Merge pull request #94 from nikstur/improve-reproducibility

Make it reproducible

nix/build-bom.nix

@@ -18,6 +18,7 @@ runCommand "${drv.name}.cdx.json" { buildInputs = [ transformer ]; } ''
  bombon-transformer ${drv} \
  ${toString flags} \
  ${buildtimeDependencies drv extraPaths} \
- ${runtimeDependencies drv extraPaths} > $out
+ ${runtimeDependencies drv extraPaths} \
+ $out
 ''
 

rust/transformer/Cargo.toml

@@ -12,6 +12,8 @@ cyclonedx-bom = "0.5"
 itertools = "0.12"
 serde = { version = "1.0", features = [ "derive" ] }
 serde_json = "1.0"
+sha2 = "0.10"
+uuid = "1.8"
 
 [lints.rust]
 unsafe_code = "forbid"

rust/transformer/src/buildtime_input.rs

@@ -1,4 +1,4 @@
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 use std::fs;
 use std::path::Path;
 
@@ -7,15 +7,15 @@ use anyhow::{Context, Result};
 use crate::derivation::Derivation;
 
 #[derive(Clone)]
-pub struct BuildtimeInput(pub HashMap<String, Derivation>);
+pub struct BuildtimeInput(pub BTreeMap<String, Derivation>);
 
 impl BuildtimeInput {
  pub fn from_file(path: &Path) -> Result<Self> {
  let buildtime_input_json: Vec<Derivation> = serde_json::from_reader(
  fs::File::open(path).with_context(|| format!("Failed to open {path:?}"))?,
  )
  .context("Failed to parse buildtime input")?;
- let mut m = HashMap::new();
+ let mut m = BTreeMap::new();
  for derivation in buildtime_input_json {
  m.insert(derivation.path.clone(), derivation);
  }

rust/transformer/src/cli.rs

@@ -19,6 +19,9 @@ pub struct Cli {
 
  /// Path to a newline separated .txt file containing the runtime input
  runtime_input: PathBuf,
+
+ /// Path to write the SBOM to
+ output: PathBuf,
 }
 
 impl Cli {
@@ -28,6 +31,7 @@ impl Cli {
  &self.target,
  &self.buildtime_input,
  &self.runtime_input,
+ &self.output,
  )
  }
 }

rust/transformer/src/cyclonedx.rs

@@ -1,13 +1,16 @@
+use std::path::Path;
+
 use anyhow::Result;
 use cyclonedx_bom::external_models::uri::Purl;
-use cyclonedx_bom::models::bom::Bom;
+use cyclonedx_bom::models::bom::{Bom, UrnUuid};
 use cyclonedx_bom::models::component::{Classification, Component, Components};
 use cyclonedx_bom::models::external_reference::{
  ExternalReference, ExternalReferenceType, ExternalReferences,
 };
 use cyclonedx_bom::models::license::{License, LicenseChoice, Licenses};
 use cyclonedx_bom::models::metadata::Metadata;
 use cyclonedx_bom::models::tool::{Tool, Tools};
+use sha2::{Digest, Sha256};
 
 use crate::derivation::{self, Derivation, Meta};
 
@@ -22,15 +25,33 @@ impl CycloneDXBom {
  Ok(output)
  }
 
- pub fn build(target: Derivation, components: CycloneDXComponents) -> Self {
+ pub fn build(target: Derivation, components: CycloneDXComponents, output: &Path) -> Self {
  Self(Bom {
  components: Some(components.into()),
  metadata: Some(metadata_from_derivation(target)),
+ // Derive a reproducible serial number from the output path. This works because the Nix
+ // outPath of the derivation is input addressed and thus reproducible.
+ serial_number: Some(derive_serial_number(output.as_os_str().as_encoded_bytes())),
  ..Bom::default()
  })
  }
 }
 
+/// Derive a serial number from some arbitrary data.
+///
+/// This data is hashed with SHA256 and the first 16 bytes are used to create a UUID to serve as a
+/// serial number.
+fn derive_serial_number(data: &[u8]) -> UrnUuid {
+ let hash = Sha256::digest(data);
+ let array: [u8; 32] = hash.into();
+ #[allow(clippy::expect_used)]
+ let bytes = array[..16]
+ .try_into()
+ .expect("Failed to extract 16 bytes from SHA256 hash");
+ let uuid = uuid::Builder::from_bytes(bytes).into_uuid();
+ UrnUuid::from(uuid)
+}
+
 pub struct CycloneDXComponents(Components);
 
 impl CycloneDXComponents {

rust/transformer/src/runtime_input.rs

@@ -1,17 +1,17 @@
 use std::borrow::ToOwned;
-use std::collections::HashSet;
+use std::collections::BTreeSet;
 use std::fs;
 use std::path::Path;
 
 use anyhow::{Context, Result};
 
-pub struct RuntimeInput(pub HashSet<String>);
+pub struct RuntimeInput(pub BTreeSet<String>);
 
 impl RuntimeInput {
  pub fn from_file(path: &Path) -> Result<Self> {
  let file_content =
  fs::read_to_string(path).with_context(|| format!("Failed to read {path:?}"))?;
- let set: HashSet<String> = file_content.lines().map(ToOwned::to_owned).collect();
+ let set: BTreeSet<String> = file_content.lines().map(ToOwned::to_owned).collect();
  Ok(Self(set))
  }
 }

rust/transformer/src/transform.rs

@@ -1,4 +1,5 @@
-use std::io::{self, Write};
+use std::fs::File;
+use std::io::Write;
 use std::path::Path;
 
 use anyhow::{Context, Result};
@@ -14,6 +15,7 @@ pub fn transform(
  target_path: &str,
  buildtime_input_path: &Path,
  runtime_input_path: &Path,
+ output: &Path,
 ) -> Result<()> {
  let mut buildtime_input = BuildtimeInput::from_file(buildtime_input_path)?;
  let target_derivation = buildtime_input.0.remove(target_path).with_context(|| {
@@ -48,8 +50,10 @@ pub fn transform(
  CycloneDXComponents::new(runtime_derivations)
  };
 
- let bom = CycloneDXBom::build(target_derivation, components);
- io::stdout().write_all(&bom.serialize()?)?;
+ let bom = CycloneDXBom::build(target_derivation, components, output);
+ let mut file =
+ File::create(output).with_context(|| format!("Failed to create file {output:?}"))?;
+ file.write_all(&bom.serialize()?)?;
 
  Ok(())
 }