feat: add missing tools to SBOM

.devcontainer/base/Dockerfile

@@ -31,7 +31,8 @@ HEALTHCHECK NONE
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
 # hadolint ignore=DL3008
-RUN --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tmp/apt-requirements.json \
+RUN --mount=type=bind,source=.devcontainer/base/add-sbom-note.sh,target=/tmp/add-sbom-note.sh \
+    --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tmp/apt-requirements.json \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     --mount=type=cache,target=/var/log,sharing=locked \
@@ -51,6 +52,14 @@ RUN --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tm
    cp -r /src/bats-support /usr/local/bats-support
    cp -r /src/bats-assert /usr/local/bats-assert
 
+   # Retain the bats-core manifest so the tool is captured in the SBOM
+   mkdir -p /usr/local/lib/bats-core
+   cp /src/bats-core/package.json /usr/local/lib/bats-core/package.json
+
+   # Install the SBOM annotation helper so downstream flavors can annotate tools
+   # that Syft cannot detect on its own (see .devcontainer/base/add-sbom-note.sh)
+   install -m 0755 /tmp/add-sbom-note.sh /usr/local/bin/add-sbom-note
+
    # Generate locale
    sed -i '/C.UTF-8/s/^# //' /etc/locale.gen
    locale-gen

.devcontainer/base/add-sbom-note.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Annotate ELF binaries with a systemd `.note.package` section so that Syft
+# includes them in the generated SBOM (see https://systemd.io/ELF_PACKAGE_METADATA/).
+#
+# This is used for tools that are installed outside of a package manager (e.g.
+# downloaded release binaries) and that Syft cannot otherwise detect. Binaries
+# that do not exist are skipped; if none of the given binaries exist the script
+# fails so that a renamed or dropped tool becomes a hard build error.
+#
+# Usage: add-sbom-note.sh <name> <version> <purl> <binary>...
+set -Eeuo pipefail
+
+name="${1:?tool name required}"
+version="${2:?tool version required}"
+purl="${3:?tool purl required}"
+shift 3
+
+note="$(mktemp)"
+trap 'rm -f "${note}"' EXIT
+jq -n --arg name "${name}" --arg version "${version}" --arg purl "${purl}" '{name: $name, version: $version, purl: $purl}' > "${note}"
+
+tagged=0
+for binary in "$@"; do
+    if [ -x "${binary}" ]; then
+        objcopy --add-section .note.package="${note}" \
+                --set-section-flags .note.package=noload,readonly "${binary}"
+        tagged=1
+    fi
+done
+
+[ "${tagged}" -eq 1 ] || { echo "no binaries found to annotate for ${name}" >&2; exit 1; }

.devcontainer/base/apt-requirements.json

@@ -1,5 +1,6 @@
 {
   "bash-completion": "1:2.16.0-8build1",
+  "binutils": "2.46-3ubuntu2",
   "ca-certificates": "20260601~26.04.1",
   "git": "1:2.53.0-1ubuntu1",
   "gnupg2": "2.4.8-4ubuntu3",

.devcontainer/base/devcontainer.json

@@ -5,5 +5,29 @@
   },
   "remoteEnv": {
     "CONTAINER_FLAVOR": "base"
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "files.insertFinalNewline": true,
+        "files.trimTrailingWhitespace": true,
+        "[json][yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode",
+          "editor.formatOnSave": true
+        }
+      },
+      "extensions": [
+        "esbenp.prettier-vscode@12.4.0",
+        "github.copilot@1.388.0",
+        "github.vscode-github-actions@0.32.1",
+        "github.vscode-pull-request-github@0.154.0",
+        "jetmartin.bats@0.1.10",
+        "kherring.bats-test-runner@0.1.3",
+        "mhutchie.git-graph@1.30.0",
+        "ms-azuretools.vscode-docker@2.0.0",
+        "sonarsource.sonarlint-vscode@5.4.0",
+        "usernamehw.errorlens@3.28.0"
+      ]
+    }
   }
 }

.devcontainer/base/tool-inventory.json

@@ -0,0 +1 @@
+["bats", "bats-assert", "bats-support", "git", "gnupg2", "wget"]

.devcontainer/cpp/Dockerfile

@@ -9,6 +9,7 @@
 ARG XWIN_VERSION=0.8.0
 # Whether or not to build the embedded flavor of this container
 ARG BUILD_EMBEDDED_FLAVOR=false
+ARG ARM_GNU_TOOLCHAIN_VERSION=15.2.rel1
 
