Re: [Suit] How are firmware and firmware versions expressed in manifest?

Dick Brooks <dick@reliableenergyanalytics.com> Fri, 05 June 2020 21:55 UTC

Return-Path: <dick@reliableenergyanalytics.com>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E8123A0EA0 for <suit@ietfa.amsl.com>; Fri, 5 Jun 2020 14:55:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8J-OnlCZmVzh for <suit@ietfa.amsl.com>; Fri, 5 Jun 2020 14:55:21 -0700 (PDT)
Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35D503A0E9B for <suit@ietf.org>; Fri, 5 Jun 2020 14:55:21 -0700 (PDT)
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 5F6765C0095; Fri, 5 Jun 2020 17:55:20 -0400 (EDT)
Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Fri, 05 Jun 2020 17:55:20 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=ek5pUS9FGm/BZ5j19Fqjsu0TrL+JmTjW5lXBPXNkf W8=; b=r5ilwtsC6BmuK2pPfEL0kaIk0v1vX7Prk8z+lGAyvYDun1HaKAQIk/t/D HDIQrDq4l7i00hoZCdUgUwNETnIzIxl6mQ8Po6vGB7F5nC5AhHKRm3AnFDcpxa5J YtoIkCN25+EYfePwqUq298WpDt1bfAO9HiExg9/ARirKirRfsY/p7HLiZJwkFxkD NAhR73GvmzT/3oVjnabqcCu2qtINIrobDkMlIeu0j0Y/4qWJ8ezZ0u+f6SAAPz4I wkYWOw1fQyqkDk8jEarGgFMlrF0CH3qHz7cZ0Elhy1fZ91WMj6uDNtNkKryMPGYJ 9LYN7DJZPr1vgSB5Z4nOk8iDwRW4g==
X-ME-Sender: <xms:R7_aXugMNMfiLZlYESYz47Z7vx9VJ4R796ynMk7tOtqIMWDPNaWPAQ>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedrudeggecutefuodetggdotefrodftvfcurf hrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecuuegr ihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjug hrpefhvfhfjgfuffhokfggtgfgofhtsehtjeertddvtddvnecuhfhrohhmpedfffhitghk uceurhhoohhkshdfuceoughitghksehrvghlihgrsghlvggvnhgvrhhghigrnhgrlhihth hitghsrdgtohhmqeenucggtffrrghtthgvrhhnpeehteevveehueeitefhfeevffekteei uedvjeevveejheffteekieefieffledtheenucffohhmrghinheprhgvlhhirggslhgvvg hnvghrghihrghnrghlhihtihgtshdrtghomhdpshgrnhguvghlmhgrnhdrtggrnecukfhp pedvudeirdduleefrddugedvrddvvdenucevlhhushhtvghrufhiiigvpedtnecurfgrrh grmhepmhgrihhlfhhrohhmpeguihgtkhesrhgvlhhirggslhgvvghnvghrghihrghnrghl hihtihgtshdrtghomh
X-ME-Proxy: <xmx:R7_aXvAKmPLErEnNegiG8t55NaGogW6CXsNTKU7AmxWpEAYxVkFpVQ> <xmx:R7_aXmGgMBF-UWr366aMcIbEP2pKnem07QMxfCrX9AvB7kmf4CKu0g> <xmx:R7_aXnTbGj7gM1ymKlQ3NKDXsTuxlU7xqzCGz9CjP2mvnOsvl1nxnw> <xmx:SL_aXkph3o4rRDvoZSeQD7n_27OENjRDnE3QKWLSXxvu_T7SNe2ARQ>
Received: from farpoint (unknown [216.193.142.22]) by mail.messagingengine.com (Postfix) with ESMTPA id 204F3328005D; Fri, 5 Jun 2020 17:55:19 -0400 (EDT)
From: "Dick Brooks" <dick@reliableenergyanalytics.com>
To: "'Michael Richardson'" <mcr@sandelman.ca>, "'Hannes Tschofenig'" <Hannes.Tschofenig@arm.com>
Cc: "'Eliot Lear'" <lear@cisco.com>, <suit@ietf.org>, "'Saad EL JAOUHARI'" <saadeljaou@gmail.com>, "'Henk Birkholz'" <henk.birkholz@sit.fraunhofer.de>
References: <AM0PR08MB371631B7C1E6B50DCA29049AFA880@AM0PR08MB3716.eurprd08.prod.outlook.com> <8b6d01d639d0$62614150$2723c3f0$@reliableenergyanalytics.com> <AM0PR08MB37166AD36B5AA36EA7D7CA9BFA890@AM0PR08MB3716.eurprd08.prod.outlook.com> <20437.1591317129@localhost> <1076601d63b3a$d53f5d90$7fbe18b0$@reliableenergyanalytics.com> <BF5D5E46-4A7C-44A7-8554-5DE1E03A3F21@cisco.com> <AM0PR08MB3716C555048993639B14D76FFA860@AM0PR08MB3716.eurprd08.prod.outlook.com> <5820.1591393073@localhost>
In-Reply-To: <5820.1591393073@localhost>
Date: Fri, 5 Jun 2020 17:55:15 -0400
Organization: Reliable Energy Analytics
Message-ID: <12c0e01d63b84$00bff3f0$023fdbd0$@reliableenergyanalytics.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQEpJGg3Q76y3b59AZfDOO6eGr7fRAJUo0s2Am+d4lkB06Pk1ADWaYOUAhdO83ACM65vWAF5pebOqbsmO+A=
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/k6bhMRm9B2QZAOtfj9Cy9fMhdR0>
Subject: Re: [Suit] How are firmware and firmware versions expressed in manifest?
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Jun 2020 21:55:23 -0000

