SBOM b850 blobs - #948
Draft
filipleple wants to merge 3 commits into
Draft
Conversation
Commit e0813b3 converted most git-backed SBOM components to the human-readable `<date>_<hash>` software-version and a release tag as colloquial-version, but edk2-platforms and edk2-gop were missed and still emitted a bare commit hash with a tree hash as colloquial-version. openSIL likewise still recorded only a bare commit hash. Convert all three to follow suit: software-version now uses `<commit-date>_<hash>`, and where the template carries a colloquial-version field (edk2-platforms, edk2-gop) it now holds the latest release tag reachable from HEAD, selected the same way as the iPXE/vboot rules. openSIL has no colloquial-version field, so only its software-version changes. Decisions based on the RFC: https://datatracker.ietf.org/doc/rfc9393/ Upstream-Status: Pending Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com> (cherry picked from commit 3ff4d68)
SBOM_EDK2_GOP could only ever be enabled on Intel boards: it depended on
EDK2_GOP_DRIVER, the Intel GOP symbol (INTEL_GMA_ADD_VBT && NO_GFX_INIT).
AMD boards provide the GOP driver through EDK2_AMD_GOP_DRIVER (VGA_BIOS
&& NO_GFX_INIT) instead, so on e.g. the MSI PRO B850-P WIFI (ms7e56) the
dependency was unsatisfiable and the AMD GOP driver was silently omitted
from the SBOM even though the blob was built into the image.
Depend on (EDK2_GOP_DRIVER || EDK2_AMD_GOP_DRIVER) and drop the
Intel-only wording from the option prompts and help. The Makefile rule
and edk2-gop.json template already keyed off the shared EDK2_GOP_FILE,
so only the component label was Intel-specific; fill a <gop_vendor>
placeholder ("AMD" when EDK2_AMD_GOP_DRIVER, else "Intel") so the CoSWID
tag names the driver that was actually built.
Turning the component on for a board is still a separate defconfig change
(CONFIG_SBOM_EDK2_GOP=y, plus SBOM_VGA_BIOS / SBOM_EDK2_LAN_ROM); this
change only makes it reachable on AMD boards.
Ref: Dasharo/dasharo-issues#1879
Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
(cherry picked from commit 7d05309)
filipleple
force-pushed
the
sbom_b850_blobs
branch
from
July 24, 2026 10:10
57a8fba to
ee88709
Compare
The MSI PRO B850-P WIFI image bundles the AMD VGA BIOS (Phoenix_generic_vbios.bin), the AMD GOP driver (AmdX64GenericGop.efi) and the Realtek LAN Option ROM (RtkUndiDxe.efi), but the generated SBOM omitted all three: the SBOM_VGA_BIOS / SBOM_EDK2_GOP / SBOM_EDK2_LAN_ROM options default to n. Enable them so the SBOM describes the blobs that are actually built into the image. SBOM_EDK2_GOP is now reachable here because EDK2_AMD_GOP_DRIVER is default y for this board (VGA_BIOS && NO_GFX_INIT && EDK2_REPO_MRCHROMEBOX) and the option was taught to accept the AMD GOP driver. Upstream-Status: Inappropriate [Dasharo downstream] Ref: Dasharo/dasharo-issues#1879 Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
filipleple
force-pushed
the
sbom_b850_blobs
branch
from
July 24, 2026 10:12
ee88709 to
0d2eaec
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mocked up; we don't know yet where the blobs will land and how they're structured, i.e. how to obtain the version. Here is the template for including them in the SBOM, calculating the hash, and so far filling the version with containing repo's commit hash.