CXX-3309 Automate SBOM generation and Endor Labs scanning #1528

jasonhills-mongodb · 2025-12-04T18:46:05Z

Objective

Obviate manual SBOM component management via automated generation of a CycloneDX SBOM that includes all required and optional runtime components.
Add Endor Labs SCA scanning of PRs (non-blocking)

Changes

Add a GitHub Action workflow (.github/workflows/endor_scan_and_generate_sbom.yml) triggered by edits to cmake files that:
- (push) performs an Endor Labs SCA scan and exports an SBOM for master or releases/v* branches, enriches SBOM with metadata, opens a PR for updated SBOM
- (pull_request) performs an Endor Labs SCA scan for PRs (non-blocking) and, if potential vulnerabilities were found, add a comment to PR
- (workflow_dispatch) workflow can also be triggered manually
Remove the etc/purls.txt file
- update all references to it in scripts and documentation
- existing scripts and processes using Silkbomb for the augmented SBOM are unchanged, except that the sbom.json file is used as input instead of etc/purls.txt
Change the location of the SBOM file from etc/cyclonedx.sbom.json to sbom.json for consistency with other MDB repos
Add etc/sbom folder with:
- Python scripts for SBOM generation using Endor Labs scan results and pre-defined enrichment data
  - Dependency group added to pyproject.toml
- SBOM enrichment data in etc/sbom/metadata.cdx.json
Updated SBOM-related documentation in etc/releasing.md

Testing

The workflow was thoroughly tested on a fork, including scenarios with missing or malformed files.

Permissions

The workflow requires the repository configuration to allow it to request write access and open PRs.

Miscellaneous

Once this is merged to master, it may be cherry picked to the relevant release branches.
Once approved, this will be ported to the C driver repo.
The new SBOM format is in alignment with the NITA Minimum Elements for Software Bill of Materials and OWASP Software Component Verification Standard (SCVS). Both publications emphasize that all components used in creation of software are to be documented in an SBOM, including ecosystem-based dependencies, as a best practice.

