From 33d074e2804f1ff37b3ce6b78c5830c4f15c1068 Mon Sep 17 00:00:00 2001
From: jiangjianfeng <jiangjianfeng.jjf@antgroup.com>
Date: Fri, 17 Sep 2021 11:56:27 +0800
Subject: [PATCH] Parse command line options

---
 tools/Makefile              |   2 +
 tools/copy_bom/.gitignore   |   9 +
 tools/copy_bom/Cargo.lock   | 480 ++++++++++++++++++++++++++++++++++++
 tools/copy_bom/Cargo.toml   |  19 ++
 tools/copy_bom/Makefile     |  21 ++
 tools/copy_bom/README.md    |  43 ++++
 tools/copy_bom/example.yaml |  38 +++
 tools/copy_bom/src/main.rs  | 112 +++++++++
 8 files changed, 724 insertions(+)
 create mode 100644 tools/copy_bom/.gitignore
 create mode 100644 tools/copy_bom/Cargo.lock
 create mode 100644 tools/copy_bom/Cargo.toml
 create mode 100644 tools/copy_bom/Makefile
 create mode 100644 tools/copy_bom/README.md
 create mode 100644 tools/copy_bom/example.yaml
 create mode 100644 tools/copy_bom/src/main.rs

diff --git a/tools/Makefile b/tools/Makefile
index e1445271..8c7ff426 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -9,6 +9,7 @@ all:
 	@ln -s -f ../../tools/occlum ../$(BUILD_DIR)/bin/occlum
 	@$(MAKE) --no-print-directory -C protect-integrity
 	@$(MAKE) --no-print-directory -C gen_internal_conf
+	@$(MAKE) --no-print-directory -C copy_bom
 	@$(MAKE) --no-print-directory -C init
 
