28 Sep
2023
28 Sep
'23
2:13 p.m.
On 28 Sep 2023, at 12:36, Ivan Ribakov via sr-users
<sr-users(a)lists.kamailio.org> wrote:
Hi Olle,
Yes, I realised by now that taking enabled Kamailio modules into account when generating
SBOM is too much to ask. I'd be ok with obtaining full list of Kamailio dependencies
(with transitive dependencies if possible) and then manually filtering them based on
module usage. Not sure if at any point during Kamailio build process all sources +
dependency sources/binaries are present in the system for scanning/identification?
I'm mainly interested in listing (and validating licenses) and having a general
inventory. Any recommendations?
I did try a beta of a tool in cyclonedx toolset for scanning C files and it
crashed. Will try again, but so far I haven’t succeeded.
I suggest we would need one SBOM based on a linux distro, like Debian and one
more generic based on C code and the versions of libraries we recommend. I have tried to
add pointers to the various
third party dependencies in the READMEs over the years in a somewhat unstructured effort,
but the information is there.
Maybe we can add the dependencies in a way that’s parseable in order to build an SBOM.
C code doesn’t have package management like Python, Perl, Go and others so it’s tricky to
automate creation of SBOMs.
I think that the SBOM tree for the source code and dependencies would grow quite large.
Anyway - at this time, I failed. :-)
/O
--
Ivan Ribakov
Software Engineer
www.zaleos.net <http://www.zaleos.net/>
On Thu, 28 Sept 2023 at 10:58, Olle E. Johansson via sr-users
<sr-users(a)lists.kamailio.org <mailto:sr-users@lists.kamailio.org>> wrote:
Still digging through this. There are tools that
can list your packages if you install Linux packages, i.e. Debian.
But there are no tools that can parse your kamailio config to really see what’s loaded
and active.
It all depends on what you want to do with the SBOM - if you want to check for
vulnerabilities, list licenses
or have a generic inventory.
/O
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
To unsubscribe send an email to sr-users-leave(a)lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe: On 28 Sep 2023, at 09:41, Henning Westerholt via
sr-users <sr-users(a)lists.kamailio.org <mailto:sr-users@lists.kamailio.org>>
wrote:
Hello,
I think Olle was looking into that some month ago, maybe (when he reads it) can share
some of his research results if possible.
You can also find some of his articles e.g., on his linkedin page.
Cheers,
Henning
--
Henning Westerholt – https://skalatan.de/blog/
Kamailio services – https://gilawa.com <https://gilawa.com/>
From: Ivan Ribakov via sr-users <sr-users(a)lists.kamailio.org
<mailto:sr-users@lists.kamailio.org>>
Sent: Mittwoch, 27. September 2023 21:11
To: Kamailio (SER) - Users Mailing List <sr-users(a)lists.kamailio.org
<mailto:sr-users@lists.kamailio.org>>
Cc: Ivan Ribakov <i.ribakov(a)zaleos.net <mailto:i.ribakov@zaleos.net>>
Subject: [SR-Users] Software bill of materials (SBOM)
Any recommendations for a tool that can generate SBOM for a Kamailio instance based on
configured modules?
Thanks,
Ivan
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
To unsubscribe send an email to sr-users-leave(a)lists.kamailio.org
<mailto:sr-users-leave@lists.kamailio.org>
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
To unsubscribe send an email to sr-users-leave(a)lists.kamailio.org
<mailto:sr-users-leave@lists.kamailio.org>
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe: