SBOM generation for Debian packages is difficult

--0000000000001a9927063f5dcf5f
Content-Type: text/plain; charset="UTF-8"

Hey Folks,

We (Canonical + Ubuntu) are working on generating SBOMs for Debian binary
packages, but there are a few problems that we'd like to discuss with
y'all.

Currently, there is no out-of-the-box tooling support in Debian to generate
SBOMs. Hence, we were experimenting with two approaches:

1. SBOM Generation at Build Time

This approach is basically recording the list of DEBs downloaded during the
phase of a source package being used to produce binary packages. However,
since Debian builds can be one-to-many, i.e. one source package produces
multiple binary packages, producing SBOMs per '.deb' file is not possible
using this approach.

2. SBOM Generation using buildinfo, '.deb' package and the source Debian
package.

This approach uses the 'Installed-Build-Depends:' field in the buildinfo
file to determine the ingredients, but similar to the previous approach,
this list is per Debian source package build and not per Debian binary
package.

Problems identifying the license of a Debian binary package:

Using the copyright file inside the Debian source package to tag the Debian
binary package with a license. The problem with this approach is that
certain files with a non-permissive license may not end up in all the
Debian binary packages. Copyright information is per file, and there is no
way to track which files went into which .deb package to have accurate
license information.

For other metadata, we parse the control file. However, two major problems
we have are:

1. Per '.deb' Installed-Build-Depends (or other *-depends).
2. Per '.deb' license/copyright information.

Do you folks have any suggestions on this?

For the first point, I was thinking whether it would be possible to add
that to the Debian toolchain (we're happy to contribute), as that is
similar to buildinfo in nature.

For the second point, we're open to suggestions and investigating them.

Thanks,
Vyom Yadav
Software Engineer - Security Team
Canonical

--0000000000001a9927063f5dcf5f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hey Folks,</div><div><br></div><div>We (Canonical + U=
buntu) are working on generating SBOMs for Debian binary packages, but ther=
e are a few problems that we&#39;d like to discuss with y&#39;all.=C2=A0</d=
iv><div><br></div><div>Currently, there is no out-of-the-box tooling suppor=
t in Debian to generate SBOMs.=C2=A0Hence, we were experimenting with two a=
pproaches:</div><div><br></div><div>1. SBOM Generation at Build Time</div><=
div><br></div><div>This approach is basically recording the list of DEBs do=
wnloaded during the phase of a source package being used to produce binary =
packages. However, since Debian builds can be one-to-many, i.e. one source =
package produces multiple binary packages, producing SBOMs per &#39;.deb&#3=
9; file is not possible using this approach.</div><div><br></div><div>2. SB=
OM Generation using buildinfo, &#39;.deb&#39; package and the source Debian=
 package.=C2=A0 =C2=A0</div><div><br></div><div>This approach uses the &#39=
;Installed-Build-Depends:&#39; field in the buildinfo file to determine the=
 ingredients, but similar to the previous approach, this list is per Debian=
 source package build and not per Debian binary package.=C2=A0</div><div><b=
r></div><div>Problems identifying the license of a Debian binary package:=
=C2=A0</div><div><br></div><div>Using the copyright file inside the Debian =
source package to tag the Debian binary package with a license. The problem=
 with this approach is that certain files with a non-permissive license may=
 not end up in all the Debian binary packages. Copyright information is per=
 file, and there is no way to track which files went into which .deb packag=
e to have accurate license information.=C2=A0</div><div><br></div><div>For =
other metadata, we parse the control file. However, two major problems we h=
ave are:</div><div><br></div><div>1. Per &#39;.deb&#39;=C2=A0Installed-Buil=
d-Depends (or other *-depends).<br></div><div>2. Per &#39;.deb&#39; license=
/copyright information.=C2=A0</div><div><br></div><div>Do you folks have an=
y suggestions on this?=C2=A0</div><div><br></div><div>For the first point, =
I was thinking whether it would be possible to add that to the Debian toolc=
hain (we&#39;re happy to contribute), as that is similar to buildinfo in na=
ture.=C2=A0</div><div><br></div><div>For the second point, we&#39;re open t=
o suggestions and investigating them.=C2=A0</div><div><br></div><div>Thanks=
,</div><div>Vyom Yadav</div><div>Software Engineer - Security Team</div><di=
v>Canonical=C2=A0</div></div>

--0000000000001a9927063f5dcf5f--