 # Downloader stage for AMD64 architecture
 FROM scratch AS downloader-amd64
@@ -53,6 +54,7 @@
 ARG CCACHE_VERSION
 ARG XWIN_VERSION
 ARG BUILD_EMBEDDED_FLAVOR
+ARG ARM_GNU_TOOLCHAIN_VERSION
 
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
@@ -65,7 +67,7 @@
     apt-get update && apt-get install --no-install-recommends -y minisign
 
     if [[ "${BUILD_EMBEDDED_FLAVOR}" == "true" ]]; then
-        ARM_GNU_TOOLCHAIN_URL="https://developer.arm.com/-/media/Files/downloads/gnu/15.2.rel1/binrel/arm-gnu-toolchain-15.2.rel1-$(uname -m)-arm-none-eabi.tar.xz"
+        ARM_GNU_TOOLCHAIN_URL="https://developer.arm.com/-/media/Files/downloads/gnu/${ARM_GNU_TOOLCHAIN_VERSION}/binrel/arm-gnu-toolchain-${ARM_GNU_TOOLCHAIN_VERSION}-$(uname -m)-arm-none-eabi.tar.xz"
         ARM_GNU_TOOLCHAIN_TAR="/tmp/arm-gnu-toolchain.tar.xz"
 
         if [[ "$(uname -m)" == "x86_64" ]]; then
@@ -95,6 +97,9 @@
 ARG CPM_VERSION=0.42.1
 ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26
 ARG BUILD_EMBEDDED_FLAVOR
+ARG CCACHE_VERSION
+ARG XWIN_VERSION
+ARG ARM_GNU_TOOLCHAIN_VERSION
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -111,6 +116,7 @@
     PATH="$PATH:/usr/lib/llvm-${CLANG_VERSION}/bin:/opt/gcc-arm-none-eabi/bin" \
     PYTHONPYCACHEPREFIX=/cache/.python
 
+# hadolint ignore=DL3008
 RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target=/tmp/apt-requirements-base.json \
     --mount=type=bind,source=.devcontainer/cpp/apt-requirements-clang.json,target=/tmp/apt-requirements-clang.json \
     --mount=type=bind,source=.devcontainer/cpp/requirements.txt,target=/tmp/requirements.txt \
@@ -148,40 +154,56 @@
         # Install arm-gcc toolchain
         cp -a /src/arm-gnu-toolchain-*-arm-none-eabi /opt/gcc-arm-none-eabi
     fi
-EOF
 
-# Install include-what-you-use (iwyu) from source
-# hadolint ignore=DL3008
-RUN --mount=type=cache,target=/cache,sharing=locked \
-    --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
- apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev \
- && wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp \
- && CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build \
- && cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install \
- && rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} \
- && apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev \
- && apt-get autoremove -y \
- && apt-get clean
-
-# Update all tool alternatives to the correct version
-RUN --mount=type=cache,target=/var/log,sharing=locked \
- update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-15 10 \
+    # Install include-what-you-use (iwyu) from source
+    apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
+    wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp
+    CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build
+    cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install
+    rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}
+    apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
+    apt-get autoremove -y
+    apt-get clean
+
+    # Update all tool alternatives to the correct version
+    update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-15 10 \
                         --slave /usr/bin/g++ g++ /usr/bin/g++-15 \
-                        --slave /usr/bin/gcov gcov /usr/bin/gcov-15 \
- && update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
-                        --slave /usr/bin/c++ c++ /usr/bin/g++-15 \
- && update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10 \
- && update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \
+                        --slave /usr/bin/gcov gcov /usr/bin/gcov-15
+    update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
+                        --slave /usr/bin/c++ c++ /usr/bin/g++-15
+    update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10
+    update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \
                         --slave /usr/bin/mull-reporter mull-reporter /usr/bin/mull-reporter-${CLANG_VERSION} \
-                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION} \
- && update-alternatives --install /usr/bin/python python /usr/bin/python3 10 \
- && mkdir /root/.amp
-
-# Set up package managers CPM and Conan
-# - Install CPM.cmake to the CMake module path
-# - Configure a default profile for Conan and set the CMake generator to Ninja
-RUN --mount=type=cache,target=/cache,sharing=locked \
- wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake \
- && conan profile detect \
- && echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
+                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION}
+    update-alternatives --install /usr/bin/python python /usr/bin/python3 10
+
+    mkdir /root/.amp
+
+    # Set up package managers CPM and Conan
+    # - Install CPM.cmake to the CMake module path
+    # - Configure a default profile for Conan and set the CMake generator to Ninja
+    #
+    # NOTE: CPM.cmake is intentionally absent from the generated SBOM. It is a single
+    # CMake module (not an ELF binary), so it cannot carry a `.note.package` ELF
+    # section and Syft has no cataloger for standalone `.cmake` files. Its version is
+    # pinned and tracked via the CPM_VERSION build argument above.
+    wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake
+    conan profile detect
+    echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
+
+    add-sbom-note ccache "${CCACHE_VERSION}" "pkg:generic/ccache@${CCACHE_VERSION}" \
+        /usr/local/bin/ccache
+    add-sbom-note xwin "${XWIN_VERSION}" "pkg:cargo/xwin@${XWIN_VERSION}" \
+        /usr/local/bin/xwin
+    add-sbom-note include-what-you-use "${INCLUDE_WHAT_YOU_USE_VERSION}" "pkg:generic/include-what-you-use@${INCLUDE_WHAT_YOU_USE_VERSION}" \
+        /usr/local/bin/include-what-you-use
+
+    # Annotate tools that Syft cannot detect on its own with a `.note.package` ELF
+    # section (systemd ELF package metadata convention, see
+    # https://systemd.io/ELF_PACKAGE_METADATA/) so they are included in the SBOM
+    # generated for the image. `add-sbom-note` is provided by the base image.
+    if [[ "${BUILD_EMBEDDED_FLAVOR}" == "true" ]]; then
+        add-sbom-note arm-gnu-toolchain "${ARM_GNU_TOOLCHAIN_VERSION}" "pkg:generic/arm-gnu-toolchain@${ARM_GNU_TOOLCHAIN_VERSION}" \
+            /opt/gcc-arm-none-eabi/bin/arm-none-eabi-{gcc,g++,ld,objcopy,size}
+    fi
+EOF

