diff --git a/.github/workflows/build_and_test_ebclfsa.yml b/.github/workflows/build_and_test_ebclfsa.yml index afb4f554e1e..86ff50df68d 100644 --- a/.github/workflows/build_and_test_ebclfsa.yml +++ b/.github/workflows/build_and_test_ebclfsa.yml @@ -45,7 +45,7 @@ jobs: run: | bazel build --lockfile_mode=error --config=eb-aarch64 //images/ebclfsa_aarch64:run - name: Upload test logs - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@604875ba63842e1d9f9aee9c783174be8b5afc23 # v5.0.0 with: name: test-logs path: | diff --git a/.github/workflows/build_and_test_linux.yml b/.github/workflows/build_and_test_linux.yml index 39f9fa2527f..6c559e1fb95 100644 --- a/.github/workflows/build_and_test_linux.yml +++ b/.github/workflows/build_and_test_linux.yml @@ -32,9 +32,11 @@ jobs: - name: Clean disk space uses: eclipse-score/more-disk-space@v1 - name: Checkout repository - uses: actions/checkout@v4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3.8.0 + uses: docker/setup-buildx-action@d707e0a9f13ec3f37a07b96fc8d8ce2ae8bb7557 # v3.8.0 + - name: Setup Bazel uses: bazel-contrib/setup-bazel@0.18.0 with: @@ -42,9 +44,21 @@ jobs: disk-cache: ${{ github.workflow }} repository-cache: true cache-save: ${{ github.event_name == 'push' }} - - name: Build image + + - name: Install uv (required for SBOM license scanning) + uses: astral-sh/setup-uv@v5 + with: + enable-cache: false + - name: Build image and product SBOM run: | - bazel build --lockfile_mode=error --config=linux-x86_64 //images/linux_x86_64:image + bazel build --lockfile_mode=error --config=linux-x86_64 \ + //images/linux_x86_64:image \ + //:sbom - name: Integration tests run: | bazel test --lockfile_mode=error --config=linux-x86_64 //feature_integration_tests/itf + - name: Upload product SBOM + uses: actions/upload-artifact@b4b15b6c7981bb8d8f533a89aa19f67a4b7b679e # v4.4.1 + with: + name: sbom-spdx + path: bazel-bin/sbom.spdx.json diff --git a/.github/workflows/test_and_docs.yml b/.github/workflows/test_and_docs.yml index e643406fc02..3f1dfbd11a5 100644 --- a/.github/workflows/test_and_docs.yml +++ b/.github/workflows/test_and_docs.yml @@ -73,6 +73,13 @@ jobs: - name: Execute Feature Integration Tests run: | bazel test --config=linux-x86_64 //feature_integration_tests/test_cases:fit + - name: Install uv (required for SBOM license scanning) + uses: astral-sh/setup-uv@v5 + with: + enable-cache: false + - name: Build build tools SBOM + run: | + bazel build --lockfile_mode=error //:build_tools_sbom - name: Publish build summary if: always() run: | @@ -102,6 +109,10 @@ jobs: files: ${{ github.event.repository.name }}_test_reports.zip env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Upload build tools SBOM to release + uses: softprops/action-gh-release@v1 + with: + files: bazel-bin/build_tools_sbom.spdx.json - name: Install Graphviz uses: eclipse-score/apt-install@main with: @@ -122,7 +133,7 @@ jobs: bazel run //scripts/tooling -- misc html_report --output ${CURRENT}/_build/status_dashboard.html tar -cf github-pages.tar _build - name: Upload documentation artifact - uses: actions/upload-artifact@v4.4.0 + uses: actions/upload-artifact@b4b15b6c7981bb8d8f533a89aa19f67a4b7b679e # v4.4.1 with: name: github-pages-${{ github.event.pull_request.head.sha || github.sha }} path: github-pages.tar diff --git a/.gitignore b/.gitignore index b719861b67c..678f4cddfac 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,6 @@ __pycache__/ /.gita-workspace.csv /build artifacts + +#Macos +.DS_Store diff --git a/BUILD b/BUILD index 24fe9e51ef7..f883ae13ed5 100644 --- a/BUILD +++ b/BUILD @@ -12,6 +12,7 @@ # ******************************************************************************* load("@score_docs_as_code//:docs.bzl", "docs") +load("@score_sbom//:defs.bzl", "sbom") load("@score_tooling//:defs.bzl", "setup_starpls", "use_format_targets") # Docs-as-code @@ -45,6 +46,72 @@ use_format_targets() exports_files([ "MODULE.bazel", + "MODULE.bazel.lock", "pyproject.toml", "known_good.json", ]) + +sbom( + name = "sbom", + auto_cdxgen = False, + auto_crates_cache = True, + component_name = "score_reference_integration", + generation_context = "build", + module_lockfiles = [":MODULE.bazel.lock"], + output_formats = [ + "spdx", + ], + targets = [ + "//feature_integration_tests/test_scenarios/cpp:cpp_test_scenarios", + "//feature_integration_tests/test_scenarios/rust:rust_test_scenarios", + "//showcases/cli:cli", + "//showcases/orchestration_persistency:orch_per_example", + "@score_communication//score/mw/com/example/com-api-example:com-api-example", + "@score_kyron//examples:main_macro", + "@score_kyron//examples:safety_task", + "@score_kyron//examples:select", + "@score_logging//score/test/component/dlt_generator_app:dlt_generator", + "@score_logging//score/test/component/logging_app:logging_app", + "@score_time//examples/time/high_res_steady_time", + "@score_time//examples/time/steady_time", + "@score_time//examples/time/system_time", + "@score_time//examples/time/vehicle_time", + ], +) + +# Product SBOM alias with an explicit lifecycle-oriented name. +alias( + name = "product_sbom", + actual = ":sbom", + visibility = ["//visibility:public"], +) + +# Qualification inventory for Python-based build and test tools. This is kept +# separate from the product SBOM because build-time dependencies are not +# product/runtime dependencies. +sbom( + name = "build_tools_sbom", + testonly = True, + auto_cdxgen = False, + auto_crates_cache = False, + component_name = "score_reference_integration_build_tools", + # Pip repositories are represented authoritatively by python_lockfiles; + # exclude their generated Bazel aliases to avoid duplicate components. + exclude_patterns = ["rules_python++pip+"], + generation_context = "build", + java_files = ["@score_docs_as_code//src:plantuml.jar"], + output_formats = ["spdx"], + python_lockfiles = [ + "//feature_integration_tests/test_cases:requirements.txt.lock", + "//scripts/tooling:requirements.txt", + "@score_docs_as_code//src:requirements_lock", + ], + targets = [ + "//:docs_combo_experimental", + "//feature_integration_tests/test_scenarios/cpp:cpp_test_scenarios", + "//scripts/tooling:checkout_repos", + "//scripts/tooling:recategorize_guidelines", + "//scripts/tooling:tooling", + "@score_docs_as_code//src:plantuml", + ], +) diff --git a/MODULE.bazel b/MODULE.bazel index df2e3a8995e..6875b7a4957 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -81,3 +81,25 @@ git_override( commit = "2792e2daee2cf524fdc7b1545fd3537791ebc36c", remote = "https://github.com/bmw-software-engineering/lobster.git", ) + +sbom_ext = use_extension("@score_sbom//:extensions.bzl", "sbom_metadata") +sbom_ext.track_module(name = "score_sbom") +sbom_ext.track_module(name = "score_baselibs") +sbom_ext.track_module(name = "score_communication") +sbom_ext.track_module(name = "score_persistency") +sbom_ext.track_module(name = "score_orchestrator") +sbom_ext.track_module(name = "score_kyron") +sbom_ext.track_module(name = "score_lifecycle_health") +sbom_ext.track_module(name = "score_logging") +sbom_ext.track_module(name = "score_time") +sbom_ext.track_module(name = "score_crates") +sbom_ext.track_module(name = "score_itf") +sbom_ext.track_module(name = "score_tooling") +sbom_ext.track_module(name = "score_platform") +sbom_ext.track_module(name = "score_bazel_platforms") +sbom_ext.track_module(name = "score_test_scenarios") +sbom_ext.track_module(name = "score_docs_as_code") +sbom_ext.track_module(name = "score_process") +sbom_ext.track_module(name = "trlc") +sbom_ext.track_module(name = "lobster") +use_repo(sbom_ext, "sbom_metadata") diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index c9eb12e0be6..69b01cc688c 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -1025,6 +1025,8 @@ "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_rust_policies/0.0.3/MODULE.bazel": "9e8310a75c13ccebc49fb9cbf7acc6c1b75654292b2ca907fb5d513133dbf6f3", "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_rust_policies/0.0.5/MODULE.bazel": "7de02547bdf121d3dedf5141b97f0fd9a545bd255ff5c7b699056b35816ffad9", "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_rust_policies/0.0.5/source.json": "22c8bf0a5cbf7c7b06f774f3f66498e0bc14346a8b2208f7427a8fbb78a42547", + "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_sbom/0.0.2/MODULE.bazel": "eaddaa984143fc540c48d59988976db82a5ff40b6264df41ad097b520c213201", + "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_sbom/0.0.2/source.json": "757694093b76ab165663f67987abe7c84a049fb4a5489ee98eccaf5a3fd8da5c", "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_toolchains_rust/0.8.0/MODULE.bazel": "ea57a9a4dcb8ad49f4556f824500eb559365f413ccbb39d70d0b363685aacec5", "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/score_toolchains_rust/0.8.0/source.json": "394a615e03ad722bc27bd4a6f098c6ff2fe7120b69cdf3925d47e39d30ada8a4", "https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/modules/stardoc/0.5.0/MODULE.bazel": "not found", @@ -9892,6 +9894,45 @@ ] } }, + "@@score_sbom+//:extensions.bzl%sbom_metadata": { + "general": { + "bzlTransitiveDigest": "6MZmMjhsKcOnMq12Rbna7aYgF4ZAbEtH3kjZYu4M5nI=", + "usagesDigest": "9i7n8SjRs3isUDHbGTLmCZHFqJDV0njGZIidi0RDBkc=", + "recordedFileInputs": {}, + "recordedDirentsInputs": {}, + "envVariables": {}, + "generatedRepoSpecs": { + "sbom_metadata": { + "repoRuleId": "@@score_sbom+//:extensions.bzl%_sbom_metadata_repo", + "attributes": { + "metadata_content": "{\"crates\":{},\"git_repositories\":{},\"http_archives\":{},\"licenses\":{},\"modules\":{}}", + "tracked_modules": [ + "score_sbom", + "score_baselibs", + "score_communication", + "score_persistency", + "score_orchestrator", + "score_kyron", + "score_lifecycle_health", + "score_logging", + "score_time", + "score_crates", + "score_itf", + "score_tooling", + "score_platform", + "score_bazel_platforms", + "score_test_scenarios", + "score_docs_as_code", + "score_process", + "trlc", + "lobster" + ] + } + } + }, + "recordedRepoMappingEntries": [] + } + }, "@@score_toolchains_rust+//extensions:ferrocene_toolchain_ext.bzl%ferrocene_toolchain_ext": { "general": { "bzlTransitiveDigest": "XEgifqjEEdSGw80RccoJ/aUy9smsRXQJ9jO4RDOf2vk=", diff --git a/README.md b/README.md index 24643df8390..be07e870078 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,72 @@ Cross-compile all showcases and assemble the IFS image: bazel build --config=qnx-aarch64 //images/qnx_aarch64:image ``` +### Software Bill of Materials + +The root `//:sbom` target generates SPDX 2.3 and CycloneDX 1.6 documents for +the integrated showcase and feature-test binaries. It consumes `sbom-tool` +from the local git checkout at `../sbom-tool` in this workspace until the +module is available in the Bazel registry. + +Install Node.js/npm and `@cyclonedx/cdxgen` before building the C++ dependency +metadata, then run: + +```bash +npm install -g @cyclonedx/cdxgen +bazel build //:sbom +``` + +The generated documents are written below `bazel-bin/` as `sbom.spdx.json` and +`sbom.cdx.json`. Rust crate metadata is collected automatically from the +workspace lockfile and the configured `score_crates` module. + +### Selecting an SBOM mode + +Choose the mode based on what is being qualified: + +- **Product mode** is for the software delivered by the integration. It follows + the configured showcase and feature-test binaries and includes their runtime + dependencies. Use `//:product_sbom` (an alias of `//:sbom`) when you need both + SPDX and CycloneDX output for the product scope. +- **Build-tool qualification mode** is for tools used to build, test, or + generate documentation. It is separate from the product scope because these + tools are not shipped as product runtime dependencies. Use + `//:build_tools_sbom` when collecting ISO 26262 qualification evidence for + the development toolchain. + +Build-tool mode includes the Python lockfiles used by the workspace tooling and +docs-as-code, the Sphinx documentation toolchain, the PlantUML integration, and +the PlantUML JAR itself with a SHA-256 checksum. It emits SPDX only and does +not run cdxgen or the Rust crate cache collector. + +Build the selected mode as follows: + +```bash +# Product/runtime dependencies +bazel build //:product_sbom +# Outputs: bazel-bin/product_sbom.spdx.json and bazel-bin/product_sbom.cdx.json + +# Build-tool qualification inventory (SPDX JSON) +bazel build //:build_tools_sbom +# Output: bazel-bin/build_tools_sbom.spdx.json +``` + +While testing the unpublished Python collector branch of `sbom-tool`, resolve +it with the module override below. Apply the override to whichever mode you are +building: + +```bash +bazel build //:product_sbom \ + --override_module=score_sbom=/workspaces/sbom-tool + +bazel build //:build_tools_sbom \ + --override_module=score_sbom=/workspaces/sbom-tool +``` + +Once the collector branch is merged, replace this command-line override with +the merged commit in the root `MODULE.bazel` git override. + +## Operating system integrations The built IFS image is written to: ``` diff --git a/bazel_common/score_modules_tooling.MODULE.bazel b/bazel_common/score_modules_tooling.MODULE.bazel index 9d7cf8bf73c..27b65feb4fc 100644 --- a/bazel_common/score_modules_tooling.MODULE.bazel +++ b/bazel_common/score_modules_tooling.MODULE.bazel @@ -69,3 +69,9 @@ git_override( commit = "8df530cab5efcb40e9f835ba6e9b61ae2f0175c7", remote = "https://github.com/eclipse-score/process_description.git", ) + +bazel_dep(name = "score_sbom") +single_version_override( + module_name = "score_sbom", + version = "0.0.2", +) diff --git a/feature_integration_tests/test_cases/BUILD b/feature_integration_tests/test_cases/BUILD index dcf8ab0542b..18d0b24212f 100644 --- a/feature_integration_tests/test_cases/BUILD +++ b/feature_integration_tests/test_cases/BUILD @@ -14,6 +14,8 @@ load("@pip_score_venv_test//:requirements.bzl", "all_requirements") load("@rules_python//python:pip.bzl", "compile_pip_requirements") load("@score_tooling//python_basics:defs.bzl", "score_py_pytest") +exports_files(["requirements.txt.lock"]) + # In order to update the requirements, change the `requirements.txt` file and run: # `bazel run //feature_integration_tests/test_cases:requirements.update`. # This will update the `requirements.txt.lock` file. diff --git a/images/ebclfsa_aarch64/build/BUILD b/images/ebclfsa_aarch64/build/BUILD deleted file mode 100644 index 11b211e6757..00000000000 --- a/images/ebclfsa_aarch64/build/BUILD +++ /dev/null @@ -1,72 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* -load("@rules_pkg//pkg:tar.bzl", "pkg_tar") - -genrule( - name = "extract-fastdev-image", - srcs = ["@eb_corbos_toolkit_fastdev_archive//file"], - outs = [ - "ebcl-qemuarm64/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64.wic", - "ebcl-qemuarm64/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64-vmlinux", - ], - cmd = "tar xzf $(location @eb_corbos_toolkit_fastdev_archive//file) -C $(RULEDIR)/ebcl-qemuarm64 && chmod +w $(RULEDIR)/ebcl-qemuarm64/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64.wic && ls -lah $(RULEDIR)/ebcl-qemuarm64/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64.wic > /tmp/foo", - visibility = [ - "//visibility:public", - ], -) - -pkg_tar( - name = "crinit_config_tar", - srcs = [ - "//images/ebclfsa_aarch64/build/config-overlay:etc/crinit/crinit.d/getty-console.crinit", - ], - mode = "0755", - package_dir = "/etc/crinit/crinit.d", -) - -pkg_tar( - name = "scripts_tar", - srcs = [ - "//images/ebclfsa_aarch64/build/config-overlay:usr/bin/delayed-start.sh", - ], - mode = "0755", - package_dir = "/usr/bin", -) - -genrule( - name = "fastdev-image", - srcs = [ - "//showcases:showcases_pkg_tar", - "//feature_integration_tests/configs:etc_configs", - ":extract-fastdev-image", - ":crinit_config_tar", - ":scripts_tar", - "build_image.sh", - ], - outs = [ - "ebcl-qemuarm64-deployed/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64.wic", - "ebcl-qemuarm64-deployed/fastdev-ubuntu-ebclfsa-ebcl-qemuarm64-vmlinux", - ], - cmd = " \ - $(location build_image.sh) \ - $(RULEDIR) \ - $(RULEDIR)/ebcl-qemuarm64 \ - $(RULEDIR)/ebcl-qemuarm64-deployed \ - $(location //showcases:showcases_pkg_tar) \ - $(location :crinit_config_tar) \ - $(location :scripts_tar) \ - ", - visibility = [ - "//visibility:public", - ], -) diff --git a/images/ebclfsa_aarch64/build/build_image.sh b/images/ebclfsa_aarch64/build/build_image.sh deleted file mode 100755 index 04712c3d095..00000000000 --- a/images/ebclfsa_aarch64/build/build_image.sh +++ /dev/null @@ -1,119 +0,0 @@ -#!/bin/bash -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -set -uoex pipefail - -if [[ $# -lt 4 ]]; then - echo "Error: Expected at least 4 arguments (working directoy, image source location, image target location, and one or more tar files to deploy relative to the root of the image)" >&2 - exit 1 -fi - -# Check if sshpass is installed -if ! command -v sshpass &> /dev/null; then - echo "Error: sshpass is not installed. Please install it to proceed." >&2 - exit 1 -fi - -WORKING_DIR="$1" -IMAGE_SOURCE="$2" -IMAGE_TARGET="$3" -shift 3 -DEPLOY_SRCS=("$@") - -# Validate that the source directory exists -if [[ ! -d "$IMAGE_SOURCE" ]]; then - echo "Error: Image source location is not a directory: $IMAGE_SOURCE" >&2 - exit 1 -fi - -# Check for .wic file -if ! find "$IMAGE_SOURCE" -maxdepth 1 \( -name "*.wic" -type f -o -name "*.wic" -type l \) | grep -q .; then - echo "Error: No .wic file found in $IMAGE_SOURCE" >&2 - exit 1 -fi - -# Check for vmlinux file -if ! find "$IMAGE_SOURCE" -maxdepth 1 \( -name "*vmlinux" -type f -o -name "*vmlinux" -type l \) | grep -q .; then - echo "Error: No vmlinux file found in $IMAGE_SOURCE" >&2 - exit 1 -fi - -# Validate that the target directory exists -if [[ ! -d "$IMAGE_TARGET" ]]; then - echo "Error: Image target location is not a directory: $IMAGE_TARGET" >&2 - exit 1 -fi - -# Validate that each deploy source exists -for src in "${DEPLOY_SRCS[@]}"; do - if [[ ! -f "$src" ]]; then - echo "Error: Deploy source file does not exist: $src" >&2 - exit 1 - fi - # Check if the file is a tar file - if [[ ! "$src" =~ \.tar(\.(gz|bz2|xz))?$ ]]; then - echo "Error: Deploy source is not a tar file: $src" >&2 - exit 1 - fi -done - -# Clear target directory and copy source directory content to target directory -mkdir -p "$IMAGE_TARGET" -rm -f "${IMAGE_TARGET:?