kassane/zwid

[WIP] Utilities for embedding CoSWID tags in EFI binaries - written on Zig

zwid

Utilities for embedding CoSWID tags in EFI binaries - written on Zig

Introduction

Software Identification (SWID) tags provide an extensible XML-based structure to identify and describe individual software components, patches, and installation bundles. SWID tag representations can be too large for devices with network and storage constraints.

CoSWID supports a similar set of semantics and features as SWID tags, as well as new semantics that allow us to describe additional types of information, all in a more memory efficient format.

We wanted to write up some text recommending a particular tool to be integrated into the tianocore build process, but they all are not exactly awesome:

• The official tool from NIST is a huge Java codebase that hasn't been updated for some time and doesn't work with any versions than Java 9 and that's been end-of-support since 2018.

• A go & rust implementation exists for coreboot utilities.

Installing

Requires: zig v0.10.0

Commands:

$> zig build run -D{Options: debug|release-fast|release-safe|release-small} -- path/firmware.bin

zwid's Issues

TODO

Development will initially follow the procedures of the official spec (draft) based on the features available from the language or not (include cffi?).

Reference:

• https://www.ietf.org/archive/id/draft-ietf-sacm-coswid-22.html

Libraries:

• CBor parser
• XML parser (zig version , xml tokenize or libxml2)