docs: tutorials: rolling alice: coach alice: down the dependency rabbit hole again: Complete tutorial

[johnandersen777]

To start work on this issue:

$ REC_TITLE="docs: tutorials: rolling alice: coach alice: down the dependency rabbit hole again: https://github.com/intel/dffml/issues/1421" exec bash

• https://github.com/intel/dffml/blob/alice/docs/tutorials/rolling_alice/0001_coach_alice/0001_down_the_dependency_rabbit_hole_again.md
• First we're just doing simple openssl demo where package is
  distributed as binary wheel via static pypi, with sbom deployment.
  We'll also show how we use VEX and basic policy.yml to triage
  (openssl server vs. client applicability).
  • https://github.com/tpm2-software/tpm2-pytss (this should ldd to openssl)
  • https://github.com/intel/cve-bin-tool
  • https://github.com/CycloneDX/cyclonedx-bom-exchange-api
  • https://github.com/CycloneDX/cyclonedx-bom-repo-server
  • https://github.com/OR13/endor
• References
  • 2022-11-14 @pdxjohnny Engineering Logs
  • https://tpm2-pytss.readthedocs.io/en/latest/testing.html
  • https://github.com/intel/cve-bin-tool
  • BSidesPDX_2019_Down_The_Dependency_Rabbit_Hole.pdf
• Related
  • shouldi: deptree: Create dependency tree of project #596
• Future
  • Update Architecting Alice: Stream of Consciousness to include notes on
    building off of Architecting Alice: She's Arriving When? to now communicate
    between Alice and Bob via SBOM, VEX, VDR, etc. rolled in.

[johnandersen777]

$ sudo dnf install -y tpm2-tss-devel swtpm libtpms-devel 
$ git clone https://github.com/tpm2-software/tpm2-pytss
$ cd tpm2-pytss
$ pip install -e .[dev]
$ find . -type f | xargs -I '{}' file {} | grep \\.so
./src/tpm2_pytss/_libtpm2_pytss.abi3.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=780c8e1d991201b4167b2c591514fe7b121f785f, with debug_info, not stripped
$ ldd ./src/tpm2_pytss/_libtpm2_pytss.abi3.so
        linux-vdso.so.1 (0x00007ffda818f000)
        libtss2-esys.so.0 => /lib64/libtss2-esys.so.0 (0x00007f197b522000)
        libtss2-tctildr.so.0 => /lib64/libtss2-tctildr.so.0 (0x00007f197b51a000)
        libtss2-rc.so.0 => /lib64/libtss2-rc.so.0 (0x00007f197b510000)
        libtss2-mu.so.0 => /lib64/libtss2-mu.so.0 (0x00007f197b4c2000)
        libtss2-fapi.so.1 => /lib64/libtss2-fapi.so.1 (0x00007f197b3e8000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f197b20a000)
        libcrypto.so.3 => /lib64/libcrypto.so.3 (0x00007f197ac00000)
        libtss2-sys.so.1 => /lib64/libtss2-sys.so.1 (0x00007f197b1e2000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f197b6d4000)
        libjson-c.so.5 => /lib64/libjson-c.so.5 (0x00007f197b1cf000)
        libcurl.so.4 => /lib64/libcurl.so.4 (0x00007f197b126000)
        libz.so.1 => /lib64/libz.so.1 (0x00007f197b10a000)
        libnghttp2.so.14 => /lib64/libnghttp2.so.14 (0x00007f197b0df000)
        libidn2.so.0 => /lib64/libidn2.so.0 (0x00007f197b0bd000)
        libssh.so.4 => /lib64/libssh.so.4 (0x00007f197b04c000)
        libpsl.so.5 => /lib64/libpsl.so.5 (0x00007f197b038000)
        libssl.so.3 => /lib64/libssl.so.3 (0x00007f197ab5d000)
        libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f197ab06000)
        libldap.so.2 => /lib64/libldap.so.2 (0x00007f197aaa0000)
        liblber.so.2 => /lib64/liblber.so.2 (0x00007f197aa8e000)
        libbrotlidec.so.1 => /lib64/libbrotlidec.so.1 (0x00007f197b029000)
        libunistring.so.2 => /lib64/libunistring.so.2 (0x00007f197a8d6000)
        libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f197a7f9000)
        libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f197a7de000)
        libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f197a7d7000)
        libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f197a7c6000)
        libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f197a7bf000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f197a7ac000)
        libevent-2.1.so.7 => /lib64/libevent-2.1.so.7 (0x00007f197a753000)
        libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007f197a731000)
        libbrotlicommon.so.1 => /lib64/libbrotlicommon.so.1 (0x00007f197a70e000)
        libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f197a6e1000)
        libcrypt.so.2 => /lib64/libcrypt.so.2 (0x00007f197a6a7000)
        libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007f197a60a000)

[johnandersen777]

• Scanned with CVE Bin Tool but no vulns

[johnandersen777]

For our conceptual upleveling we should investigate alignment between the open architecture and CycloneDX. We should ideally support serialization to their format CycloneDX/specification#194