feat: add missing tools to SBOM

.devcontainer/base/Dockerfile

@@ -31,7 +31,8 @@ HEALTHCHECK NONE
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
 # hadolint ignore=DL3008
-RUN --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tmp/apt-requirements.json \
+RUN --mount=type=bind,source=.devcontainer/base/add-sbom-note.sh,target=/tmp/add-sbom-note.sh \
+    --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tmp/apt-requirements.json \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     --mount=type=cache,target=/var/log,sharing=locked \
@@ -51,6 +52,14 @@ RUN --mount=type=bind,source=.devcontainer/base/apt-requirements.json,target=/tm
    cp -r /src/bats-support /usr/local/bats-support
    cp -r /src/bats-assert /usr/local/bats-assert
 
+   # Retain the bats-core manifest so the tool is captured in the SBOM
+   mkdir -p /usr/local/lib/bats-core
+   cp /src/bats-core/package.json /usr/local/lib/bats-core/package.json
+
+   # Install the SBOM annotation helper so downstream flavors can annotate tools
+   # that Syft cannot detect on its own (see .devcontainer/base/add-sbom-note.sh)
+   install -m 0755 /tmp/add-sbom-note.sh /usr/local/bin/add-sbom-note
+
    # Generate locale
    sed -i '/C.UTF-8/s/^# //' /etc/locale.gen
    locale-gen

.devcontainer/base/add-sbom-note.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Annotate ELF binaries with a systemd `.note.package` section so that Syft
+# includes them in the generated SBOM (see https://systemd.io/ELF_PACKAGE_METADATA/).
+#
+# This is used for tools that are installed outside of a package manager (e.g.
+# downloaded release binaries) and that Syft cannot otherwise detect. Binaries
+# that do not exist are skipped; if none of the given binaries exist the script
+# fails so that a renamed or dropped tool becomes a hard build error.
+#
+# Usage: add-sbom-note.sh <name> <version> <purl> <binary>...
+set -Eeuo pipefail
+
+name="${1:?tool name required}"
+version="${2:?tool version required}"
+purl="${3:?tool purl required}"
+shift 3
+
+note="$(mktemp)"
+trap 'rm -f "${note}"' EXIT
+jq -n --arg name "${name}" --arg version "${version}" --arg purl "${purl}" '{name: $name, version: $version, purl: $purl}' > "${note}"
+
+tagged=0
+for binary in "$@"; do
+    if [ -x "${binary}" ]; then
+        objcopy --add-section .note.package="${note}" \
+                --set-section-flags .note.package=noload,readonly "${binary}"
+        tagged=1
+    fi
+done
+
+[ "${tagged}" -eq 1 ] || { echo "no binaries found to annotate for ${name}" >&2; exit 1; }

.devcontainer/base/apt-requirements.json

@@ -1,5 +1,6 @@
 {
   "bash-completion": "1:2.16.0-8build1",
+  "binutils": "2.46-3ubuntu2",
   "ca-certificates": "20260601~26.04.1",
   "git": "1:2.53.0-1ubuntu1",
   "gnupg2": "2.4.8-4ubuntu3",

.devcontainer/base/tool-inventory.json

@@ -0,0 +1,8 @@
+[
+  "bats",
+  "bats-assert",
+  "bats-support",
+  "git",
+  "gnupg2",
+  "wget"
+]

.devcontainer/cpp/Dockerfile

@@ -9,6 +9,7 @@
 ARG XWIN_VERSION=0.8.0
 # Whether or not to build the embedded flavor of this container
 ARG BUILD_EMBEDDED_FLAVOR=false
+ARG ARM_GNU_TOOLCHAIN_VERSION=15.2.rel1
 
 # Downloader stage for AMD64 architecture
 FROM scratch AS downloader-amd64
@@ -53,6 +54,7 @@
 ARG CCACHE_VERSION
 ARG XWIN_VERSION
 ARG BUILD_EMBEDDED_FLAVOR
+ARG ARM_GNU_TOOLCHAIN_VERSION
 