}/"* -cp -L "$IMAGE_SOURCE"/* "$IMAGE_TARGET"/ - -IMAGE=$(find "$IMAGE_TARGET" -maxdepth 1 \( -name "*.wic" -type f -o -name "*.wic" -type l \) -print -quit) -KERNEL=$(find "$IMAGE_TARGET" -maxdepth 1 \( -name "*vmlinux" -type f -o -name "*vmlinux" -type l \) -print -quit) - -# the image file needs to be writable for qemu to run, so we change the permissions here -chmod +w "$IMAGE" - -qemu-system-aarch64 -m 2048 -cpu cortex-a53 -machine virt \ - -kernel "$KERNEL" \ - -machine "virt,virtualization=true,gic-version=3" \ - -smp 8 \ - -device virtio-blk-device,drive=vd0 -drive if=none,format=raw,file="${IMAGE}",id=vd0 \ - -append "root=/dev/vda1 sdk_enable lisa_syscall_whitelist=2026 rw sharedmem.enable_sharedmem=0 init=/usr/bin/ebclfsa-cflinit" \ - -netdev user,id=net0,net=192.168.7.0/24,dhcpstart=192.168.7.2,dns=192.168.7.3,host=192.168.7.5,hostfwd=tcp::2222-:22,hostfwd=tcp::3333-:3333 -device virtio-net-device,netdev=net0 \ - -pidfile "$WORKING_DIR/qemu.pid" \ - -nographic \ - > "$WORKING_DIR/qemu_deployment.log" \ - & - -# Wait for QEMU to be accessible via SSH -for i in {1..60}; do - if sshpass -p linux ssh -o StrictHostKeyChecking=no -o ConnectTimeout=1 -p 2222 root@localhost true 2>/dev/null; then - echo "QEMU is accessible" - break - fi - echo "Waiting for QEMU to be ready... ($i/60)" - sleep 1 -done - -# deploy files to QEMU via scp -for src in "${DEPLOY_SRCS[@]}"; do - sshpass -p linux scp -rp -o StrictHostKeyChecking=no -P 2222 "$src" root@localhost:/ - sshpass -p linux ssh -o StrictHostKeyChecking=no -p 2222 root@localhost "tar -xf /$(basename "$src") -C /" - sshpass -p linux ssh -o StrictHostKeyChecking=no -p 2222 root@localhost "rm -f /$(basename "$src")" -done - -# Shutdown QEMU via SSH -sshpass -p linux ssh -o StrictHostKeyChecking=no -p 2222 root@localhost sync -sshpass -p linux ssh -o StrictHostKeyChecking=no -p 2222 root@localhost crinit-ctl poweroff || true - -# Wait for QEMU process to finish -if [[ -f "$WORKING_DIR/qemu.pid" ]]; then - wait "$(cat "$WORKING_DIR/qemu.pid")" 2>/dev/null || true - rm -f "$WORKING_DIR/qemu.pid" -fi diff --git a/images/ebclfsa_aarch64/build/config-overlay/BUILD b/images/ebclfsa_aarch64/build/config-overlay/BUILD deleted file mode 100644 index 535b52d54c4..00000000000 --- a/images/ebclfsa_aarch64/build/config-overlay/BUILD +++ /dev/null @@ -1,18 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2026 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* -exports_files( - [ - "usr/bin/delayed-start.sh", - "etc/crinit/crinit.d/getty-console.crinit", - ], -) diff --git a/images/ebclfsa_aarch64/build/config-overlay/etc/crinit/crinit.d/getty-console.crinit b/images/ebclfsa_aarch64/build/config-overlay/etc/crinit/crinit.d/getty-console.crinit deleted file mode 100644 index 8dcdda7e874..00000000000 --- a/images/ebclfsa_aarch64/build/config-overlay/etc/crinit/crinit.d/getty-console.crinit +++ /dev/null @@ -1,7 +0,0 @@ -NAME = getty-console - -COMMAND = /usr/bin/setsid /sbin/getty --login-program /usr/bin/delayed-start.sh --autologin root 115200 console - -RESPAWN = YES -DEPENDS = "" -RESPAWN_RETRIES = 3 diff --git a/images/ebclfsa_aarch64/build/config-overlay/usr/bin/delayed-start.sh b/images/ebclfsa_aarch64/build/config-overlay/usr/bin/delayed-start.sh deleted file mode 100755 index 81d0dc8b731..00000000000 --- a/images/ebclfsa_aarch64/build/config-overlay/usr/bin/delayed-start.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/sh -# ******************************************************************************* -# Copyright (c) 2026 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* -sleep 2 -/showcases/bin/cli diff --git a/images/qnx_aarch64/build/BUILD b/images/qnx_aarch64/build/BUILD deleted file mode 100644 index ca5c4d35043..00000000000 --- a/images/qnx_aarch64/build/BUILD +++ /dev/null @@ -1,72 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -load("@score_rules_imagefs//rules/qnx:ifs.bzl", "qnx_ifs") - -filegroup( - name = "scripts", - srcs = [ - "//images/qnx_aarch64/configs:startup.sh", - ], - visibility = ["//visibility:private"], -) - -filegroup( - name = "configs", - srcs = [ - "//images/qnx_aarch64/configs:dhcpcd.conf", - "//images/qnx_aarch64/configs:group", - "//images/qnx_aarch64/configs:hostname", - "//images/qnx_aarch64/configs:network_capture.sh", - "//images/qnx_aarch64/configs:network_setup.sh", - "//images/qnx_aarch64/configs:network_setup_dhcp.sh", - "//images/qnx_aarch64/configs:passwd", - "//images/qnx_aarch64/configs:profile", - "//images/qnx_aarch64/configs:qcrypto.conf", - "//images/qnx_aarch64/configs:ssh_host_rsa_key", - "//images/qnx_aarch64/configs:ssh_host_rsa_key.pub", - "//images/qnx_aarch64/configs:sshd_config", - ], - visibility = ["//visibility:private"], -) - -qnx_ifs( - name = "init", - srcs = [ - ":configs", - ":scripts", - ":system.build", - ":system_dir", - "//feature_integration_tests/configs:etc_configs", - "//feature_integration_tests/configs/datarouter:etc_configs", - "//showcases", - "@score_logging//score/datarouter", - "@score_persistency//tests/test_scenarios/cpp:test_scenarios", - ], - build_file = "init.build", - ext_repo_maping = { - "BUNDLE_PATH": "$(location //showcases:showcases)", - "DATAROUTER_PATH": "$(location @score_logging//score/datarouter:datarouter)", - }, - visibility = [ - "//visibility:public", - ], -) - -filegroup( - name = "system_dir", - srcs = [ - "init.build", - "system.build", - ], -) diff --git a/images/qnx_aarch64/build/init.build b/images/qnx_aarch64/build/init.build deleted file mode 100644 index 3f8be6768df..00000000000 --- a/images/qnx_aarch64/build/init.build +++ /dev/null @@ -1,98 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - - -############################################################################### -# -# Example image built based on minimal configuration from QNX -# -############################################################################### - -[-optional] - -[image=0x3600000] # Set image size to 56MB (0x3600000 bytes) -[virtual=aarch64le,raw -compress] boot = { # Configure for aarch64le architecture with raw compressed boot - # TODO: replace startup-virt with the actual aarch64 startup binary for the target BSP. - # QNX SDP 8.0.0 ships no generic QEMU-virt startup; source one from the appropriate BSP. - startup-virt -v # Start aarch64 kernel - board-specific startup binary required - PATH=/proc/boot # Set executable search path to boot directory - LD_LIBRARY_PATH=/proc/boot # Set library search path to boot directory - [+keeplinked] procnto-smp-instr # Keep process manager linked and instrumented for SMP -} - -[+script] startup-script = { # Define startup script that runs during boot - procmgr_symlink /dev/shmem /tmp # Create symbolic link from shared memory to /tmp - # /tmp will be mounted later as a proper RAM disk - - display_msg Welcome to QNX OS 8.0 on aarch64 tweaked for S-CORE! # Display welcome message - - # These env variables get inherited by all programs which follow - SYSNAME=nto # Set system name to "nto" (Neutrino) - TERM=qansi # Set terminal type to QNX ANSI - - devc-ser8250 & # Start serial driver in background - waitfor /dev/ser1 # Wait for serial device to be available - reopen /dev/ser1 # Reopen serial device for console I/O - - display_msg Placeholder for startup script # Display startup message - etc/startup.sh # Execute main startup script - - [+session] /bin/sh & # Start shell session in background -} - -# Essential utilities - core system commands needed for basic operation -# These binaries provide fundamental system functionality and process management - -# Process and system management utilities -on # Command execution utility - runs commands with specific options -[type=link] waitfor=on # Create symbolic link: waitfor -> on (waits for resources to become available) -[type=link] ability=on # Create symbolic link: ability -> on (manages process abilities/privileges) - -# Shell and command interpreter -ksh # Korn shell - provides command-line interface and scripting -pidin # Process information display - shows running processes (like 'ps' on Linux) -[type=link] /bin/sh=/proc/boot/ksh # Create symbolic link: sh -> ksh (standard shell link) - -# File system utilities -mount # File system mount utility - mounts/unmounts file systems -getconf # System configuration query utility - retrieves system parameters -[type=link] setconf=getconf # Create symbolic link: setconf -> getconf (sets configuration parameters) - -# Device drivers for hardware access -devc-ser8250 # Serial port driver for 8250/16550 UART controllers (console access) - -# System logging utilities -slog2info # System log viewer - displays logged messages -slogger2 # System logging daemon - collects and manages log messages - -# Essential libraries - core runtime libraries required for system operation -# These libraries provide fundamental services like C runtime, networking, and logging - -# Standard C library - provides basic C runtime functions -libc.so.6 # Main C library (malloc, printf, file I/O, etc.) - -# Dynamic linker/loader - handles dynamic library loading at runtime -/usr/lib/ldqnx-64.so.2=ldqnx-64.so.2 # 64-bit QNX dynamic linker (loads shared libraries) - -# Networking library - provides socket and network communication functions -libsocket.so.4 # Socket library (TCP/IP, UDP, network I/O functions) -[type=link] libsocket.so=libsocket.so.4 # Create version-neutral symbolic link - -# System logging library - provides logging services for applications -libslog2.so.1 # System logging library (slog2_* functions) -[type=link] libslog2.so=libslog2.so.1 # Create version-neutral symbolic link - -# Orchestrator example needed -[type=link] /data=/tmp_ram - -[+include] ${MAIN_BUILD_FILE_DIR}/system.build # Include additional system build configurations diff --git a/images/qnx_aarch64/build/system.build b/images/qnx_aarch64/build/system.build deleted file mode 100644 index 190f56fa7ff..00000000000 --- a/images/qnx_aarch64/build/system.build +++ /dev/null @@ -1,289 