Systems and processes for creating software bill of materials for large distributed builds
Systems are provided for generating, modifying and using SBOMs for facilitating risk assessment and threat mitigation for corresponding programs, and particularly for large programming builds. The creation and modification of the SBOMs includes processes for omitting declarations referenced in chunk SBOMs of program chunks incorporated into a final programming build associated with a build SBOM, but which are not actually utilized by the final programming build, as well as processes for adding new declarations for code segments that are not declared in the related chunk SBOMs, even though the code segments are utilized by the final programming build. Systems are also configured to use SBOMs in combination with configuration restriction records to assess and resolve threat events in a manner that can prevent unnecessary remedial actions for threat events that appear to be relevant to one or more files or dependencies incorporated into a program.
1. A method for creating an SBOM (software bill of materials) for a programming build, wherein the programming build is composed of a plurality of program chunks, each of the program chunks being composed of a unique set of files that are stored within a plurality of files in a monolithic repository, each program chunk of the plurality of program chunks being associated with a corresponding program chunk SBOM that includes file declarations for the unique set of files that are incorporated into the corresponding program chunk and dependency declarations associated with one or more of the files, the method comprising:
identifying a programming build to generate a build SBOM for, the programming build comprising a particular configuration build that utilizes at least one or more files from each program chunk of a set of program chunks;
identifying a program chunk SBOM corresponding to each program chunk of the set of program chunks, each program chunk SBOM comprising declarations of files and dependencies associated with files included within each corresponding program chunk;
verifying each program chunk of the set of program chunks based at least in part on a strong identifier of the corresponding program chunk SBOM associated with said each program chunk;
examining evidence associated with said each program chunk of the set of program chunks to identify at least one program chunk of the set of program chunks that includes at least a particular file or dependency that is not utilized by the programming build, and which is declared in the corresponding program chunk SBOM for that at least one program chunk; and
generating the build SBOM for the programming build based at least in part on each of the program chunk SBOMs by at least including declarations of files and dependencies specified in each of the program chunk SBOMs for the program chunks utilized in the programming build and while refraining from adding a declaration of the particular file or dependency to the build SBOM that identifies the particular file or dependency as being incorporated into the programming build, and wherein the program build utilizes the at least one program chunk having the corresponding program chunk SBOM that does include a declaration for the particular file or dependency.
2. The method of claim 1 , the method further including: generating the strong identifier of the build SBOM for enabling subsequent verification of the build SBOM and creating a digital record that associates the strong identifier of the build SBOM with an identifier of the particular configuration of the programming build.
3. The method of claim 2 , wherein generating the build SBOM further includes verifying that the build SBOM omits the particular file or dependency from the build SBOM prior to generating the strong identifier of the build SBOM.
4. The method of claim 3 , wherein verifying that the build SBOM omits the particular file or dependency from the build SBOM includes adding an explicit declaration to the build SBOM that the particular file or dependency is not utilized by the particular configuration of the programming build that is associated with the build SBOM.
5. The method of claim 1 , wherein the set of program chunks is used to create both the programming build comprising a first build having the particular configuration and a different programming build comprising a second build that at least partially incorporates each program chunk of the set of program chunks with a different configuration than the particular configuration of the first build, wherein the method further includes generating a second build SBOM for the second programming build, the second build SBOM including a declaration for one or more file or dependency that is omitted from a first build SBOM, based on the one or more file or dependency being utilized by the second build but not being utilized by the first build.
6. The method of claim 5 , wherein the second build SBOM includes a file declaration from a reference program chunk SBOM which is omitted from the first SBOM.
7. The method of claim 5 , wherein the second build SBOM includes a dependency declaration from a reference program chunk SBOM which is omitted from the first build SBOM.
8. The method of claim 1 , wherein examining the evidence associated with each program chunk of the set of program chunks to identify at least one program chunk of the set of program chunks having the particular file or dependency which is not utilized by the programming build includes:
using a database to track processing applied to or by files included in the at least one program chunk, and
based on the tracked processing, determining that the particular file does not have any executable functionality or applicable dependency within the particular configuration of the program build.
9. The method of claim 8 , wherein examining the evidence associated with each program chunk of the set of program chunks to identify at least one program chunk of the set of program chunks having the particular file or dependency which is not utilized by the programming build includes:
identifying a declaration of a file included in the program chunk SBOM of the at least one program chunk, the at least one program chunk being incorporated into the programming build, and further identifying that the file is not utilized by the programming build,
the method further including verifying the declaration of the file included in the program chunk SBOM is omitted from the SBOM for the programming build.
10. The method of claim 1 , wherein the build SBOM is written in a first SBOM format comprising at least one of SPDX, SWID or CycloneDX, and wherein the program chunk SBOM for the particular program chunk SBOM is written in different SBOM format than the first SBOM format.