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
@@ -65,7 +67,7 @@
     apt-get update && apt-get install --no-install-recommends -y minisign
 
     if [[ "${BUILD_EMBEDDED_FLAVOR}" == "true" ]]; then
-        ARM_GNU_TOOLCHAIN_URL="https://developer.arm.com/-/media/Files/downloads/gnu/15.2.rel1/binrel/arm-gnu-toolchain-15.2.rel1-$(uname -m)-arm-none-eabi.tar.xz"
+        ARM_GNU_TOOLCHAIN_URL="https://developer.arm.com/-/media/Files/downloads/gnu/${ARM_GNU_TOOLCHAIN_VERSION}/binrel/arm-gnu-toolchain-${ARM_GNU_TOOLCHAIN_VERSION}-$(uname -m)-arm-none-eabi.tar.xz"
         ARM_GNU_TOOLCHAIN_TAR="/tmp/arm-gnu-toolchain.tar.xz"
 
         if [[ "$(uname -m)" == "x86_64" ]]; then
@@ -95,6 +97,9 @@
 ARG CPM_VERSION=0.42.1
 ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26
 ARG BUILD_EMBEDDED_FLAVOR
+ARG CCACHE_VERSION
+ARG XWIN_VERSION
+ARG ARM_GNU_TOOLCHAIN_VERSION
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -111,6 +116,7 @@
     PATH="$PATH:/usr/lib/llvm-${CLANG_VERSION}/bin:/opt/gcc-arm-none-eabi/bin" \
     PYTHONPYCACHEPREFIX=/cache/.python
 
+# hadolint ignore=DL3008
 RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target=/tmp/apt-requirements-base.json \
     --mount=type=bind,source=.devcontainer/cpp/apt-requirements-clang.json,target=/tmp/apt-requirements-clang.json \
     --mount=type=bind,source=.devcontainer/cpp/requirements.txt,target=/tmp/requirements.txt \
@@ -148,40 +154,56 @@
         # Install arm-gcc toolchain
         cp -a /src/arm-gnu-toolchain-*-arm-none-eabi /opt/gcc-arm-none-eabi
     fi
-EOF
 
-# Install include-what-you-use (iwyu) from source
-# hadolint ignore=DL3008
-RUN --mount=type=cache,target=/cache,sharing=locked \
-    --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
- apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev \
- && wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp \
- && CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build \
- && cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install \
- && rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} \
- && apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev \
- && apt-get autoremove -y \
- && apt-get clean
-
-# Update all tool alternatives to the correct version
-RUN --mount=type=cache,target=/var/log,sharing=locked \
- update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-15 10 \
+    # Install include-what-you-use (iwyu) from source
+    apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
+    wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp
+    CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build
+    cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install
+    rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}
+    apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev
+    apt-get autoremove -y
+    apt-get clean
+
+    # Update all tool alternatives to the correct version
+    update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-15 10 \
                         --slave /usr/bin/g++ g++ /usr/bin/g++-15 \
-                        --slave /usr/bin/gcov gcov /usr/bin/gcov-15 \
- && update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
-                        --slave /usr/bin/c++ c++ /usr/bin/g++-15 \
- && update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10 \
- && update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \
+                        --slave /usr/bin/gcov gcov /usr/bin/gcov-15
+    update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
+                        --slave /usr/bin/c++ c++ /usr/bin/g++-15
+    update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10
+    update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \
                         --slave /usr/bin/mull-reporter mull-reporter /usr/bin/mull-reporter-${CLANG_VERSION} \
-                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION} \
- && update-alternatives --install /usr/bin/python python /usr/bin/python3 10 \
- && mkdir /root/.amp
-
-# Set up package managers CPM and Conan
-# - Install CPM.cmake to the CMake module path
-# - Configure a default profile for Conan and set the CMake generator to Ninja
-RUN --mount=type=cache,target=/cache,sharing=locked \
- wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake \
- && conan profile detect \
- && echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
+                        --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION}
+    update-alternatives --install /usr/bin/python python /usr/bin/python3 10
+
+    mkdir /root/.amp
+
+    # Set up package managers CPM and Conan
+    # - Install CPM.cmake to the CMake module path
+    # - Configure a default profile for Conan and set the CMake generator to Ninja
+    #
+    # NOTE: CPM.cmake is intentionally absent from the generated SBOM. It is a single
+    # CMake module (not an ELF binary), so it cannot carry a `.note.package` ELF
+    # section and Syft has no cataloger for standalone `.cmake` files. Its version is
+    # pinned and tracked via the CPM_VERSION build argument above.
+    wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake
+    conan profile detect
+    echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
+
+    add-sbom-note ccache "${CCACHE_VERSION}" "pkg:generic/ccache@${CCACHE_VERSION}" \
+        /usr/local/bin/ccache
+    add-sbom-note xwin "${XWIN_VERSION}" "pkg:cargo/xwin@${XWIN_VERSION}" \
+        /usr/local/bin/xwin
+    add-sbom-note include-what-you-use "${INCLUDE_WHAT_YOU_USE_VERSION}" "pkg:generic/include-what-you-use@${INCLUDE_WHAT_YOU_USE_VERSION}" \
+        /usr/local/bin/include-what-you-use
+
+    # Annotate tools that Syft cannot detect on its own with a `.note.package` ELF
+    # section (systemd ELF package metadata convention, see
+    # https://systemd.io/ELF_PACKAGE_METADATA/) so they are included in the SBOM
+    # generated for the image. `add-sbom-note` is provided by the base image.
+    if [[ "${BUILD_EMBEDDED_FLAVOR}" == "true" ]]; then
+        add-sbom-note arm-gnu-toolchain "${ARM_GNU_TOOLCHAIN_VERSION}" "pkg:generic/arm-gnu-toolchain@${ARM_GNU_TOOLCHAIN_VERSION}" \
+            /opt/gcc-arm-none-eabi/bin/arm-none-eabi-{gcc,g++,ld,objcopy,size}
+    fi
+EOF

