feat: implement RFC 3553 to add SBOM support #13709

justahero · 2024-04-05T11:23:51Z

What does this PR try to resolve?

This PR is an implementation of RFC 3553 to add support to generate pre-cursor SBOM files for compiled artifacts in Cargo.

How should we test and review this PR?

The RFC 3553 adds a new option to Cargo to emit SBOM pre-cursor files. A project can be configured either by the new Cargo config field sbom.

# .cargo/config.toml
[build]
sbom = true

or using the environment variable CARGO_BUILD_SBOM=true. The sbom option is an unstable feature and requires the -Zsbom flag to enable it.

Check out this branch & compile Cargo. Pick a Cargo project to test it on, then run:

CARGO_BUILD_SBOM=true <path/to/compiled/cargo>/target/debug/cargo build -Zsbom

All generated *.cargo-sbom.json files are located in the target folder alongside their artifacts. To list all generated files use:

find ./target -name "*.cargo-sbom.json"

then check their content. To see the current output format, see these examples.

What does the PR not solve?

The PR leaves a task(s) open that are either out of scope or should be done in a follow-up PRs.

does not address Duplicate artifact tracking issue. #6313 (see comment)

Additional information

There are a few things that I would like to get feedback on, in particular the generated JSON format is not final. Currently it holds the information listed in the RFC 3553, but it could be further enriched with information only available during builds.

During the implementation a number of questions arose:

Should the graph be packages or crates?
- The unit graph that the SBOM is based on is units. The current SBOM graph is identical to the unit graph, with the run build script nodes merged with building build scripts.
- Artifact dependencies may impact this
Which outputs should get SBOMs files?
- Currently: executables (including examples and tests), dylib, cdylib, staticlib
How do we refer to "normal" dependencies? feat: implement RFC 3553 to add SBOM support #13709 (comment)
What case should we use? feat: implement RFC 3553 to add SBOM support #13709 (comment)
Should this be build.sbom or profile.*.sbom
Is sbom the right name for this?

Thanks @arlosi, @RobJellinghaus and @lfrancke for initial guidance & feedback.

RFC: #RFC: cargo-sbom rfcs#3553

rustbot · 2024-04-05T11:23:56Z

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @ehuss (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

@rustbot author: the review is finished, PR author should check the comments and take action accordingly
@rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

src/cargo/core/compiler/build_runner/mod.rs

heisen-li · 2024-04-07T12:12:11Z

Much respect for your contribution.

From my kind reminders, it seems appropriate to modify the documentation of the corresponding sections, e.g. Configuration, Environment Variables.

weihanglo · 2024-04-07T14:35:13Z

Thanks for the reminder, @heisen-li. Would love to see a doc update, though we should probably focus on the design discussion first, as the location of the configuration is not yet decided. (See rust-lang/rfcs#3553 (comment)).

epage · 2024-04-09T16:02:21Z

One approach for the docs (if this is looking to be merged) is to put the env and config documentation fragments in the Unstable docs.

src/cargo/core/compiler/mod.rs

src/cargo/core/compiler/build_runner/mod.rs

src/cargo/core/compiler/output_sbom.rs

tests/testsuite/sbom.rs

weihanglo

Just note that I reviewed this as-is, didn't really think too much for the design itself. Thank you for working on this!

src/cargo/core/compiler/build_config.rs

src/cargo/core/compiler/output_sbom.rs

bors · 2024-05-03T16:12:02Z

☔ The latest upstream changes (presumably #13571) made this pull request unmergeable. Please resolve the merge conflicts.

weihanglo

Now I like the idea of having this PR to explore SBOM format. I'll post back issues we've found so far to the RFC. Thank you :)

src/cargo/core/compiler/build_runner/mod.rs

src/doc/src/reference/unstable.md

tests/testsuite/sbom.rs

src/cargo/core/compiler/output_sbom.rs

tests/testsuite/sbom.rs

src/cargo/core/compiler/build_runner/mod.rs

src/cargo/core/compiler/build_config.rs

src/cargo/core/compiler/output_sbom.rs

bors · 2024-05-31T22:58:12Z

☔ The latest upstream changes (presumably #13992) made this pull request unmergeable. Please resolve the merge conflicts.

justahero · 2024-06-26T12:55:46Z

Rebased the PR.

tests/testsuite/sbom.rs

bors · 2024-07-04T20:28:52Z

☔ The latest upstream changes (presumably #13900) made this pull request unmergeable. Please resolve the merge conflicts.

bors · 2024-07-26T22:01:39Z

☔ The latest upstream changes (presumably #13947) made this pull request unmergeable. Please resolve the merge conflicts.

bors · 2024-10-04T19:05:52Z

☔ The latest upstream changes (presumably #14576) made this pull request unmergeable. Please resolve the merge conflicts.

arlosi

I've the PR to address most of the feedback from @epage. Thanks!