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - - -# ============================================================================ -# QNX System Build File - Defines system partition contents -# ============================================================================ -# This file defines the contents of the QNX system partition, including -# essential utilities, libraries, configuration files, and system services -# needed for a minimal QNX QEMU environment. - -############################################# -### SHARED LIBRARIES ### -############################################# -# Essential shared libraries for system operation - -libfsnotify.so.1 # File system notification library -cam-cdrom.so # CAM (Common Access Method) CD-ROM driver -cam-disk.so # CAM disk driver for storage devices -fs-dos.so # DOS file system support -fs-qnx6.so # QNX6 file system support -io-blk.so # Block I/O manager -libbz2.so.1 # BZip2 compression library -libc++.so.2 # C++ standard library -libc.so # C standard library (essential) -libcam.so.2 # CAM library for device access -libcatalog.so.1 # Message catalog support -libcrypto.so.3 # OpenSSL crypto library (disabled) -libfscrypto.so.1 # File system encryption support -libgcc_s.so.1 # GCC runtime support library -libiconv.so.1 # Character encoding conversion -liblzma.so.5 # LZMA compression library -libm.so # Math library -libpci.so.3.0 # PCI library v3.0 for hardware access -libqcrypto.so.1.0 # QNX cryptographic library -libqh.so # QNX helper library -libregex.so.1 # Regular expression library -libsecpol.so.1 # Security policy library -libslog2parse.so.1 # System log parsing library -libssl.so.3 # OpenSSL SSL/TLS library (disabled) -libtracelog.so.1 # Trace logging library -libxml2.so.2 # XML parsing library -libz.so # Zlib compression library -libexpat.so.2 # Expat XML parser library -libjail.so.1 # QNX jail library for process containment -qcrypto-openssl-3.so # QNX cryptographic library with OpenSSL 3 support -libpam.so.2 # Pluggable Authentication Modules library - - -############################################# -### FILE MANIPULATION UTILITIES ### -############################################# -# Core file system utilities - most are provided by toybox (minimal Unix utilities) - -[type=link] /bin/ls=/proc/boot/ls # Link ls to IFS version for compatibility -# Note: /bin/sh symlink already defined in init.build as /proc/boot/ksh -toybox # Minimal Unix utilities collection (replaces many GNU tools) -[type=link] cp=toybox # Copy files and directories -[type=link] ls=toybox # List directory contents -[type=link] cat=toybox # Display file contents -[type=link] chmod=toybox # Change file permissions -[type=link] rm=toybox # Remove files and directories -[type=link] dd=toybox # Convert and copy files with specified I/O block size -[type=link] echo=toybox # Display text -[type=link] grep=toybox # Search text patterns in files -[type=link] mkdir=toybox # Create directories -[type=link] ascii=toybox # Display ASCII character set -[type=link] base64=toybox # Base64 encoding/decoding utility -[type=link] basename=toybox # Extract filename from path -[type=link] bc=toybox # Basic calculator -[type=link] bunzip2=toybox # Decompress bzip2 files -[type=link] bzcat=toybox # Display contents of bzip2 files -[type=link] cal=toybox # Display calendar -[type=link] chgrp=toybox # Change group ownership -[type=link] chown=toybox # Change file ownership -[type=link] cksum=toybox # Calculate checksums -[type=link] clear=toybox # Clear terminal screen -[type=link] cmp=toybox # Compare files byte by byte -[type=link] comm=toybox # Compare sorted files line by line -[type=link] cpio=toybox # Copy files to/from archives -[type=link] crc32=toybox # Calculate CRC32 checksums -[type=link] cut=toybox # Extract columns from files -[type=link] date=toybox # Display or set system date -[type=link] diff=toybox # Compare files line by line -[type=link] dirname=toybox # Extract directory from path -[type=link] dos2unix=toybox # Convert DOS line endings to Unix -[type=link] du=toybox # Display disk usage -[type=link] egrep=toybox # Extended grep with regular expressions -[type=link] env=toybox # Display or set environment variables -[type=link] expand=toybox # Convert tabs to spaces -[type=link] expr=toybox # Evaluate expressions -[type=link] false=toybox # Return false status -[type=link] fgrep=toybox # Fast grep for fixed strings -[type=link] file=toybox # Determine file type -[type=link] find=toybox # Search for files and directories -[type=link] fmt=toybox # Format text paragraphs -[type=link] groups=toybox # Display user group membership -[type=link] gunzip=toybox # Decompress gzip files -[type=link] gzip=toybox # Compress files with gzip -[type=link] hd=toybox # Hexadecimal dump (alias for hexdump) -[type=link] head=toybox # Display first lines of files -[type=link] hexdump=toybox # Display files in hexadecimal format -[type=link] id=toybox # Display user and group IDs -[type=link] install=toybox # Copy files and set attributes -[type=link] link=toybox # Create hard links -[type=link] logname=toybox # Display login name -[type=link] md5sum=toybox # Calculate MD5 checksums -[type=link] mkfifo=toybox # Create named pipes (FIFOs) -[type=link] mktemp=toybox # Create temporary files/directories -[type=link] more=toybox # Display files page by page -[type=link] mv=toybox # Move/rename files and directories -[type=link] nl=toybox # Number lines in files -[type=link] nohup=toybox # Run commands immune to hangups -[type=link] od=toybox # Dump files in octal format -[type=link] paste=toybox # Merge lines from files -[type=link] patch=toybox # Apply patches to files -[type=link] printenv=toybox # Print environment variables -[type=link] printf=toybox # Format and print data -[type=link] pwd=toybox # Print working directory -[type=link] readlink=toybox # Display target of symbolic links -[type=link] realpath=toybox # Display absolute path -[type=link] rmdir=toybox # Remove empty directories -[type=link] sed=toybox # Stream editor for filtering/transforming text -[type=link] seq=toybox # Generate sequences of numbers -[type=link] sha1sum=toybox # Calculate SHA1 checksums -[type=link] sleep=toybox # Suspend execution for specified time -[type=link] sort=toybox # Sort lines in text files -[type=link] split=toybox # Split files into pieces -[type=link] stat=toybox # Display file/filesystem status -[type=link] strings=toybox # Extract printable strings from files -[type=link] tail=toybox # Display last lines of files -[type=link] tee=toybox # Copy input to files and stdout -[type=link] test=toybox # Evaluate conditional expressions -[type=link] time=toybox # Time command execution -[type=link] timeout=toybox # Run command with time limit -[type=link] touch=toybox # Update file timestamps -[type=link] tr=toybox # Translate or delete characters -[type=link] true=toybox # Return true status -[type=link] truncate=toybox # Truncate files to specified size -[type=link] tty=toybox # Display terminal name -[type=link] uname=toybox # Display system information -[type=link] uniq=toybox # Remove duplicate lines -[type=link] unix2dos=toybox # Convert Unix line endings to DOS -[type=link] unlink=toybox # Remove files (system call interface) -[type=link] uudecode=toybox # Decode uuencoded files -[type=link] uuencode=toybox # Encode files using uuencoding -[type=link] uuidgen=toybox # Generate UUIDs -[type=link] wc=toybox # Count lines, words, and characters -[type=link] which=toybox # Locate commands in PATH -[type=link] whoami=toybox # Display current username -[type=link] xargs=toybox # Execute commands from standard input -[type=link] xxd=toybox # Make hexdump or reverse -[type=link] yes=toybox # Output string repeatedly -[type=link] zcat=toybox # Display contents of compressed files -[type=link] nc=toybox # Netcat for network connections and packet streaming -[type=link] netcat=toybox # Netcat alias for network connections -[type=link] pkill=slay # Process killer Linux compatibility layer -############################################# -### Tools ### -############################################# -awk # Text processing and pattern scanning -devb-ram # RAM disk block device manager -devc-pty # Pseudo-terminal device manager -fsencrypt # File system encryption utility -fsevmgr # File system event manager -if_up # Network interface configuration -ifconfig # Network interface configuration tool -ln # Create file links -mkqnx6fs # Create QNX6 file systems -mount_ifs # Mount Image File System (IFS) -mqueue # POSIX message queue manager -openssl # SSL/TLS cryptographic toolkit -pci-server # PCI bus server -pdebug # Process debugger -pfctl # Packet filter control utility -pipe # Named pipe manager -random # Random number generator service -shutdown # System shutdown utility -sync # Synchronize file system buffers to disk -tar # Archive utility for creating/extracting tar files -umount # Unmount file systems -sysctl # Configure kernel parameters at runtime -sshd # SSH daemon for remote access -ssh # SSH client for remote connections -ssh-keygen # SSH key generation utility -hostname # Set or display system hostname -route -dhcpcd # DHCP client daemon for automatic network configuration -tcpdump # Network packet capture tool for Wireshark analysis -slay -/usr/lib/ssh/sftp-server=${QNX_TARGET}/${PROCESSOR}/usr/libexec/sftp-server # File transfer server to enable scp - -############################################# -### NETWORKING COMPONENTS ### -############################################# -io-sock # Network socket manager -mods-pci.so # PCI module support for network hardware -mods-phy.so # Physical layer module for network interfaces -mods-usb.so # USB module support -libfdt.so.1 # Flattened Device Tree library -libusbdci.so.2 # USB device controller interface library -devs-vtnet_pci.so # VirtIO network device driver for QEMU/KVM -librpc.so.2 # For TCP dump - - -############################################# -### PCI COMPONENTS ### -############################################# -# PCI-related shared libraries and modules (no hardware-specific HW module for QEMU virt) -pci/pci_slog2.so # PCI system logging support -pci/pci_cap-0x05.so # PCI capability handler for MSI -pci/pci_cap-0x10.so # PCI Express capability handler -pci/pci_cap-0x11.so # MSI-X capability handler -pci/pci_strings.so # PCI device string database -pci/pci_bkwd_compat.so # Backward compatibility support -pci/pci_debug2.so # Enhanced PCI debugging support - - -############################################# -### SYSTEM DIRECTORIES ### -############################################# -# Create SSH and system directories with appropriate permissions -[gid=0 uid=0 dperms=755 type=dir] /var/chroot/sshd # SSH chroot directory for privilege separation -[gid=0 uid=0 dperms=700 type=dir] /var/ssh # SSH configuration and key storage directory - - -############################################# -### SCRIPTS ### -############################################# -# System startup and initialization scripts -[perms=700] /etc/startup.sh = ${MAIN_BUILD_FILE_DIR}/../configs/startup.sh # Main system startup script -[perms=700] /etc/network_setup.sh = ${MAIN_BUILD_FILE_DIR}/../configs/network_setup.sh # Network configuration script -[perms=700] /etc/network_setup_dhcp.sh = ${MAIN_BUILD_FILE_DIR}/../configs/network_setup_dhcp.sh # Network configuration script -[perms=755] /etc/network_capture = ${MAIN_BUILD_FILE_DIR}/../configs/network_capture.sh # Network packet capture utility - - -############################################# -### CONFIGURATION FILES ### -############################################# -# This section defines critical configuration files that control system -# behavior, hardware access, security policies, and user environment setup. - -[perms=0444] qcrypto.conf = ${MAIN_BUILD_FILE_DIR}/../configs/qcrypto.conf # QNX cryptographic library configuration - -# System hostname configuration -/etc/hostname = ${MAIN_BUILD_FILE_DIR}/../configs/hostname # System hostname definition file -/etc/profile = ${MAIN_BUILD_FILE_DIR}/../configs/profile - -# System user and group databases -/etc/passwd = ${MAIN_BUILD_FILE_DIR}/../configs/passwd # User account database with login information -/etc/group = ${MAIN_BUILD_FILE_DIR}/../configs/group # Group membership database - - -############################################# -### SSH CONFIGURATION ### -############################################# -# SSH server configuration (no static host keys - generated at runtime) -[perms=444] /var/ssh/sshd_config = ${MAIN_BUILD_FILE_DIR}/../configs/sshd_config # SSH daemon configuration file - -[uid=0 gid=0 perms=400] /var/ssh/ssh_host_rsa_key = ${MAIN_BUILD_FILE_DIR}/../configs/ssh_host_rsa_key # SSH server private key -[uid=0 gid=0 perms=400] /var/ssh/ssh_host_rsa_key.pub = ${MAIN_BUILD_FILE_DIR}/../configs/ssh_host_rsa_key.pub # SSH server public key - -# DHCP client configuration -[perms=644] /etc/dhcpcd.conf = ${MAIN_BUILD_FILE_DIR}/../configs/dhcpcd.conf # DHCP client configuration file - -# Communication configuration files -[perms=777] /etc/logging.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/etc/logging.json -[perms=777] /etc/mw_com_config.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/etc/mw_com_config.json - -# Executable files from external repositories -[perms=777] /scrample = ${SCRAMPLE_PATH} -[perms=777] /cpp_tests_persistency = ${CPP_TEST_SCENARIOS_PATH} - -[perms=777] /usr/bin/datarouter/datarouter = ${DATAROUTER_PATH} -[perms=644] /usr/bin/datarouter/etc/logging.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/datarouter/etc/logging.json -[perms=644] /usr/bin/datarouter/etc/log-channels.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/datarouter/etc/log-channels.json - -# Common showcases bundle -[perms=777] / = ${BUNDLE_PATH} diff --git a/images/qnx_x86_64/build/BUILD b/images/qnx_x86_64/build/BUILD deleted file mode 100644 index afd5563b570..00000000000 --- a/images/qnx_x86_64/build/BUILD +++ /dev/null @@ -1,74 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - -load("@score_rules_imagefs//rules/qnx:ifs.bzl", "qnx_ifs") - -filegroup( - name = "scripts", - srcs = [ - "//images/qnx_x86_64/configs:startup.sh", - ], - visibility = ["//visibility:private"], -) - -filegroup( - name = "configs", - srcs = [ - "//images/qnx_x86_64/configs:dhcpcd.conf", - "//images/qnx_x86_64/configs:group", - "//images/qnx_x86_64/configs:hostname", - "//images/qnx_x86_64/configs:network_capture.sh", - "//images/qnx_x86_64/configs:network_setup.sh", - "//images/qnx_x86_64/configs:network_setup_dhcp.sh", - "//images/qnx_x86_64/configs:passwd", - "//images/qnx_x86_64/configs:pci_hw.cfg", - "//images/qnx_x86_64/configs:pci_server.cfg", - "//images/qnx_x86_64/configs:profile", - "//images/qnx_x86_64/configs:qcrypto.conf", - "//images/qnx_x86_64/configs:ssh_host_rsa_key", - "//images/qnx_x86_64/configs:ssh_host_rsa_key.pub", - "//images/qnx_x86_64/configs:sshd_config", - ], - visibility = ["//visibility:private"], -) - -qnx_ifs( - name = "init", - srcs = [ - ":configs", - ":scripts", - ":system.build", - ":system_dir", - "//feature_integration_tests/configs:etc_configs", - "//feature_integration_tests/configs/datarouter:etc_configs", - "//showcases", - "@score_logging//score/datarouter", - "@score_persistency//tests/test_scenarios/cpp:test_scenarios", - ], - build_file = "init.build", - ext_repo_maping = { - "BUNDLE_PATH": "$(location //showcases:showcases)", - "DATAROUTER_PATH": "$(location @score_logging//score/datarouter:datarouter)", - }, - visibility = [ - "//visibility:public", - ], -) - -filegroup( - name = "system_dir", - srcs = [ - "init.build", - "system.build", - ], -) diff --git a/images/qnx_x86_64/build/init.build b/images/qnx_x86_64/build/init.build deleted file mode 100644 index fdc1d273390..00000000000 --- a/images/qnx_x86_64/build/init.build +++ /dev/null @@ -1,101 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - - -############################################################################### -# -# Example image built based on minimal configuration from QNX -# -############################################################################### - -[-optional] - -[image=0x3600000] # Set image size to 56MB (0x3600000 bytes) -[virtual=x86_64,multiboot] boot = { # Configure for x86_64 architecture with multiboot support - # Use startup-x86 by default - startup-x86 -v -D8250..115200 -zz # Start x86 kernel with verbose output, serial console at 115200 baud - PATH=/proc/boot # Set executable search path to boot directory - LD_LIBRARY_PATH=/proc/boot # Set library search path to boot directory - [+keeplinked] procnto-smp-instr # Keep process manager linked and instrumented for SMP -} - -[+script] startup-script = { # Define startup script that runs during boot - procmgr_symlink /dev/shmem /tmp # Create symbolic link from shared memory to /tmp - # /tmp will be mounted later as a proper RAM disk - - display_msg Welcome to QNX OS 8.0 on x86_64 tweaked for S-CORE! # Display welcome message - - # These env variables get inherited by all programs which follow - SYSNAME=nto # Set system name to "nto" (Neutrino) - TERM=qansi # Set terminal type to QNX ANSI - - devc-ser8250 & # Start serial driver in background - waitfor /dev/ser1 # Wait for serial device to be available - reopen /dev/ser1 # Reopen serial device for console I/O - - display_msg Placeholder for startup script # Display startup message - etc/startup.sh # Execute main startup script - - [+session] /bin/sh & # Start shell session in background -} - -# Essential utilities - core system commands needed for basic operation -# These binaries provide fundamental system functionality and process management - -# Process and system management utilities -on # Command execution utility - runs commands with specific options -[type=link] waitfor=on # Create symbolic link: waitfor -> on (waits for resources to become available) -[type=link] ability=on # Create symbolic link: ability -> on (manages process abilities/privileges) - -# Shell and command interpreter -ksh # Korn shell - provides command-line interface and scripting -pidin # Process information display - shows running processes (like 'ps' on Linux) -[type=link] /bin/sh=/proc/boot/ksh # Create symbolic link: sh -> ksh (standard shell link) - -# File system utilities -mount # File system mount utility - mounts/unmounts file systems -getconf # System configuration query utility - retrieves system parameters -[type=link] setconf=getconf # Create symbolic link: setconf -> getconf (sets configuration parameters) - -# Device drivers for hardware access -devc-ser8250 # Serial port driver for 8250/16550 UART controllers (console access) - -# System logging utilities -slog2info # System log viewer - displays logged messages -slogger2 # System logging daemon - collects and manages log messages - -# Essential