.devcontainer/cpp/tool-inventory.json

@@ -0,0 +1,19 @@
+[
+  "ccache",
+  "clang-22",
+  "clang-format-22",
+  "clang-tidy-22",
+  "clang-tools-22",
+  "clangd-22",
+  "cmake",
+  "conan",
+  "g++-15",
+  "gcovr",
+  "gdb-multiarch",
+  "include-what-you-use",
+  "lld-22",
+  "llvm-22",
+  "mull-22",
+  "ninja-build",
+  "xwin"
+]

.devcontainer/docs/tool-inventory.json

@@ -0,0 +1,5 @@
+[
+  "graphviz",
+  "plantuml",
+  "sbdl"
+]

.devcontainer/embedded-cpp/tool-inventory.json

@@ -0,0 +1,20 @@
+[
+  "arm-gnu-toolchain",
+  "ccache",
+  "clang-22",
+  "clang-format-22",
+  "clang-tidy-22",
+  "clang-tools-22",
+  "clangd-22",
+  "cmake",
+  "conan",
+  "g++-15",
+  "gcovr",
+  "gdb-multiarch",
+  "include-what-you-use",
+  "lld-22",
+  "llvm-22",
+  "mull-22",
+  "ninja-build",
+  "xwin"
+]

.devcontainer/rust/Dockerfile

@@ -4,6 +4,10 @@ ARG BASE_IMAGE=ghcr.io/philips-software/amp-devcontainer-base:edge
 FROM ${BASE_IMAGE}
 
 ARG CARGO_BINSTALL_VERSION=1.17.9
+ARG CARGO_BINUTILS_VERSION=0.3.6
+ARG CARGO_MUTANTS_VERSION=25.3.1
+ARG FLIP_LINK_VERSION=0.1.12
+ARG PROBE_RS_TOOLS_VERSION=0.30.0
 ARG RUST_VERSION=1.94.1
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -12,6 +16,11 @@ HEALTHCHECK NONE
 
 SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"]
 
+ENV BINSTALL_DISABLE_TELEMETRY=true \
+    CARGO_HOME=/usr/local/cargo \
+    RUSTUP_HOME=/usr/local/rustup \
+    PATH=/usr/local/cargo/bin:"$PATH"
+
 RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tmp/apt-requirements.json \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -23,20 +32,32 @@ RUN --mount=type=bind,source=.devcontainer/rust/apt-requirements.json,target=/tm
 
     update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \
                         --slave /usr/bin/c++ c++ /usr/bin/g++-15
-EOF
 
