Repository navigation
Generate license reports and SBOMs from build evidence (bom-tools 0.3.0) - #201
Merged
Merged
Conversation
Replace cargo-cyclonedx and allow-list with bom-tools 0.3.0, which scopes the third-party license reports and the new CycloneDX SBOMs to what each build actually compiled. Same migration as stepfunc/dnp3#450. cargo-cyclonedx described the default features, while most targets are built with tls-aws-lc, so the reports listed ring and omitted aws-lc-rs/aws-lc-sys. - each build job records its evidence via .github/scripts/build-evidence.sh (same script as dnp3), which also does the build and requires --target; macOS now builds with --target like the other platforms - packaging runs bom-tools for rodbus-ffi and rodbus-ffi-java, embeds each SBOM in its package next to the license report, and the GitHub release attaches the SBOMs - allowed.json: same review as dnp3 for the shared crates (ring, aws-lc-*, Step Function's open-source crates, embedded build dependencies), plus cmake, fs_extra, jobserver and pkg-config as build tools
jadamcrain
added a commit
to stepfunc/rodbus-no-serial
that referenced
this pull request
Oct 9, 2026
…#8) * Generate the license report and a CycloneDX SBOM with bom-tools 0.3.0 Same migration as stepfunc/rodbus#201: each build records its evidence with upstream's build-evidence.sh, packaging runs bom-tools 0.3.0 for the license report and the SBOM, the SBOM is embedded in the .nupkg and attached to the release. The upstream ref is now a single RODBUS_REF variable. * Release only when the upstream ref is the tag being released
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same migration as stepfunc/dnp3#450: replaces
cargo cyclonedx+allow-listwith bom-tools 0.3.0.Why
third-party-licenses.txtcame fromcargo cyclonedxwithout feature flags, describing the default features (ring), while Windows, macOS and the gnu Linux targets are built withtls-aws-lc. Also, packaging installed bom-tools frommainwithout a tag, so it broke when 0.3.0 removed the cargo-cyclonedx commands.What changes
cross; FFI and JNI) run through.github/scripts/build-evidence.sh(identical to dnp3's), which does the build and records its evidence from the same arguments, and requires--target. macOS now builds with--target(copy and binding-test paths updated).bom-toolspinned to--tag 0.3.0, generates the license reports androdbus-ffi.cdx.json/rodbus-ffi-java.cdx.json, and embeds each SBOM in its package next to the license report (C zip,.nupkg,.jar).allowed.json: the crates rodbus shares with dnp3 use dnp3's reviewed entries (ringasApache-2.0 AND ISC,aws-lc-rs/aws-lc-sys, Step Function's open-source crates inthird_party,oo-bindgen/sfio-tokio-ffi/sfio-tracing-ffiasembedded);cmake,fs_extra,jobserver,pkg-configadded as build tools; workspace members dropped;commercial_licenseadded.Checked locally
An all-targets approval check finds no violations; real evidence for
x86_64-unknown-linux-gnu(aws-lc and ring builds) passes for both products, and the SBOMs validate with the CycloneDX CLI. CI here covers the rest.