libraries - core runtime libraries required for system operation -# These libraries provide fundamental services like C runtime, networking, and logging - -# Standard C library - provides basic C runtime functions -libc.so.6 # Main C library (malloc, printf, file I/O, etc.) - -# Dynamic linker/loader - handles dynamic library loading at runtime -/usr/lib/ldqnx-64.so.2=ldqnx-64.so.2 # 64-bit QNX dynamic linker (loads shared libraries) - -# Networking library - provides socket and network communication functions -libsocket.so.4 # Socket library (TCP/IP, UDP, network I/O functions) -[type=link] libsocket.so=libsocket.so.4 # Create version-neutral symbolic link - -# System logging library - provides logging services for applications -libslog2.so.1 # System logging library (slog2_* functions) -[type=link] libslog2.so=libslog2.so.1 # Create version-neutral symbolic link - -# Storage driver - provides access to IDE/SATA block devices -devb-eide # Block device driver for IDE/SATA hard drives and SSDs - # Required for mounting QNX6 file systems from disk partitions - -# Orchestrator example needed -[type=link] /data=/tmp_ram - -[+include] ${MAIN_BUILD_FILE_DIR}/system.build # Include additional system build configurations diff --git a/images/qnx_x86_64/build/system.build b/images/qnx_x86_64/build/system.build deleted file mode 100644 index 16f55a4607f..00000000000 --- a/images/qnx_x86_64/build/system.build +++ /dev/null @@ -1,293 +0,0 @@ -# ******************************************************************************* -# Copyright (c) 2025 Contributors to the Eclipse Foundation -# -# See the NOTICE file(s) distributed with this work for additional -# information regarding copyright ownership. -# -# This program and the accompanying materials are made available under the -# terms of the Apache License Version 2.0 which is available at -# https://www.apache.org/licenses/LICENSE-2.0 -# -# SPDX-License-Identifier: Apache-2.0 -# ******************************************************************************* - - -# ============================================================================ -# QNX System Build File - Defines system partition contents -# ============================================================================ -# This file defines the contents of the QNX system partition, including -# essential utilities, libraries, configuration files, and system services -# needed for a minimal QNX QEMU environment. - -############################################# -### SHARED LIBRARIES ### -############################################# -# Essential shared libraries for system operation - -libfsnotify.so.1 # File system notification library -cam-cdrom.so # CAM (Common Access Method) CD-ROM driver -cam-disk.so # CAM disk driver for storage devices -fs-dos.so # DOS file system support -fs-qnx6.so # QNX6 file system support -io-blk.so # Block I/O manager -libbz2.so.1 # BZip2 compression library -libc++.so.2 # C++ standard library -libc.so # C standard library (essential) -libcam.so.2 # CAM library for device access -libcatalog.so.1 # Message catalog support -libcrypto.so.3 # OpenSSL crypto library (disabled) -libfscrypto.so.1 # File system encryption support -libgcc_s.so.1 # GCC runtime support library -libiconv.so.1 # Character encoding conversion -liblzma.so.5 # LZMA compression library -libm.so # Math library -libpci.so.3.0 # PCI library v3.0 for hardware access -libqcrypto.so.1.0 # QNX cryptographic library -libqh.so # QNX helper library -libregex.so.1 # Regular expression library -libsecpol.so.1 # Security policy library -libslog2parse.so.1 # System log parsing library -libssl.so.3 # OpenSSL SSL/TLS library (disabled) -libtracelog.so.1 # Trace logging library -libxml2.so.2 # XML parsing library -libz.so # Zlib compression library -libexpat.so.2 # Expat XML parser library -libjail.so.1 # QNX jail library for process containment -qcrypto-openssl-3.so # QNX cryptographic library with OpenSSL 3 support -libpam.so.2 # Pluggable Authentication Modules library - - -############################################# -### FILE MANIPULATION UTILITIES ### -############################################# -# Core file system utilities - most are provided by toybox (minimal Unix utilities) - -[type=link] /bin/ls=/proc/boot/ls # Link ls to IFS version for compatibility -# Note: /bin/sh symlink already defined in init.build as /proc/boot/ksh -toybox # Minimal Unix utilities collection (replaces many GNU tools) -[type=link] cp=toybox # Copy files and directories -[type=link] ls=toybox # List directory contents -[type=link] cat=toybox # Display file contents -[type=link] chmod=toybox # Change file permissions -[type=link] rm=toybox # Remove files and directories -[type=link] dd=toybox # Convert and copy files with specified I/O block size -[type=link] echo=toybox # Display text -[type=link] grep=toybox # Search text patterns in files -[type=link] mkdir=toybox # Create directories -[type=link] ascii=toybox # Display ASCII character set -[type=link] base64=toybox # Base64 encoding/decoding utility -[type=link] basename=toybox # Extract filename from path -[type=link] bc=toybox # Basic calculator -[type=link] bunzip2=toybox # Decompress bzip2 files -[type=link] bzcat=toybox # Display contents of bzip2 files -[type=link] cal=toybox # Display calendar -[type=link] chgrp=toybox # Change group ownership -[type=link] chown=toybox # Change file ownership -[type=link] cksum=toybox # Calculate checksums -[type=link] clear=toybox # Clear terminal screen -[type=link] cmp=toybox # Compare files byte by byte -[type=link] comm=toybox # Compare sorted files line by line -[type=link] cpio=toybox # Copy files to/from archives -[type=link] crc32=toybox # Calculate CRC32 checksums -[type=link] cut=toybox # Extract columns from files -[type=link] date=toybox # Display or set system date -[type=link] diff=toybox # Compare files line by line -[type=link] dirname=toybox # Extract directory from path -[type=link] dos2unix=toybox # Convert DOS line endings to Unix -[type=link] du=toybox # Display disk usage -[type=link] egrep=toybox # Extended grep with regular expressions -[type=link] env=toybox # Display or set environment variables -[type=link] expand=toybox # Convert tabs to spaces -[type=link] expr=toybox # Evaluate expressions -[type=link] false=toybox # Return false status -[type=link] fgrep=toybox # Fast grep for fixed strings -[type=link] file=toybox # Determine file type -[type=link] find=toybox # Search for files and directories -[type=link] fmt=toybox # Format text paragraphs -[type=link] groups=toybox # Display user group membership -[type=link] gunzip=toybox # Decompress gzip files -[type=link] gzip=toybox # Compress files with gzip -[type=link] hd=toybox # Hexadecimal dump (alias for hexdump) -[type=link] head=toybox # Display first lines of files -[type=link] hexdump=toybox # Display files in hexadecimal format -[type=link] id=toybox # Display user and group IDs -[type=link] install=toybox # Copy files and set attributes -[type=link] link=toybox # Create hard links -[type=link] logname=toybox # Display login name -[type=link] md5sum=toybox # Calculate MD5 checksums -[type=link] mkfifo=toybox # Create named pipes (FIFOs) -[type=link] mktemp=toybox # Create temporary files/directories -[type=link] more=toybox # Display files page by page -[type=link] mv=toybox # Move/rename files and directories -[type=link] nl=toybox # Number lines in files -[type=link] nohup=toybox # Run commands immune to hangups -[type=link] od=toybox # Dump files in octal format -[type=link] paste=toybox # Merge lines from files -[type=link] patch=toybox # Apply patches to files -[type=link] printenv=toybox # Print environment variables -[type=link] printf=toybox # Format and print data -[type=link] pwd=toybox # Print working directory -[type=link] readlink=toybox # Display target of symbolic links -[type=link] realpath=toybox # Display absolute path -[type=link] rmdir=toybox # Remove empty directories -[type=link] sed=toybox # Stream editor for filtering/transforming text -[type=link] seq=toybox # Generate sequences of numbers -[type=link] sha1sum=toybox # Calculate SHA1 checksums -[type=link] sleep=toybox # Suspend execution for specified time -[type=link] sort=toybox # Sort lines in text files -[type=link] split=toybox # Split files into pieces -[type=link] stat=toybox # Display file/filesystem status -[type=link] strings=toybox # Extract printable strings from files -[type=link] tail=toybox # Display last lines of files -[type=link] tee=toybox # Copy input to files and stdout -[type=link] test=toybox # Evaluate conditional expressions -[type=link] time=toybox # Time command execution -[type=link] timeout=toybox # Run command with time limit -[type=link] touch=toybox # Update file timestamps -[type=link] tr=toybox # Translate or delete characters -[type=link] true=toybox # Return true status -[type=link] truncate=toybox # Truncate files to specified size -[type=link] tty=toybox # Display terminal name -[type=link] uname=toybox # Display system information -[type=link] uniq=toybox # Remove duplicate lines -[type=link] unix2dos=toybox # Convert Unix line endings to DOS -[type=link] unlink=toybox # Remove files (system call interface) -[type=link] uudecode=toybox # Decode uuencoded files -[type=link] uuencode=toybox # Encode files using uuencoding -[type=link] uuidgen=toybox # Generate UUIDs -[type=link] wc=toybox # Count lines, words, and