.devcontainer/cpp/devcontainer.json

@@ -31,10 +31,15 @@
         "cucumberautocomplete.smartSnippets": true,
         "cucumberautocomplete.onTypeFormat": true,
         "files.insertFinalNewline": true,
-        "files.trimTrailingWhitespace": true
+        "files.trimTrailingWhitespace": true,
+        "[json][yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode",
+          "editor.formatOnSave": true
+        }
       },
       "extensions": [
         "alexkrechik.cucumberautocomplete@3.1.0",
+        "esbenp.prettier-vscode@12.4.0",
         "github.copilot@1.388.0",
         "github.vscode-github-actions@0.32.1",
         "github.vscode-pull-request-github@0.154.0",

.devcontainer/cpp/tool-inventory.json

@@ -0,0 +1,19 @@
+[
+  "ccache",
+  "clang-22",
+  "clang-format-22",
+  "clang-tidy-22",
+  "clang-tools-22",
+  "clangd-22",
+  "cmake",
+  "conan",
+  "g++-15",
+  "gcovr",
+  "gdb-multiarch",
+  "include-what-you-use",
+  "lld-22",
+  "llvm-22",
+  "mull-22",
+  "ninja-build",
+  "xwin"
+]

.devcontainer/docs/devcontainer.json

@@ -14,9 +14,14 @@
     "vscode": {
       "settings": {
         "files.insertFinalNewline": true,
-        "files.trimTrailingWhitespace": true
+        "files.trimTrailingWhitespace": true,
+        "[json][yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode",
+          "editor.formatOnSave": true
+        }
       },
       "extensions": [
+        "esbenp.prettier-vscode@12.4.0",
         "github.copilot@1.388.0",
         "github.vscode-github-actions@0.32.1",
         "github.vscode-pull-request-github@0.152.0",

.devcontainer/docs/tool-inventory.json

@@ -0,0 +1 @@
+["graphviz", "plantuml", "sbdl"]

.devcontainer/embedded-cpp/devcontainer.json

@@ -32,10 +32,15 @@
         "cucumberautocomplete.smartSnippets": true,
         "cucumberautocomplete.onTypeFormat": true,
         "files.insertFinalNewline": true,
-        "files.trimTrailingWhitespace": true
+        "files.trimTrailingWhitespace": true,
+        "[json][yaml]": {
+          "editor.defaultFormatter": "esbenp.prettier-vscode",
+          "editor.formatOnSave": true
+        }
       },
       "extensions": [
         "alexkrechik.cucumberautocomplete@3.1.0",
+        "esbenp.prettier-vscode@12.4.0",
         "github.copilot@1.388.0",
         "github.vscode-github-actions@0.32.1",
         "github.vscode-pull-request-github@0.154.0",

