GitBOM: Enabling universal artifact traceability in software supply chains | Hacker News Reader

GitBOM: Enabling universal artifact traceability in software supply chains

gitbom.dev

26 pointstodsacerdoti4 comments

From https://gitbom.dev/resources/whitepaper/ :

> For this reason we propose two areas of work:

> 1. enhancing artifact-generating tools (e.g., compilers, linkers, and container image generators) to also output metadata regarding their inputs and outputs

> 2. defining a storage format which represents the minimum information to describe the artifact relationship tree, and which uses git’s on-disk storage format

> Following from (1), this approach will require minimal to no effort on the part of open source project maintainers, thus significantly increasing its chances of widespread adoption as compared to any approach which requires maintainers to perform additional actions (e.g., implementing substantive changes in their CI/CD or package build pipeline to generate an SBOM).

Requirements traceability: https://en.wikipedia.org/wiki/Requirements_traceability

codemeta/codemeta - Minimal metadata schemas for science software and code, in JSON-LD: https://github.com/codemeta/codemeta

JSON-LD: https://en.wikipedia.org/wiki/JSON-LD

> By generating artifact trees at build time, embedding the hash of the tree in produced artifacts, and referencing that hash in each subsequent build step, GitBOM will enable the creation of verifiable and complete artifact trees while requiring no effort from, or changes in, most open source projects

So, Nix? (Except maybe the part where there's no effort/changes needed...)

I know of Hardware companies which commit binaries and such artefacts to git (generated from the source code in repo) to ensure that those are available. This looks like a really good solution for this.

That reminded me of "The Vesta Software Configuration Management System"

> Vesta is a system for software configuration management. It stores collections of source files, keeps track of which versions of which files go together, and automates the process of building a complete software artifact from its component pieces. Unlike other software configuration management systems, Vesta was specifically designed to handle very large projects—tens of millions of lines of code and beyond. Vesta’s novel approach gives it three important properties not available in other systems. First, every build is repeatable, because its component sources and build tools are stored immutably and immortally, and its configuration description completely describes what components and tools are used and how they are put together. Second, every build is incremental, because results of previous builds are cached and reused. Third, every build is consistent, because all build dependencies are automatically captured, recorded, and checked, so that a cached result from a previous build is reused only when doing so is certain to be correct. In addition, Vesta’s flexible language for writing configuration descriptions makes it easy to describe large software configurations in a modular fashion and to create variant configurations by customizing build parameters. This report describes the Vesta technology in detail and discusses the performance of our implementation.

https://www.hpl.hp.com/techreports/Compaq-DEC/SRC-RR-177.pdf

Allan Heydon, Roy Levin, Timothy Mann, Yuan Yu (2002)

Reply on news.ycombinator.com