-# Install rust
-ENV BINSTALL_DISABLE_TELEMETRY=true \
-    CARGO_HOME=/usr/local/cargo \
-    RUSTUP_HOME=/usr/local/rustup \
-    PATH=/usr/local/cargo/bin:"$PATH"
-
-RUN rustup set profile minimal \
- && rustup default ${RUST_VERSION} \
- && rustup component add clippy llvm-tools rustfmt \
- && rustup target add thumbv7em-none-eabi \
- && rustup target add thumbv7em-none-eabihf
-
-# Install additional rust tools
-RUN wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin" \
- && cargo-binstall -y --locked cargo-binutils@0.3.6 cargo-mutants@25.3.1 flip-link@0.1.12 probe-rs-tools@0.30.0
+    # Install rust
+    rustup set profile minimal
+    rustup default ${RUST_VERSION}
+    rustup component add clippy llvm-tools rustfmt
+    rustup target add thumbv7em-none-eabi
+    rustup target add thumbv7em-none-eabihf
+
+    wget -qO - "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-$(uname -m)-unknown-linux-gnu.tgz" | tar xz -C "/usr/bin"
+    cargo-binstall -y --locked "cargo-binutils@${CARGO_BINUTILS_VERSION}" \
+                               "cargo-mutants@${CARGO_MUTANTS_VERSION}" \
+                               "flip-link@${FLIP_LINK_VERSION}" \
+                               "probe-rs-tools@${PROBE_RS_TOOLS_VERSION}"
+
+    # Annotate tools that Syft cannot detect on its own with a `.note.package` ELF
+    # section (systemd ELF package metadata convention, see
+    # https://systemd.io/ELF_PACKAGE_METADATA/) so they are included in the SBOM
+    # generated for the image. `add-sbom-note` is provided by the base image.
+    add-sbom-note cargo-binstall "${CARGO_BINSTALL_VERSION}" "pkg:cargo/cargo-binstall@${CARGO_BINSTALL_VERSION}" \
+        /usr/bin/cargo-binstall
+    add-sbom-note cargo-binutils "${CARGO_BINUTILS_VERSION}" "pkg:cargo/cargo-binutils@${CARGO_BINUTILS_VERSION}" \
+        "${CARGO_HOME}"/bin/cargo-{cov,nm,objcopy,profdata,readobj,size,strip}
+    add-sbom-note cargo-mutants "${CARGO_MUTANTS_VERSION}" "pkg:cargo/cargo-mutants@${CARGO_MUTANTS_VERSION}" \
+        "${CARGO_HOME}/bin/cargo-mutants"
+    add-sbom-note flip-link "${FLIP_LINK_VERSION}" "pkg:cargo/flip-link@${FLIP_LINK_VERSION}" \
+        "${CARGO_HOME}/bin/flip-link"
+    add-sbom-note probe-rs-tools "${PROBE_RS_TOOLS_VERSION}" "pkg:cargo/probe-rs-tools@${PROBE_RS_TOOLS_VERSION}" \
+        "${CARGO_HOME}"/bin/probe-rs "${CARGO_HOME}"/bin/cargo-embed "${CARGO_HOME}"/bin/cargo-flash
+EOF

.devcontainer/rust/tool-inventory.json

@@ -0,0 +1,10 @@
+[
+  "cargo-binstall",
+  "cargo-binutils",
+  "cargo-mutants",
+  "flip-link",
+  "g++-15",
+  "probe-rs-tools",
+  "rust",
+  "rustup"
+]

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,3 +14,4 @@
 - [ ] I have added tests for new behavior, and have not broken any existing tests
 - [ ] I have added or updated relevant documentation
 - [ ] I have verified that all added components are accounted for in the SBOM
+- [ ] I understand the image size delta and agree the functionality justifies it

.github/RELEASE_TEMPLATE.md

@@ -16,3 +16,44 @@
 | amp-devcontainer-embedded-cpp | ghcr.io/philips-software/amp-devcontainer-embedded-cpp:{{ amp-devcontainer-embedded-cpp-version }}@{{ amp-devcontainer-embedded-cpp-sha }} |
 | amp-devcontainer-rust         | ghcr.io/philips-software/amp-devcontainer-rust:{{ amp-devcontainer-rust-version }}@{{ amp-devcontainer-rust-sha }}                         |
 
+#### :hammer_and_wrench: Included tools
+
+The tables below list the most relevant tools per flavor and their versions, as
+recorded in the image's Software Bill of Materials (SBOM).
+
+<details>
+<summary>amp-devcontainer-base</summary>
+
+{{ amp-devcontainer-base-tools }}
+
+</details>
+
+<details>
+<summary>amp-devcontainer-cpp</summary>
+
+{{ amp-devcontainer-cpp-tools }}
+
+</details>
+
+<details>
+<summary>amp-devcontainer-docs</summary>
+
+{{ amp-devcontainer-docs-tools }}
+
+</details>
+
+<details>
+<summary>amp-devcontainer-embedded-cpp</summary>
+
+{{ amp-devcontainer-embedded-cpp-tools }}
+
+</details>
+
+<details>
+<summary>amp-devcontainer-rust</summary>
+
+{{ amp-devcontainer-rust-tools }}
+
+</details>
+
+