Repository navigation
Generate license reports and SBOMs from build evidence (bom-tools 0.3.0) - #450
Merged
Merged
Conversation
Replace cargo-cyclonedx and allow-list with bom-tools 0.3.0, which scopes the third-party license reports and the new CycloneDX SBOMs to what each build actually compiled. cargo-cyclonedx described the default features, while most targets are built with tls-aws-lc: the 1.7.0 reports listed ring and omitted aws-lc-rs/aws-lc-sys. - each build job records its evidence (cargo build log plus the full and runtime cargo tree) via .github/scripts/build-evidence.sh, which also does the build, so the arguments are defined once - packaging runs bom-tools for dnp3-ffi and dnp3-ffi-java and uploads the SBOMs, which the GitHub release now attaches - allowed.json: approve aws-lc-rs/aws-lc-sys, review ring as Apache-2.0 AND ISC, add jobserver/pkg-config as build tools, move Step Function's open-source crates to third_party, mark code-embedding build dependencies (oo-bindgen, sfio-tokio-ffi, sfio-tracing-ffi) as embedded, drop workspace members, add the commercial license
Without --target, cargo tree does not separate host and target features, so on macOS it disagreed with the build log (tracing-core compiled with a host-only feature set). Build macOS with --target like the other jobs, and make build-evidence.sh refuse to run without it.
jadamcrain
marked this pull request as ready for review
October 9, 2026 22:21
This was referenced Oct 9, 2026
jadamcrain
added a commit
to stepfunc/dnp3-no-serial
that referenced
this pull request
Oct 9, 2026
…#8) * Generate the license report and a CycloneDX SBOM with bom-tools 0.3.0 Same migration as stepfunc/dnp3#450: each build records its evidence with upstream's build-evidence.sh, packaging runs bom-tools 0.3.0 for the license report and the SBOM, the SBOM is embedded in the .nupkg and attached to the release. The upstream ref is now a single DNP3_REF variable. * Release only when the upstream ref is the tag being released
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces
cargo cyclonedx+allow-listwith bom-tools 0.3.0, which derives the third-party license reports and new CycloneDX 1.5 SBOMs from what each build actually compiled.Why
The 1.7.0
third-party-licenses.txtcame fromcargo cyclonedxwithout feature flags, so it described the default features (ring), while Windows, macOS and the gnu Linux targets are built withtls-aws-lc:aws-lc-rs/aws-lc-sysship but were never approved or listed.What changes
cross; FFI and JNI): each build runs through.github/scripts/build-evidence.sh, which does the build and records its evidence (cargo build log plus the full and runtimecargo tree) from the same arguments, and requires--target. macOS now builds with--targetlike the other platforms (copy and binding-test paths updated): without itcargo treedoes not separate host and target features and the evidence cross-check fails.bom-toolspinned to--tag 0.3.0, generatesthird-party-licenses.txt/third-party-licenses-java.txtanddnp3-ffi.cdx.json/dnp3-ffi-java.cdx.json, and embeds each SBOM in its package next to the license report (C zip,.nupkg,.jar) via the existing--extra-filesoption.allowed.json: approveaws-lc-rs/aws-lc-sys(copyrights from their LICENSE file), reviewringasApache-2.0 AND ISC, addjobserver/pkg-configas build tools, move Step Function's MIT/Apache crates (rx509,scursor,sfio-rustls-config,oo-bindgen) tothird_party, markoo-bindgen,sfio-tokio-ffi,sfio-tracing-ffiasembedded(their code is copied into the product), drop workspace members, addcommercial_license.License audit: of the 95 shipped third-party crates, 89 are MIT; the remaining ones declare a single license with no standard alternative, except
ring, now corrected. OpenSSL and Unicode-DFS-2016 drop out of the report; Apache-2.0 comes in (ring,aws-lc-sys).Verified in CI
dnp3-ffianddnp3-ffi-java.LICENSE.txtand the license report.The SBOMs are a rollup of all platforms, matching the packages, which contain every platform's library.
Before merging
Copyright Step Function I/O LLC) and thecommercial_licensename.Follow-ups
xxhash-rustto 0.8.16 (GHSA-6g2r-675j-hx59, low), flagged by Trivy and OSV-Scanner on the new SBOM.