
andrew-m-leonard
approved these changes
Mar 4, 2024
|
Here is the complete output from the test build: |
|
@sxa @henning410 The above ^ output maybe a bit verbose, but i'm happy with that for the moment. I think the really good thing is the ONLY un-identified dependencies is the /usr/local/gcc11, which we can resolve...(in a new issue) so i'm really pleased with that. |
karianna
approved these changes
Mar 4, 2024
Suggest adding anything that long in a twistie or file attachment in the future :-) |
I also hadn't included We'll also need to think about how often we're going to run with these options. |
|
@henning410 good work. Happy to see this issue merged 🥇 @sxa, @karianna and @andrew-m-leonard thanks for your valuable input and support 💯 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This work adds packages used in the build to the SBOM via strace
sbin/common/config_init.shwith an additonal argumentENABLE_SBOM_STRACEsbin/build.shto check ifENABLE_SBOM_STRACEis set to true. Check if strace is available an then update build command with strace/workspace/build/src/build/straceOutputtooling/strace_analysis.shto analyse strace output and insert relevant information into SBOMthis PR relates to #3087