feat: link scanner technology in Methods and add per-unit CycloneDX SBOM deliverable #11

Merged

Philipp Baumann merged 2 commits from fm/dse-security-reports-scanner-link into main

2026-10-26 22:06:58 +00:00

Philipp Baumann commented

2026-10-26 22:05:56 +00:00

Owner

What

Two captain asks (2026-10-26), folded into one PR:

Scanner-technology links in the Methods section (reports/defender-triage.typ, bullet stays exactly one bullet, same sentence style): visible #link()s for the trivy homepage (https://trivy.dev) and the project repository (https://github.com/aquasecurity/trivy), plus the SBOM standard (https://cyclonedx.org) next to them, and a statement that the per-unit CycloneDX SBOM is produced as a standalone deterministic artifact via just sbom.
CycloneDX SBOM as a real pipeline deliverable: new just sbom recipe (scripts/sbom_trivy.sh) that generates a CycloneDX 1.7 SBOM per Linux unit from the SSH evidence inventories using trivy (trivy sbom --format cyclonedx --scanners vuln against the cached DB, offline, --skip-db-update), writing to gitignored .local/sbom/<machine>.json — same cache rules as just scan. trivy's cyclonedx output embeds three run-time values (scan metadata.timestamp, random serialNumber, random OS-component bom-ref), so scripts/normalize_cyclonedx.py replaces them with deterministic DB-tied stand-ins (DB UpdatedAt, uuid5 over machine+DB date, os:alma-<major>) and stable-sorts components and vulnerability affects. The input-SBOM builder is factored out of scan_trivy.sh into the shared scripts/build_cyclonedx_sbom.py.

Proof

Input SBOMs from the factored builder verified byte-identical to the previous inline builder for all 7 units (scan pipeline otherwise unchanged).
just sbom run twice end-to-end: all 7 SBOMs byte-identical across runs; output is a valid CycloneDX 1.7 document (purl bom-refs, vulnerability affects, uuid5 serial, DB-tied timestamp).
Real-lane proof on the artifact caches (just ingest + just triage): two consecutive renders byte-identical; links are PDF annotations only, no network access at render time — determinism unchanged. Fixture lane (just all) also green.
just test (21 passed), just lint, just fmt green. Nothing real committed (.local/ is gitignored).

Note: re-running just scan against the trivy DB re-fetched today drifts detections vs. the archived scans (advisory updates, e.g. CVE-2026-2673); the archived .local/scans/ cache a report run was produced from stays authoritative. Recorded in AGENTS.md.

## What Two captain asks (2026-10-26), folded into one PR: 1. **Scanner-technology links in the Methods section** (`reports/defender-triage.typ`, bullet stays exactly one bullet, same sentence style): visible `#link()`s for the trivy homepage (https://trivy.dev) and the project repository (https://github.com/aquasecurity/trivy), plus the SBOM standard (https://cyclonedx.org) next to them, and a statement that the per-unit CycloneDX SBOM is produced as a standalone deterministic artifact via `just sbom`. 2. **CycloneDX SBOM as a real pipeline deliverable**: new `just sbom` recipe (`scripts/sbom_trivy.sh`) that generates a CycloneDX 1.7 SBOM per Linux unit from the SSH evidence inventories using trivy (`trivy sbom --format cyclonedx --scanners vuln` against the cached DB, offline, `--skip-db-update`), writing to gitignored `.local/sbom/<machine>.json` — same cache rules as `just scan`. trivy's cyclonedx output embeds three run-time values (scan `metadata.timestamp`, random `serialNumber`, random OS-component `bom-ref`), so `scripts/normalize_cyclonedx.py` replaces them with deterministic DB-tied stand-ins (DB `UpdatedAt`, uuid5 over machine+DB date, `os:alma-<major>`) and stable-sorts components and vulnerability affects. The input-SBOM builder is factored out of `scan_trivy.sh` into the shared `scripts/build_cyclonedx_sbom.py`. ## Proof - Input SBOMs from the factored builder verified **byte-identical** to the previous inline builder for all 7 units (scan pipeline otherwise unchanged). - `just sbom` run twice end-to-end: **all 7 SBOMs byte-identical** across runs; output is a valid CycloneDX 1.7 document (purl bom-refs, vulnerability affects, uuid5 serial, DB-tied timestamp). - Real-lane proof on the artifact caches (`just ingest` + `just triage`): two consecutive renders **byte-identical**; links are PDF annotations only, no network access at render time — determinism unchanged. Fixture lane (`just all`) also green. - `just test` (21 passed), `just lint`, `just fmt` green. Nothing real committed (`.local/` is gitignored). Note: re-running `just scan` against the trivy DB re-fetched today drifts detections vs. the archived scans (advisory updates, e.g. CVE-2026-2673); the archived `.local/scans/` cache a report run was produced from stays authoritative. Recorded in AGENTS.md.

Philipp Baumann added 2 commits

2026-10-26 22:05:56 +00:00

feat(triage): link the trivy scanner technology in the method section ac71f16fb2

Add visible #link()s for the scanner homepage (https://trivy.dev) and the
project repository (https://github.com/aquasecurity/trivy) to the trivy
bullet in Grundlagen und Methode, keeping it exactly one bullet in the
same sentence style. Links are PDF annotations only -- no network access
at render time, so determinism is unchanged (two consecutive renders
byte-identical on the real caches).

feat(sbom): per-unit CycloneDX SBOM deliverable and method links d7c0eacb0c

Add `just sbom` (scripts/sbom_trivy.sh): a deterministic CycloneDX 1.7
SBOM per Linux unit from the SSH evidence inventories, produced offline by
trivy (sbom --format cyclonedx --scanners vuln) against the cached DB,
same cache rules as `just scan`. trivy's cyclonedx output carries three
run-time values (metadata.timestamp, random serialNumber, random OS
bom-ref) that break reproducibility; scripts/normalize_cyclonedx.py
replaces them with deterministic DB-tied stand-ins and stable-sorts
components and vulnerability affects, verified byte-identical across
two full runs.

Factor the input-SBOM builder out of scan_trivy.sh into the shared
scripts/build_cyclonedx_sbom.py; input SBOMs verified byte-identical to
the inline builder for all 7 units.

Methods section (defender-triage.typ): link the SBOM standard
(cyclonedx.org) next to the trivy scanner links and state that the
per-unit CycloneDX SBOM is produced as a standalone deterministic
artifact via `just sbom`.

Philipp Baumann merged commit f18cd2d7a0 into main

2026-10-26 22:06:58 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-scanner-link

2026-10-26 22:06:58 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-26 22:06:59 +00:00

feat: link scanner technology in Methods and add per-unit CycloneDX SBOM deliverable (#11)