characters -[type=link] which=toybox # Locate commands in PATH -[type=link] whoami=toybox # Display current username -[type=link] xargs=toybox # Execute commands from standard input -[type=link] xxd=toybox # Make hexdump or reverse -[type=link] yes=toybox # Output string repeatedly -[type=link] zcat=toybox # Display contents of compressed files -[type=link] nc=toybox # Netcat for network connections and packet streaming -[type=link] netcat=toybox # Netcat alias for network connections -[type=link] pkill=slay # Process killer Linux compatibility layer -############################################# -### Tools ### -############################################# -awk # Text processing and pattern scanning -devb-ram # RAM disk block device manager -devc-pty # Pseudo-terminal device manager -fsencrypt # File system encryption utility -fsevmgr # File system event manager -if_up # Network interface configuration -ifconfig # Network interface configuration tool -ln # Create file links -mkqnx6fs # Create QNX6 file systems -mount_ifs # Mount Image File System (IFS) -mqueue # POSIX message queue manager -openssl # SSL/TLS cryptographic toolkit -pci-server # PCI bus server -pdebug # Process debugger -pfctl # Packet filter control utility -pipe # Named pipe manager -random # Random number generator service -shutdown # System shutdown utility -sync # Synchronize file system buffers to disk -tar # Archive utility for creating/extracting tar files -umount # Unmount file systems -sysctl # Configure kernel parameters at runtime -sshd # SSH daemon for remote access -ssh # SSH client for remote connections -ssh-keygen # SSH key generation utility -hostname # Set or display system hostname -route -dhcpcd # DHCP client daemon for automatic network configuration -tcpdump # Network packet capture tool for Wireshark analysis -slay -/usr/lib/ssh/sftp-server=${QNX_TARGET}/${PROCESSOR}/usr/libexec/sftp-server # File transfer server to enable scp - -############################################# -### NETWORKING COMPONENTS ### -############################################# -io-sock # Network socket manager -mods-pci.so # PCI module support for network hardware -mods-phy.so # Physical layer module for network interfaces -mods-usb.so # USB module support -libfdt.so.1 # Flattened Device Tree library -libusbdci.so.2 # USB device controller interface library -devs-vtnet_pci.so # VirtIO network device driver for QEMU/KVM -librpc.so.2 # For TCP dump - - -############################################# -### PCI COMPONENTS ### -############################################# -# PCI-related shared libraries and modules -pci/pci_hw-Intel_x86.so # Intel x86 PCI hardware support -pci/pci_slog2.so # PCI system logging support -pci/pci_cap-0x05.so # PCI capability handler for MSI -pci/pci_cap-0x10.so # PCI Express capability handler -pci/pci_cap-0x11.so # MSI-X capability handler -pci/pci_strings.so # PCI device string database -pci/pci_bkwd_compat.so # Backward compatibility support -pci/pci_debug2.so # Enhanced PCI debugging support - - -############################################# -### SYSTEM DIRECTORIES ### -############################################# -# Create SSH and system directories with appropriate permissions -[gid=0 uid=0 dperms=755 type=dir] /var/chroot/sshd # SSH chroot directory for privilege separation -[gid=0 uid=0 dperms=700 type=dir] /var/ssh # SSH configuration and key storage directory - - -############################################# -### SCRIPTS ### -############################################# -# System startup and initialization scripts -[perms=700] /etc/startup.sh = ${MAIN_BUILD_FILE_DIR}/../configs/startup.sh # Main system startup script -[perms=700] /etc/network_setup.sh = ${MAIN_BUILD_FILE_DIR}/../configs/network_setup.sh # Network configuration script -[perms=700] /etc/network_setup_dhcp.sh = ${MAIN_BUILD_FILE_DIR}/../configs/network_setup_dhcp.sh # Network configuration script -[perms=755] /etc/network_capture = ${MAIN_BUILD_FILE_DIR}/../configs/network_capture.sh # Network packet capture utility - - -############################################# -### CONFIGURATION FILES ### -############################################# -# This section defines critical configuration files that control system -# behavior, hardware access, security policies, and user environment setup. - -[perms=0444] pci_server.cfg = ${MAIN_BUILD_FILE_DIR}/../configs/pci_server.cfg # PCI server configuration -[perms=0444] pci_hw.cfg = ${MAIN_BUILD_FILE_DIR}/../configs/pci_hw.cfg # PCI hardware configuration -[perms=0444] qcrypto.conf = ${MAIN_BUILD_FILE_DIR}/../configs/qcrypto.conf # QNX cryptographic library configuration - -# System hostname configuration -/etc/hostname = ${MAIN_BUILD_FILE_DIR}/../configs/hostname # System hostname definition file -/etc/profile = ${MAIN_BUILD_FILE_DIR}/../configs/profile - -# System user and group databases -/etc/passwd = ${MAIN_BUILD_FILE_DIR}/../configs/passwd # User account database with login information -/etc/group = ${MAIN_BUILD_FILE_DIR}/../configs/group # Group membership database - - -############################################# -### SSH CONFIGURATION ### -############################################# -# SSH server configuration (no static host keys - generated at runtime) -[perms=444] /var/ssh/sshd_config = ${MAIN_BUILD_FILE_DIR}/../configs/sshd_config # SSH daemon configuration file - -[uid=0 gid=0 perms=400] /var/ssh/ssh_host_rsa_key = ${MAIN_BUILD_FILE_DIR}/../configs/ssh_host_rsa_key # SSH server private key -[uid=0 gid=0 perms=400] /var/ssh/ssh_host_rsa_key.pub = ${MAIN_BUILD_FILE_DIR}/../configs/ssh_host_rsa_key.pub # SSH server public key - -# DHCP client configuration -[perms=644] /etc/dhcpcd.conf = ${MAIN_BUILD_FILE_DIR}/../configs/dhcpcd.conf # DHCP client configuration file - -# Communication configuration files -[perms=777] /etc/logging.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/etc/logging.json -[perms=777] /etc/mw_com_config.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/etc/mw_com_config.json - -# Executable files from external repositories -[perms=777] /scrample = ${SCRAMPLE_PATH} -[perms=777] /cpp_tests_persistency = ${CPP_TEST_SCENARIOS_PATH} - -[perms=777] /usr/bin/datarouter/datarouter = ${DATAROUTER_PATH} -[perms=644] /usr/bin/datarouter/etc/logging.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/datarouter/etc/logging.json -[perms=644] /usr/bin/datarouter/etc/log-channels.json = ${MAIN_BUILD_FILE_DIR}/../../../feature_integration_tests/configs/datarouter/etc/log-channels.json - -# Common showcases bundle -[perms=777] / = ${BUNDLE_PATH} - diff --git a/known_good.json b/known_good.json index 8e671f5c393..6a1ae5e3ea9 100644 --- a/known_good.json +++ b/known_good.json @@ -169,6 +169,10 @@ "score_process": { "repo": "https://github.com/eclipse-score/process_description.git", "hash": "8df530cab5efcb40e9f835ba6e9b61ae2f0175c7" + }, + "score_sbom": { + "repo": "https://github.com/eclipse-score/sbom-tool.git", + "version": "0.0.2" } } }, diff --git a/scripts/tooling/BUILD b/scripts/tooling/BUILD index c2088414897..8f843625a0a 100644 --- a/scripts/tooling/BUILD +++ b/scripts/tooling/BUILD @@ -15,6 +15,8 @@ load("@rules_python//python:defs.bzl", "py_binary", "py_library") load("@rules_python//python:pip.bzl", "compile_pip_requirements") load("@score_tooling//python_basics:defs.bzl", "score_py_pytest") +exports_files(["requirements.txt"]) + # In order to update the requirements, change the `requirements.in` file and run # `bazel run //scripts/tooling:requirements.update` # This will update the `requirements.txt` file diff --git a/scripts/tooling/cli/misc/assets/report_template.html b/scripts/tooling/cli/misc/assets/report_template.html index f3b501af52c..7391a635873 100644 --- a/scripts/tooling/cli/misc/assets/report_template.html +++ b/scripts/tooling/cli/misc/assets/report_template.html @@ -256,13 +256,90 @@ border-top: 1px solid var(--border); padding-top: 1rem; } + /* ── Tabs (new) ─────────────────────────────────────────────── */ + .tabs { + max-width: 1400px; + margin: 0 auto 1.2rem; + display: flex; + gap: 0.5rem; + border-bottom: 1px solid var(--border); + padding-bottom: 0.3rem; + } + .tab-btn { + font-size: 0.85rem; + padding: 0.4rem 0.9rem; + border-radius: 6px 6px 0 0; + border-bottom: none; + } + .tab-btn.active { + background: var(--bg); + color: #e6edf3; + border-color: var(--accent); + } + .tab-panel { display: none; } + .tab-panel.active { display: block; } + + /* SBOM / Tools table */ + .sbom-table-wrap { + max-width: 1400px; + margin: 0 auto 1.5rem; + overflow-x: auto; + } + .sbom-table { + width: 100%; + border-collapse: collapse; + font-size: 0.82rem; + } + .sbom-table th, + .sbom-table td { + padding: 0.45rem 0.6rem; + text-align: left; + vertical-align: top; + border-bottom: 1px solid var(--border); + } + .sbom-table thead th { + position: sticky; + top: 0; + background: var(--bg); + color: #e6edf3; + font-weight: 600; + } + .sbom-table tbody tr:hover td { + background: #161b22; + } + + /* Traceability */ + .trace-section { + max-width: 1400px; + margin: 0 auto 1.5rem; + font-size: 0.85rem; + } + .trace-card { + background: var(--surface); + border: 1px solid var(--border); + border-radius: var(--radius); + padding: 1rem 1.1rem; + margin-bottom: 1rem; + } + .trace-links a { + color: var(--accent); + text-decoration: none; + font-size: 0.82rem; + } + .trace-links a:hover { text-decoration: underline; }
-