.devcontainer/embedded-cpp/tool-inventory.json

@@ -0,0 +1,20 @@
+[
+  "arm-gnu-toolchain",
+  "ccache",
+  "clang-22",
+  "clang-format-22",
+  "clang-tidy-22",
+  "clang-tools-22",
+  "clangd-22",
+  "cmake",
+  "conan",
+  "g++-15",
+  "gcovr",
+  "gdb-multiarch",
+  "include-what-you-use",
+  "lld-22",
+  "llvm-22",
+  "mull-22",
+  "ninja-build",
+  "xwin"
+]

.devcontainer/rust/Dockerfile

@@ -4,6 +4,10 @@ ARG BASE_IMAGE=ghcr.io/philips-software/amp-devcontainer-base:edge
 FROM ${BASE_IMAGE}
 
 ARG CARGO_BINSTALL_VERSION=1.17.9
+ARG CARGO_BINUTILS_VERSION=0.3.6
+ARG CARGO_MUTANTS_VERSION=25.3.1
+ARG FLIP_LINK_VERSION=0.1.12
+ARG PROBE_RS_TOOLS_VERSION=0.30.0
 ARG RUST_VERSION=1.94.1
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -12,6 +16,11 @@ HEALTHCHECK NONE
 
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
+ENV BINSTALL_DISABLE_TELEMETRY=true \
+    CARGO_HOME=/usr/local/cargo \
+    RUSTUP_HOME=/usr/local/rustup \
+    PATH=/usr/local/cargo/bin:"$PATH"
+
 RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tmp/apt-requirements.json \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -23,20 +32,32 @@ RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tm
 
     update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
                         --slave /usr/bin/c++ c++ /usr/bin/g++-15
-EOF
 
-# Install rust
-ENV BINSTALL_DISABLE_TELEMETRY=true \
-    CARGO_HOME=/usr/local/cargo \
-    RUSTUP_HOME=/usr/local/rustup \
-    PATH=/usr/local/cargo/bin:"$PATH"
-
-RUN rustup set profile minimal \
- && rustup default ${RUST_VERSION} \
- && rustup component add clippy llvm-tools rustfmt \
- && rustup target add thumbv7em-none-eabi \
- && rustup target add thumbv7em-none-eabihf
-
-# Install additional rust tools
-RUN wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin" \
- && cargo-binstall -y --locked cargo-binutils@0.3.6 cargo-mutants@25.3.1 flip-link@0.1.12 probe-rs-tools@0.30.0
+    # Install rust
+    rustup set profile minimal
+    rustup default ${RUST_VERSION}
+    rustup component add clippy llvm-tools rustfmt
+    rustup target add thumbv7em-none-eabi
+    rustup target add thumbv7em-none-eabihf
+
+    wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin"
+    cargo-binstall -y --locked "cargo-binutils@${CARGO_BINUTILS_VERSION}" \
+                               "cargo-mutants@${CARGO_MUTANTS_VERSION}" \
+                               "flip-link@${FLIP_LINK_VERSION}" \
+                               "probe-rs-tools@${PROBE_RS_TOOLS_VERSION}"
+
+    # Annotate tools that Syft cannot detect on its own with a `.note.package` ELF
+    # section (systemd ELF package metadata convention, see
+    # https://systemd.io/ELF_PACKAGE_METADATA/) so they are included in the SBOM
+    # generated for the image. `add-sbom-note` is provided by the base image.
+    add-sbom-note cargo-binstall "${CARGO_BINSTALL_VERSION}" "pkg:cargo/cargo-binstall@${CARGO_BINSTALL_VERSION}" \
+        /usr/bin/cargo-binstall
+    add-sbom-note cargo-binutils "${CARGO_BINUTILS_VERSION}" "pkg:cargo/cargo-binutils@${CARGO_BINUTILS_VERSION}" \
+        "${CARGO_HOME}"/bin/cargo-{cov,nm,objcopy,profdata,readobj,size,strip}
+    add-sbom-note cargo-mutants "${CARGO_MUTANTS_VERSION}" "pkg:cargo/cargo-mutants@${CARGO_MUTANTS_VERSION}" \
+        "${CARGO_HOME}/bin/cargo-mutants"
+    add-sbom-note flip-link "${FLIP_LINK_VERSION}" "pkg:cargo/flip-link@${FLIP_LINK_VERSION}" \
+        "${CARGO_HOME}/bin/flip-link"
+    add-sbom-note probe-rs-tools "${PROBE_RS_TOOLS_VERSION}" "pkg:cargo/probe-rs-tools@${PROBE_RS_TOOLS_VERSION}" \
+        "${CARGO_HOME}"/bin/probe-rs "${CARGO_HOME}"/bin/cargo-embed "${CARGO_HOME}"/bin/cargo-flash
+EOF