CMakeLists.txt

eramongodb · 2025-12-04T18:55:48Z

etc/releasing.md

+  }
+}
 ```
+The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the assocaited `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`).


Suggested change

The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the assocaited `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`).

The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the associated `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`).

Typo.

eramongodb · 2025-12-04T19:02:34Z

etc/sbom/config.py

Given these scripts are intended for use by GitHub Actions, can they be relocated into a new .github/scripts directory instead?

eramongodb · 2025-12-04T19:08:50Z

.github/workflows/endor_scan_and_generate_sbom.yml

+          CXX_STANDARD: 17
+        working-directory: ${{env.BUILD}}
+        run: |
+          cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON


Suggested change

cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON

cmake -DCMAKE_BUILD_TYPE="${{env.BUILD_TYPE}}" -DCMAKE_CXX_STANDARD="${{env.CXX_STANDARD}}" -DENABLE_TESTS=OFF -B . -S ..

Recommended CMake command syntax + guard against variable expansion.

eramongodb · 2025-12-04T19:11:02Z

.github/workflows/endor_scan_and_generate_sbom.yml

+        working-directory: ${{env.BUILD}}
+        run: |
+          cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON
+          rm .gitignore # prevent exclusion of build/_deps from endorctl scan


Suggested change

rm .gitignore # prevent exclusion of build/_deps from endorctl scan

echo "!_deps" >>.gitignore # prevent exclusion of build/_deps from endorctl scan

Consider excluding the _deps directory specifically instead.

eramongodb · 2025-12-04T19:11:47Z

.github/workflows/endor_scan_and_generate_sbom.yml

+        env:
+          ENDOR_SCAN_EMBEDDINGS: true
+        with:
+          additional_args: '--languages=c --include-path="build/_deps/**"'


Should the --languages flag use something like c,cpp instead? Catch2 (only used for tests) is a C++ library.

eramongodb · 2025-12-04T19:14:43Z

.evergreen/scripts/sbom.sh

  --repo mongodb/mongo-cxx-driver
  --branch "${branch_name:?}"
-  --sbom-in /pwd/etc/cyclonedx.sbom.json
+  --sbom-in /pwd/sbom.json


Why not under etc as before? Is this required by Endor Labs?

kevinAlbs · 2025-12-08T13:51:06Z

etc/sbom/metadata.cdx.json

+          "type": "distribution"
+        }
+      ],
+      "scope": "required"


Should zlib be marked "optional"? zlib is a default-enabled but optional component. The C driver may be built without zlib. And the C++ driver can be built using a custom C driver install:

# Install C driver without zlib: cd "$HOME/code/mongo-c-driver" cmake -DENABLE_ZLIB=OFF -S. -Bcmake-build -DCMAKE_INSTALL_PREFIX="$HOME/mongo-c-driver-nozlib" cmake --build cmake-build --target install # Build C++ driver with custom C driver: cd "$HOME/code/mongo-cxx-driver" cmake -DCMAKE_PREFIX_PATH="$HOME/mongo-c-driver-nozlib" -S. -Bcmake-build

However, I expect that is a rare scenario. I expect most users would have zlib enabled.

kevinAlbs · 2025-12-08T15:19:49Z

etc/releasing.md

-Run a patch build which executes the `sbom` task and download the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:
+Ensure the container engine (e.g. `podman` or `docker`) is authenticated with the DevProd-provided Amazon ECR instance.
+
+Run a patch build which executes the `sbom` task and downloads the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:


Suggested change

Run a patch build which executes the `sbom` task and downloads the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:

Run a patch build which executes the `sbom` task and download the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:

Tweak wording since the person doing the release is expected to download and commit the Augmented SBOM.

kevinAlbs · 2025-12-08T15:36:02Z

etc/third_party_vulnerabilities.md

 - **Date Detected:** YYYY-MM-DD
 - **Severity:** Low, Medium, High, or Critical
- **Detector:** Silk or Snyk
+- **Detector:** Endor Labs or Dependency-Track


If Silk is no longer used, suggest similarly updating ssdlc_compliance_report.md.

Aside: ssdlc_compliance_report.md was a requirement of DRIVERS-2898 and refers to Proposal: SSDLC Compliance Verification Flow. I think that policy is no longer required in favor of Secure SDLC Best Practices. So maybe ssdlc_compliance_report.md is no longer strictly needed.

kevinAlbs · 2025-12-08T15:40:40Z

.github/workflows/endor_scan_and_generate_sbom.yml

+        if: env.PR_SCAN == 'false'
+        id: sbom_diff
+        run: |
+          # diff the temp SBOM files, save output to variable, supress exit code


Suggested change

# diff the temp SBOM files, save output to variable, supress exit code

# diff the temp SBOM files, save output to variable, suppress exit code

CXX-3309 Automate SBOM generation using Endor Labs

3c31ff6

jasonhills-mongodb requested a review from a team as a code owner December 4, 2025 18:46

jasonhills-mongodb requested a review from kevinAlbs December 4, 2025 18:46

kevinAlbs requested a review from eramongodb December 4, 2025 18:49

Add updated SBOM

e307951

eramongodb requested changes Dec 5, 2025

View reviewed changes

kevinAlbs reviewed Dec 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CXX-3309 Automate SBOM generation and Endor Labs scanning #1528

CXX-3309 Automate SBOM generation and Endor Labs scanning #1528

Uh oh!

jasonhills-mongodb commented Dec 4, 2025 •

edited

Loading

Uh oh!

Uh oh!

eramongodb Dec 4, 2025

Uh oh!

eramongodb Dec 4, 2025 •

edited

Loading

Uh oh!

eramongodb Dec 4, 2025

Uh oh!

eramongodb Dec 4, 2025

Uh oh!

eramongodb Dec 4, 2025 •

edited

Loading

Uh oh!

eramongodb Dec 4, 2025

Uh oh!

kevinAlbs Dec 8, 2025

Uh oh!

kevinAlbs Dec 8, 2025

Uh oh!

kevinAlbs Dec 8, 2025

Uh oh!

kevinAlbs Dec 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the assocaited `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`).
	The `metadata.component.bom-ref` field does not need to change, but if you do change it be sure to also update the associated `dependencies[].ref` field. Note that the github PURL references the release tag (`rX.Y.Z`).

	cmake .. -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_STANDARD=${{env.CXX_STANDARD}} -DENABLE_TESTS=ON
	cmake -DCMAKE_BUILD_TYPE="${{env.BUILD_TYPE}}" -DCMAKE_CXX_STANDARD="${{env.CXX_STANDARD}}" -DENABLE_TESTS=OFF -B . -S ..

	rm .gitignore # prevent exclusion of build/_deps from endorctl scan
	echo "!_deps" >>.gitignore # prevent exclusion of build/_deps from endorctl scan

	Run a patch build which executes the `sbom` task and downloads the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:
	Run a patch build which executes the `sbom` task and download the "Augmented SBOM (Updated)" file as `etc/augmented.sbom.json`. Evergreen CLI may be used to schedule only the `sbom` task:

	# diff the temp SBOM files, save output to variable, supress exit code
	# diff the temp SBOM files, save output to variable, suppress exit code

CXX-3309 Automate SBOM generation and Endor Labs scanning #1528

Are you sure you want to change the base?

CXX-3309 Automate SBOM generation and Endor Labs scanning #1528

Uh oh!

Conversation

jasonhills-mongodb commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Objective

Changes

Testing

Permissions

Miscellaneous

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eramongodb Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eramongodb Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jasonhills-mongodb commented Dec 4, 2025 •

edited

Loading

eramongodb Dec 4, 2025 •

edited

Loading

eramongodb Dec 4, 2025 •

edited

Loading