I re-wrote the algorithm for building the sbom graph and made changes to the format. There's also now documentation for the format in unstable.md that should help reviewers understand what it's looking like.

Before merging, I still want to add more test coverage for additional cases.

src/cargo/core/compiler/output_sbom.rs

arlosi · 2025-02-06T22:46:04Z

src/cargo/core/compiler/output_sbom.rs

+
+/// Describes a package dependency
+#[derive(Serialize, Clone, Debug)]
+struct SbomPackage {


Currently packages, since the crates within the package should have the same dependency set & profile if compiled in the same invocation. The existing algorithm is merging units within the same package.

If there's a reason to move to crates instead and have more nodes in the graph, I'm open to that, but I currently don't see one.

src/cargo/core/compiler/output_sbom.rs

tests/testsuite/sbom/mod.rs

src/doc/src/reference/unstable.md

src/cargo/core/features.rs

src/cargo/core/compiler/build_runner/mod.rs

src/cargo/core/compiler/mod.rs

src/cargo/core/compiler/build_runner/mod.rs

src/doc/src/reference/unstable.md

src/cargo/core/compiler/output_sbom.rs

tests/testsuite/sbom/mod.rs

arlosi · 2025-02-26T20:27:03Z

I've updated the PR and it should be ready for another round of review. Notable changes include:

The graph is no longer combining dependencies within the same package. This means that things like libs and build scripts within a package get unique nodes in the graph.
The SBOM is listed in the JSON output as an output file.
Added a test for RUSTC_WRAPPER

Adds a new option `build.sbom` that adds generation of a JSON file containing dependency information alongside compiled artifacts.

justahero · 2025-02-27T10:37:06Z

Huge thank you @arlosi & to the cargo team for investing the time & effort to get this feature integrated. 🎉

Update cargo 11 commits in 1d1d646c06a84c1aa53967b394b7f1218f85db82..2622e844bc1e2e6123e54e94e4706f7b6195ce3d 2025-02-21 21:38:53 +0000 to 2025-02-28 12:33:57 +0000 - Bump `cc` to 1.2.16 to fix `x86` windows jobs in rust-lang/rust CI (rust-lang/cargo#15245) - refactor(tree): Abstract the concept of a NodeId (rust-lang/cargo#15237) - feat: implement RFC 3553 to add SBOM support (rust-lang/cargo#13709) - refactor(tree): Abstract the concept of an edge (rust-lang/cargo#15233) - chore: bump openssl to v3 (rust-lang/cargo#15232) - fix(package): Register workspace member renames in overlay (rust-lang/cargo#15228) - Implemented `build.build-dir` config option (rust-lang/cargo#15104) - feat: add completions for `--manifest-path` (rust-lang/cargo#15225) - chore: semver-check build-rs against beta channel (rust-lang/cargo#15223) - chore: depend on openssl-sys to correctly pin its version (rust-lang/cargo#15224) - chore: dont check cargo-util semver until 1.86 is released (rust-lang/cargo#15222)

nazar-pc · 2025-03-21T07:19:50Z

Is this supposed to work with cargo rustc (I hope so)? It doesn't complain about the option, but doesn't produce *.cargo-sbom.json file either, while cargo build does.

weihanglo · 2025-03-22T04:24:49Z

IIRC that hasn't yet been discussed, but personally I think it should

rustbot assigned ehuss Apr 5, 2024

rustbot added A-build-execution Area: anything dealing with executing the compiler A-configuration Area: cargo config files and env vars A-unstable Area: nightly unstable support S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 5, 2024

justahero commented Apr 5, 2024

View reviewed changes

src/cargo/core/compiler/build_runner/mod.rs Show resolved Hide resolved

weihanglo reviewed May 2, 2024

View reviewed changes

tests/testsuite/sbom.rs Show resolved Hide resolved

weihanglo reviewed May 2, 2024

View reviewed changes

src/cargo/core/compiler/build_config.rs Outdated Show resolved Hide resolved

src/cargo/core/compiler/build_config.rs Outdated Show resolved Hide resolved

src/cargo/core/compiler/output_sbom.rs Outdated Show resolved Hide resolved

rustbot added the A-documenting-cargo-itself Area: Cargo's documentation label May 6, 2024

justahero marked this pull request as ready for review May 7, 2024 11:53

weihanglo reviewed May 8, 2024

View reviewed changes

weihanglo mentioned this pull request May 8, 2024

RFC: cargo-sbom rust-lang/rfcs#3553

Open

arlosi reviewed May 8, 2024

View reviewed changes

rustbot added the A-testing-cargo-itself Area: cargo's tests label May 28, 2024

justahero requested review from weihanglo and arlosi July 3, 2024 11:14

arlosi reviewed Jul 3, 2024

View reviewed changes

tests/testsuite/sbom.rs Outdated Show resolved Hide resolved

justahero requested a review from arlosi August 5, 2024 13:56

Shnatsel mentioned this pull request Nov 8, 2024

cargo metadata: provide an option not to collect data about dev-dependencies #14794

Open

arlosi reviewed Feb 7, 2025

View reviewed changes

epage reviewed Feb 7, 2025

View reviewed changes

src/cargo/core/features.rs Outdated Show resolved Hide resolved

epage reviewed Feb 7, 2025

View reviewed changes

src/cargo/core/compiler/build_runner/mod.rs Outdated Show resolved Hide resolved

epage reviewed Feb 7, 2025

View reviewed changes

src/cargo/core/compiler/mod.rs Outdated Show resolved Hide resolved

epage reviewed Feb 7, 2025

View reviewed changes

src/cargo/core/compiler/build_runner/mod.rs Show resolved Hide resolved

epage reviewed Feb 7, 2025

View reviewed changes

src/cargo/core/compiler/build_runner/mod.rs Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

weihanglo reviewed Feb 13, 2025

View reviewed changes

src/doc/src/reference/unstable.md Show resolved Hide resolved

src/doc/src/reference/unstable.md Outdated Show resolved Hide resolved

src/cargo/core/compiler/output_sbom.rs Outdated Show resolved Hide resolved

src/cargo/core/compiler/output_sbom.rs Show resolved Hide resolved

epage reviewed Feb 19, 2025

View reviewed changes

tests/testsuite/sbom/mod.rs Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

rustbot added A-cfg-expr Area: Platform cfg expressions A-dep-info Area: dep-info, .d files A-layout Area: target output directory layout, naming, and organization A-rebuild-detection Area: rebuild detection and fingerprinting labels Feb 26, 2025

feat: Add SBOM pre-cursor files

5f833db

Adds a new option `build.sbom` that adds generation of a JSON file containing dependency information alongside compiled artifacts.

epage approved these changes Feb 26, 2025

View reviewed changes

epage enabled auto-merge February 26, 2025 20:59

epage added this pull request to the merge queue Feb 26, 2025

Merged via the queue into rust-lang:master with commit 7ea222d Feb 26, 2025
23 checks passed

weihanglo mentioned this pull request Feb 28, 2025

Update cargo rust-lang/rust#137791

Merged

rustbot added this to the 1.87.0 milestone Feb 28, 2025

taiki-e mentioned this pull request Mar 1, 2025

Support -Z sbom taiki-e/upload-rust-binary-action#97

Open

messense mentioned this pull request May 6, 2025

PEP 770 (SBOM) support PyO3/maturin#2554

Open

Shnatsel mentioned this pull request Jun 24, 2025

Cargo fingerprint doesn't include SBOM #15695

Open

feat: implement RFC 3553 to add SBOM support #13709

feat: implement RFC 3553 to add SBOM support #13709

Uh oh!

Conversation

justahero commented Apr 5, 2024 • edited by epage Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR try to resolve?

How should we test and review this PR?

What does the PR not solve?

Additional information

Uh oh!

rustbot commented Apr 5, 2024

Uh oh!

Uh oh!

heisen-li commented Apr 7, 2024

Uh oh!

weihanglo commented Apr 7, 2024

Uh oh!

epage commented Apr 9, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

weihanglo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bors commented May 3, 2024

Uh oh!

weihanglo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bors commented May 31, 2024

Uh oh!

justahero commented Jun 26, 2024

Uh oh!

Uh oh!

bors commented Jul 4, 2024

Uh oh!

bors commented Jul 26, 2024

Uh oh!

bors commented Oct 4, 2024

Uh oh!

arlosi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arlosi Feb 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justahero commented Apr 5, 2024 •

edited by epage

Loading

weihanglo commented Mar 22, 2025 •

edited

Loading