Here's an example of a "manufactured" SBOM that my SW creates today as part
of a CIP-010-3 risk assessment, which I'm hoping to produce from a firmware
object following SUIT/MUD:

Performing program introspection for risks...
*************** PROPERTIES *******************
----> Manufacturer : Microsoft
----> ProductCode : {B6B7DDDB-1FF6-47F6-AB32-457052610E19}
----> ProductName : PowerToys (Preview)
----> ProductVersion : 0.15.2
*************** FILES AND COMPONENTS *******************
----> Executable; FileName:  ruguzy_l.exe|PowerToys.exe  in module:
powertoys_exe
----> Executable; FileName:  h-ey7k2x.exe|PowerToysSettings.exe  in module:
settings_exe
----> Executable; FileName:  syxida6a.dll|Notifications.dll  in module:
notifications_dll
----> Executable; FileName:  _6j56zho.dll|shortcut_guide.dll  in module:
Module_ShortcutGuide
----> Executable; FileName:  3xugv-xs.dll|fancyzones.dll  in module:
Module_FancyZones
----> Executable; FileName:  big0xqbx.dll|PowerRenameExt.dll  in module:
Module_PowerRename
----> Executable; FileName:  bundle.js  in module:  settings_js_bundle
----> Executable; FileName:  mdhcn61j.exe|FancyZonesEditor.exe  in module:
Module_FancyZones
----> Executable; FileName:  9bdoaowy.dll|ControlzEx.dll  in module:
Module_FancyZones
----> Executable; FileName:  eb2enddq.dll|MahApps.Metro.dll  in module:
Module_FancyZones
----> Executable; FileName:  p_v6yvui.dll|Microsoft.Xaml.Behaviors.dll  in
module:  Module_FancyZones
----> Executable; FileName:  jve_oxvy.dll|Microsoft.Bcl.AsyncInterfaces.dll
in module:  Module_FancyZones
----> Executable; FileName:  qmwo-wq3.dll|System.Buffers.dll  in module:
Module_FancyZones
----> Executable; FileName:  cmhozp3b.dll|System.Memory.dll  in module:
Module_FancyZones
----> Executable; FileName:  dfjkhcy2.dll|System.Numerics.Vectors.dll  in
module:  Module_FancyZones
----> Executable; FileName:
p781ucha.dll|System.Runtime.CompilerServices.Unsafe.dll  in module:
Module_FancyZones
----> Executable; FileName:  yrific62.dll|System.Text.Encodings.Web.dll  in
module:  Module_FancyZones
----> Executable; FileName:  dwnfqiw_.dll|System.Text.Json.dll  in module:
Module_FancyZones
----> Executable; FileName:
fut-sab_.dll|System.Threading.Tasks.Extensions.dll  in module:
Module_FancyZones
----> Executable; FileName:  6cuycogx.dll|System.ValueTuple.dll  in module:
Module_FancyZones
A trust score of: 86.0 has been calculated for this step. Do you wish to
assign a passing grade (Y)/N?



Thanks,

Dick Brooks

Never trust software, always verify and report! T
http://www.reliableenergyanalytics.com
Email: dick@reliableenergyanalytics.com
Tel: +1 978-696-1788

-----Original Message-----
From: Michael Richardson <mcr@sandelman.ca> 
Sent: Friday, June 05, 2020 5:38 PM
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
Cc: Eliot Lear <lear@cisco.com>om>; Dick Brooks
<dick@reliableenergyanalytics.com>om>; suit@ietf.org; Saad EL JAOUHARI
<saadeljaou@gmail.com>om>; Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Subject: Re: [Suit] How are firmware and firmware versions expressed in
manifest?


Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:
    > FWIW I thought that COSWID would provide information about the
software
    > libraries on a device.

No, AFAIK, it just identifies the materials. (i.e. "libcurl 1.0.2")

Assembling them into a BOM requires another process:
  "curl 1.0.2" contains "libcurl 1.0.2", "curl-main",
                        "libssl 1.1.1f", "glibc 2.19", "pcre 1.0.2"

I could mis-understand though.

--
]               Never tell me the odds!                 | ipv6 mesh networks
[
]   Michael Richardson, Sandelman Software Works        |    IoT architect
[
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails
[