Compile-time native code software bill of material generator
AssigneeRunsafe Security, Inc.
InventorsSalim Rolf Blume, Kelli Schwalm, Shane Paulsen Fry
Life of this patent
Estimating the term…
Abstract
Presented is a method for capturing the software bill of material (SBOM) for compiled-code languages (like C or C++), in the absence of a package manager (such as Conan). The method loads a library into the process space of all tools used in the build process (e.g. gcc, Id, as, etc), which allows it to observe all of the files opened by the build tool during the build process. By combining a process identification tree, PID tree, with the record of which files were opened or created by which build tools, the system is able to identify all of the files utilized in the build and create a tree of which files depend on which other files.
Claims20
A method for generating a software bill-of-material on a developers build system during the build process of a binary file, the software bill-of-material including unique identifiers for all files accessed during the build process and their dependencies, the method comprising:
- assigning a library to preload as part of the build process when a build application is loaded into memory on the developers build system, said library comprising an initialize function, an exit function, and an open-detect function,
- said build application comprising a series of code blocks which are executed as sequential events including an application construction, an application objective, and an application deconstruction, and
- said developers build system having an operating system which includes an open-file function;
- registering the initialize function to be executed during the application construction,
- the exit function to be executed during the application deconstruction,
- invoking the initialize function during the application construction, thereby causing the open-detect function to wrap the open-file function of the operating systems such that the open-detect function is executed with any subsequent open-file call performed on the developers build system, and creating a database and storing metadata relating to the build application;
- exiting the application construction code block and proceeding to the application objective, wherein the application objective includes code to open a file;
- calling the operating system's open-file function to open said file;
- intercepting the open-file function call by the open-detect function, said open-detect function collecting information relative to the file, and storing said information to the database, and invoking the operating system's open-file function prior to returning to the application objective;
- completing the application objective and entering the application deconstruction wherein the application deconstruction invokes the exit function, said exit function closing said database;
- generating a software bill-of-material from the stored information from the database.
A system for generating a software bill-of-material on a developers build system during the build process of a binary file, the software bill-of-material including unique identifiers for all files accessed during the build process and their dependencies, the system comprising:
- the developers build system having an operating system which includes an open-file function;
- a build application loaded into memory on the developers build system, said build application comprising a series of code blocks which are executed as sequential events including an application construction, an application objective, and an application deconstruction;
- and
- a library assigned to be preloaded as part of the build process when the build application is loaded into memory on the developers build system, said library comprising an initialize function, an exit function, and an open-detect function, wherein the initialize function is registered to be executed during the application construction and the exit function is registered to be executed during the application deconstruction;
- wherein the initialize function, when invoked during the application construction, is configured to cause the open-detect function to wrap the open-file function of the operating system such that the open-detect function is executed with any subsequent open-file call performed on the developers build system, and to create a database and store metadata relating to the build application;
- wherein, upon exiting the application construction code block and proceeding to the application objective, the application objective includes code to open a file and calls the operating system's open-file function to open said file;
- wherein the open-detect function is configured to intercept the open-file function call, to collect information relative to the file, to store said information to the database, and to invoke the operating system's open-file function prior to returning to the application objective;
- wherein, upon completing the application objective and entering the application deconstruction, the application deconstruction invokes the exit function, said exit function closing said database;
- and
- wherein a software bill-of-material is generated from the stored information from the database.
A non-transitory computer-readable medium storing instructions for generating a software bill-of-material on a developers build system during the build process of a binary file, the software bill-of-material including unique identifiers for all files accessed during the build process and their dependencies, the instructions, when executed by one or more processors of the developers build system, cause the processor to:
- assign a library to preload as part of the build process when a build application is loaded into memory on the developers build system,
- said library comprising an initialize function, an exit function, and an open-detect function,
- said build application comprising a series of code blocks which are executed as sequential events including an application construction, an application objective, and an application deconstruction, and
- said developers build system having an operating system which includes an open-file function;
- register the initialize function to be executed during the application construction, the exit function to be executed during the application deconstruction;
- invoke the initialize function during the application construction, thereby causing the open-detect function to wrap the open-file function of the operating system such that the open-detect function is executed with any subsequent open-file call performed on the developers build system, and create a database and store metadata relating to the build application;
- exit the application construction code block and proceed to the application objective, wherein the application objective includes code to open a file;
- call the operating system's open-file function to open said file;
- intercept the open-file function call by the open-detect function, said open-detect function collecting information relative to the file, and store said information to the database, and invoke the operating system's open-file function prior to returning to the application objective;
- complete the application objective and enter the application deconstruction wherein the application deconstruction invokes the exit function, said exit function closing said database;
- and
- generate a software bill-of-material from the stored information from the database.
Dependencies are inferred from the claim text.