11. The method of claim 1 , wherein each file of the at least one program chunk includes a separate file SBOM with one or more file declarations and one or more dependency declarations, wherein the program chunk SBOM for the at least one program chunk incorporates all file declarations and all dependency declarations of all corresponding file SBOMs for all files included in the at least one program chunk.
12. The method of claim 1 , wherein different permutations of the set of program chunks are incorporated into different configurations of the programming build, each different permutation of the set of program chunks including different combinations of files of the set of program chunks, each different configuration of the programming build comprising a different program chunk SBOM that is unique from all other program chunk SBOMs associated with the different configurations of the programming build.
13. A computing system comprising:
one or more hardware processors; and one or more storage devices having stored computer-executable instructions that are executable by the one or more hardware processors for configuring the computing system to perform the following:
identify a programming build to generate a build SBOM (software bill of materials) for, the programming build comprising a particular configuration that utilizes at least one or more files from each program chunk of a set of program chunks;
identify a program chunk SBOM corresponding to each program chunk of the set of program chunks, each program chunk SBOM comprising declarations of files and dependencies associated with files included within each corresponding program chunk;
verify each program chunk of the set of program chunks based at least in part on a strong identifier of the corresponding program chunk SBOM associated with said each program chunk;
examine evidence associated with said each program chunk of the set of program chunks to identify at least one program chunk of the set of program chunks that includes at least a particular file or dependency that is not utilized by the programming build, and which is declared in the corresponding program chunk SBOM for that at least one program chunk; and
generate the build SBOM for the programming build based at least in part on each of the program chunk SBOMs by at least including declarations of files and dependencies specified in each of the program chunk SBOMs for the program chunks utilized in the programming build and while refraining from adding a declaration of the particular file or dependency to the build SBOM that identifies the particular file or dependency as being incorporated into the programming build, and wherein the program build utilizes the at least one program chunk having the corresponding program chunk SBOM that does include a declaration for the particular file or dependency.
14. The computing system of claim 13 , the computer-executable instructions being further executable for configuring the computing system to generate the strong identifier of the build SBOM for enabling subsequent verification of the build SBOM and creating a digital record that associates the strong identifier of the build SBOM with an identifier of the particular configuration of the programming build.
15. The computing system of claim 14 , wherein generating the build SBOM further includes verifying that the build SBOM omits the particular file or dependency from the build SBOM prior to generating the strong identifier of the build SBOM.
16. The computing system of claim 15 , wherein verifying that the build SBOM omits the particular file or dependency from the build SBOM includes adding an explicit declaration to the build SBOM that the particular file or dependency is not utilized by the particular configuration of the programming build that is associated with the build SBOM.
17. The computing system of claim 13 , wherein the set of program chunks is used to create both the programming build comprising a first build having the particular configuration and a different programming build comprising a second build that at least partially incorporates each program chunk of the set of program chunks with a different configuration than the particular configuration of the first build, and wherein the computer-executable instructions are further executable for configuring the computing system to generate a second build SBOM for the second programming build, the second build SBOM including a declaration for one or more file or dependency that is omitted from a first build SBOM, based on the one or more file or dependency being utilized by the second build but not being utilized by the first build.
18. The computing system of claim 17 , wherein the second build SBOM includes a file declaration from a reference program chunk SBOM which is omitted from the first SBOM.
19. The computing system of claim 17 , wherein the second build SBOM includes a dependency declaration from a reference program chunk SBOM which is omitted from the first build SBOM.
20. A computer program product comprising one or more storage devices having stored computer-executable instructions that are executable by one or more hardware processors of a computing system for configuring the computing system to perform the following:
identify a programming build to generate a build SBOM (software bill of materials) for, the programming build comprising a particular configuration that utilizes at least one or more files from each program chunk of a set of program chunks;
identify a program chunk SBOM corresponding to each program chunk of the set of program chunks, each program chunk SBOM comprising declarations of files and dependencies associated with files included within each corresponding program chunk;
verify each program chunk of the set of program chunks based at least in part on a strong identifier of the corresponding program chunk SBOM associated with said each program chunk;
examine evidence associated with said each program chunk of the set of program chunks to identify at least one program chunk of the set of program chunks that includes at least a particular file or dependency that is not utilized by the programming build, and which is declared in the corresponding program chunk SBOM for that at least one program chunk; and
generate the build SBOM for the programming build based at least in part on each of the program chunk SBOMs by at least including declarations of files and dependencies specified in each of the program chunk SBOMs for the program chunks utilized in the programming build and while refraining from adding a declaration of the particular file or dependency to the build SBOM that identifies the particular file or dependency as being incorporated into the programming build, and wherein the program build utilizes the at least one program chunk having the corresponding program chunk SBOM that does include a declaration for the particular file or dependency.