Design of the omnibor crate

[alilleybrinker]

Okay, with the specification having come along to a better point, I'd like to sketch out a design for the omnibor crate. In particular, I think it should have the following features:

• Create an ArtifactInputManifest which includes the individual input records
• Support embedding this in a binary in a custom ELF notes section
• Support writing this to a distinct file, respecting the environment variable guidance
• Support writing the ArtifactIdentifier for the ArtifactInputManifest to the end of any generated file, with an option for overwriting any prior identifier, or for simply appending
• Support reading an ArtifactInputManifest for a file, either from an ELF section or from a separate metadata file
• Support resolving an ArtifactDependencyGraph from a set of manifests.

[alilleybrinker]

Good note during the last WG meeting that, as this progresses, we should coordinate with the Go implementation folks to make sure we're keeping the APIs relatively similar (modulo common language patterns).

[yonhan3]

I would be interested to see how you add a custom ELF .note.omnibor section to an existing executable or shared object file (which does not contain .note.omnibor ELF section).

It is straight-forward to replace the emedded OmniBOR bom-id if this ELF section already exists in the ELF executable.
I have tried to use the objcopy tool, specifically the "objcopy --add-section" command. But it does not work well to create a new loadable ELF section. (It is perfectly fine to add a new non-loadable ELF section).

[alilleybrinker]

I'll admit, I'm not very knowledgeable about how ELF works, so this will be an area I'll have to explore. I absolutely will not have this crate rely on external system dependencies like the presence of objcopy, so something like modifying the ELF binary will either be through reimplementation or leaving that portion to users of the crate (i.e., we could output the binary data, but leave updating the binary file itself to our users).

[yonhan3]

Thanks for the reply. I guess by using compilers (or low-level tools) we could probably make it work, but not sure. Thanks! :-)