Known Good Status

+

Integration Dashboard

Snapshot: {{ timestamp }}

+
+ + + +
+
@@ -272,25 +349,141 @@

Known Good Status

-
- 🔒 Add a GitHub personal access token (PAT) for live status — exact commit counts fetched directly from GitHub. - Enter it in the token field above, or - create one here. - Without a token, up-to-date / behind status is still shown from data embedded at report generation time. - Your PAT is not sent anywhere — it is only kept in the local cache of this page. -
+ +
+
+ 🔒 Add a GitHub personal access token (PAT) for live status — exact commit counts fetched directly from GitHub. + Enter it in the token field above, or + create one here. + Without a token, up-to-date / behind status is still shown from data embedded at report generation time. + Your PAT is not sent anywhere — it is only kept in the local cache of this page. +
-
-
+
+
+ + +
+ + +
+
+

Traceability Overview

+

+ This tab provides an overview of requirements, architecture, and test traceability for the S-CORE reference integration. + Detailed models are maintained in Sphinx with sphinx-needs and linked below. +

+ +
+

Requirements & Architecture

+

+ Central documentation and needs-based traceability are published via Sphinx. Use the links below to inspect coverage between requirements, design, tests, and components. +

+
+ +
+
-
- Commits-behind data fetched live from the GitHub REST API. -
+
+

ISO 26262 Alignment

+

+ For ISO 26262, this view will be extended to expose: +

+
    +
  • Traceability from system requirements → software components → tests.
    • +
  • Links to Safety Sentinel–based checks in the Bazel build.
    • +
  • Automated coverage metrics derived from Sphinx-Needs exports (future).
    • +
+
+
+
+ + +
+
+

SBOM & Tool Qualification

+

+ Product SBOM (ISO 26262) and tool qualification overview for the S-CORE reference integration. +

+
+ + +
+

Product SBOM

+

+ +
+ +
+ +
+ + + + + + + + + + +
PackageVersionSupplierLicenses
+
+
+ + +
+

Tool Qualification (ISO 26262)

+

+ Tools used in the build, analysis, and verification pipeline are documented separately and linked here. + Detailed qualification information is maintained in the S-CORE tooling documentation. +

+ +
+

Static Analysis & Code Quality

+
+ +
+
+ +
+

SBOM & Dependency Tools

+

+ SBOM generation and dependency analysis tools (e.g., Syft, Grype) are configured in CI and documented as part of the tooling landscape. + A dedicated tool-qualification table will be added here once a central manifest is available. +

+
+
+
diff --git a/scripts/tooling/cli/misc/html_report.py b/scripts/tooling/cli/misc/html_report.py index 00af22e2cf1..b5dd576617a 100644 --- a/scripts/tooling/cli/misc/html_report.py +++ b/scripts/tooling/cli/misc/html_report.py @@ -97,10 +97,46 @@ def _enrich_with_compare_data(entries: list[dict[str, Any]], token: str) -> None _LOG.warning("Could not fetch compare data for %s@%s", entry["owner_repo"], entry["branch"]) -def generate_report(known_good: KnownGood, token: Optional[str] = None) -> str: +def _parse_sbom_packages(sbom_path: Path) -> list[dict[str, Any]]: + """Minimal SPDX JSON parser for SBOM dashboard.""" + data = json.loads(sbom_path.read_text(encoding="utf-8")) + packages = [] + for p in data.get("packages", []): + name = (p.get("name") or "").strip() + version = (p.get("versionInfo") or "").strip() + supplier_raw = p.get("supplier") or {} + supplier = "" + if isinstance(supplier_raw, dict): + supplier = supplier_raw.get("name", "") + elif isinstance(supplier_raw, str): + supplier = supplier_raw + + licenses = [] + for lic in (p.get("licenseConcluded") or "").split(" OR "): + lic = lic.strip() + if lic and lic != "NOASSERTION": + licenses.append(lic) + + packages.append( + { + "name": name, + "version": version or "", + "supplier": supplier or "", + "licenses": licenses, + } + ) + return packages + + +def generate_report( + known_good: KnownGood, + token: str | None = None, + sbom_packages: list[dict[str, Any]] | None = None, +) -> str: entries = _collect_entries(known_good) if token: _enrich_with_compare_data(entries, token) + env = Environment( loader=FileSystemLoader(TEMPLATE_DIR), autoescape=select_autoescape(["html"]), @@ -108,12 +144,18 @@ def generate_report(known_good: KnownGood, token: Optional[str] = None) -> str: tmpl = env.get_template("report_template.html") return tmpl.render( modules_json=json.dumps(entries, indent=2), + sbom_packages_json=json.dumps(sbom_packages or [], indent=2), timestamp=known_good.timestamp, ) -def write_report(known_good: KnownGood, output_path: Path, token: Optional[str] = None) -> None: - Path(output_path).write_text(generate_report(known_good, token), encoding="utf-8") +def write_report( + known_good: KnownGood, + output_path: Path, + token: str | None = None, + sbom_packages: list[dict[str, Any]] | None = None, +) -> None: + Path(output_path).write_text(generate_report(known_good, token, sbom_packages), encoding="utf-8") def register(subparsers: argparse._SubParsersAction) -> None: @@ -130,6 +172,12 @@ def register(subparsers: argparse._SubParsersAction) -> None: default="report.html", help="Output HTML file path (default: report.html)", ) + parser.add_argument( + "--sbom", + metavar="PATH", + default=None, + help="Optional SPDX JSON SBOM to include in the SBOM & Tools tab.", + ) parser.set_defaults(func=_run) @@ -143,7 +191,17 @@ def _run(args: argparse.Namespace) -> int: token = os.environ.get("GITHUB_TOKEN") output = _resolve_path_from_bazel(Path(args.output)) - write_report(known_good, output, token=token) + + sbom_packages = None + if args.sbom: + sbom_path = _resolve_path_from_bazel(Path(args.sbom)) + try: + sbom_packages = _parse_sbom_packages(sbom_path) + except Exception as e: + print(f"warning: failed to parse SBOM {sbom_path}: {e}", file=sys.stderr) + + write_report(known_good, output, token=token, sbom_packages=sbom_packages) + if token: print(f"Report written to {output} (current hashes fetched from GitHub)") else: diff --git a/scripts/tooling/tests/test_report.py b/scripts/tooling/tests/test_report.py index 2ddf21c441e..945bc48c8a6 100644 --- a/scripts/tooling/tests/test_report.py +++ b/scripts/tooling/tests/test_report.py @@ -32,7 +32,7 @@ def test_is_html(self, minimal_known_good): assert "" in html def test_contains_title(self, minimal_known_good): - assert "Known Good Status" in generate_report(minimal_known_good, TEMPLATE_DIR) + assert "Integration Dashboard" in generate_report(minimal_known_good, TEMPLATE_DIR) def test_contains_timestamp(self, minimal_known_good): html = generate_report(minimal_known_good, TEMPLATE_DIR)