platform-system-interface / sbom Goto Github PK

https://github.com/doddi/cyclonedx-rust

https://cyclonedx.org/capabilities/sbom/

Currently, we only get the first swid. A uSWID SBOM within a binary may contain multiple SWIDs.

see https://github.com/hughsie/python-uswid/blob/84c879a720d5cb7a2f41acc5a7ddbf1aefebc84c/uswid/container.py#L96

see also https://www.rfc-editor.org/rfc/rfc8949.html#section-3-6

If the encoded sequence of bytes ends before the end of a data item, that item is not well-formed. If the encoded sequence of bytes still has bytes remaining after the outermost encoded item is decoded, that encoding is not a single well-formed CBOR item. Depending on the application, the decoder may either treat the encoding as not well-formed or just identify the start of the remaining bytes to the application.

9eSec's uswid pkg is able to parse multiple CBOR blobs:
https://github.com/9elements/goswid/blob/trunk/pkg/uswid/uswid.go#L158

see https://github.com/veraison/corim

Dasharo is also looking for/into this:
Dasharo/dasharo-issues#129

https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/