 format:
@@ -20,4 +21,5 @@ format-check:
 clean:
 	@$(MAKE) --no-print-directory -C protect-integrity clean
 	@$(MAKE) --no-print-directory -C gen_internal_conf clean
+	@$(MAKE) --no-print-directory -C copy_bom clean
 	@$(MAKE) --no-print-directory -C init clean
diff --git a/tools/copy_bom/.gitignore b/tools/copy_bom/.gitignore
new file mode 100644
index 00000000..de9894d0
--- /dev/null
+++ b/tools/copy_bom/.gitignore
@@ -0,0 +1,9 @@
+/target
+run*
+*-test/*
+.vscode
+*backup
+*demos
+install.sh
+base.yaml
+occlum_elf_loader.config
diff --git a/tools/copy_bom/Cargo.lock b/tools/copy_bom/Cargo.lock
new file mode 100644
index 00000000..879f13e4
--- /dev/null
+++ b/tools/copy_bom/Cargo.lock
@@ -0,0 +1,480 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ansi_term"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "byteorder"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc10e8cc6b2580fda3f36eb6dc5316657f812a3df879a44a66fc9f0fdbc4855"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "2.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "copy_bom"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "data-encoding",
+ "elf",
+ "env_logger",
+ "lazy_static",
+ "log",
+ "regex",
+ "serde",
+ "serde_yaml",
+ "sha2",
+ "shellexpand",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95059428f66df56b63431fdb4e1947ed2190586af5c5a8a8b71122bdf5a7f469"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ee2393c4a91429dffb4bedf19f4d6abf27d8a732c8ce4980305d782e5426d57"
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "dirs-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "dtoa"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56899898ce76aaf4a0f24d914c97ea6ed976d42fec6ad33fcbb0a1103e07b2b0"
+
+[[package]]
+name = "elf"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4841de15dbe0e49b9b62a417589299e3be0d557e0900d36acb87e6dae47197f5"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "501466ecc8a30d1d3b7fc9229b122b2ce8ed6e9d9223f1138d4babb253e51817"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd999463524c52659517fe2cea98493cfe485d10565e7b0fb07dbba7ad2753"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "indexmap"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc633605454125dec4b66843673f01c7df2b89479b32e0ed634e43a91cff62a5"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cb00336871be5ed2c8ed44b60ae9959dc5b9f08539422ed43f09e34ecaeba21"
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fb9b38af92608140b86b693604b9ffcc5824240a484d1ecd4795bacb2fe88f3"
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9f5105d4fdaab20335ca9565e106a5d9b82b6219b5ba735731124ac6711d23d"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8383f39639269cde97d255a32bdb68c047337295414940c68bdd30c2e13203ff"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528532f3d801c87aec9def2add9ca802fe569e44a544afe633765267840abe64"
+dependencies = [
+ "getrandom",
+ "redox_syscall",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "serde"
+version = "1.0.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7bc1a1ab1961464eae040d96713baa5a724a8152c1222492465b54322ec508b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad104641f3c958dab30eb3010e834c2622d1f3f4c530fef1dee20ad9485f3c09"
+dependencies = [
+ "dtoa",
+ "indexmap",
+ "serde",
+ "yaml-rust",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9204c41a1597a8c5af23c82d1c921cb01ec0a4c59e07a9c7306062829a3903f3"
+dependencies = [
+ "block-buffer",
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+ "opaque-debug",
+]
+
+[[package]]
+name = "shellexpand"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83bdb7831b2d85ddf4a7b148aa19d0587eddbe8671a436b7bd1182eaad0f2829"
+dependencies = [
+ "dirs-next",
+]
+
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
+[[package]]
+name = "syn"
+version = "1.0.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f58f7e8eaa0009c5fec437aabf511bd9933e4b2d7407bd05273c01a8906ea7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "typenum"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f6906492a7cd215bfa4cf595b600146ccfac0c79bcbd1f3000162af5e8b06"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "version_check"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
diff --git a/tools/copy_bom/Cargo.toml b/tools/copy_bom/Cargo.toml
new file mode 100644
index 00000000..cae55965
--- /dev/null
+++ b/tools/copy_bom/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "copy_bom"
+version = "0.1.0"
+edition = "2018"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+serde = { version = "1.0", features = ["derive"] }
+serde_yaml = "0.8"
+log = "0.4.14"
+env_logger = "0.9.0"
+clap = "2.33.3"
+sha2 = "0.9.5"
+data-encoding = "2.3.2"
+lazy_static = "1.4.0"
+regex = "1.5.4"
+shellexpand = "2.1"
+elf = "0.0.10"
diff --git a/tools/copy_bom/Makefile b/tools/copy_bom/Makefile
new file mode 100644
index 00000000..93d34648
--- /dev/null
+++ b/tools/copy_bom/Makefile
@@ -0,0 +1,21 @@
+include ../../src/sgxenv.mk
+
+SRC_FILES := $(shell find . -type f -name '*.rs') Cargo.toml
+RUST_TARGET_DIR := $(BUILD_DIR)/internal/tools/copy_bom/cargo-target
+RUST_OUT_DIR := $(BUILD_DIR)/bin
+TARGET_BINARY := $(RUST_OUT_DIR)/copy_bom
+
+.PHONY: all clean
+
+all: $(SRC_FILES)
+ifeq ($(OCCLUM_RELEASE_BUILD), 1)
+	@RUSTC_BOOTSTRAP=1 cargo build --release --target-dir=$(RUST_TARGET_DIR) -Z unstable-options --out-dir=$(RUST_OUT_DIR)
+	@echo "CARGO (release) => copy_bom"
+else
+	@RUSTC_BOOTSTRAP=1 cargo build --target-dir=$(RUST_TARGET_DIR) -Z unstable-options --out-dir=$(RUST_OUT_DIR)
+	@echo "CARGO (debug) => copy_bom"
+endif
+
+clean:
+	@cargo clean --target-dir=$(RUST_TARGET_DIR)
+	@-$(RM) -f $(TARGET_BINARY)
diff --git a/tools/copy_bom/README.md b/tools/copy_bom/README.md
new file mode 100644
index 00000000..3abe748f
--- /dev/null
+++ b/tools/copy_bom/README.md
@@ -0,0 +1,43 @@
+# Introduction
+This crate provides a tool named `copy_bom`. This tool is designed to copy files described in a bom file to a given dest root directory.
+
+# Bom file
+Bom file is used to describe which files should be copied to the root directory(usually, the image directory). A bom file contains all files, directories that should be copied to the root directory. We also can define symbolic links and directories that should be created in a bom file. The meanings of each entry in the bom file can be seen in [RFC: bom file](https://github.com/occlum/occlum/issues/565). Also, a bom example with all optional entries can be seen in `example.yaml`.
+
+# copy_bom
+### overview
+`copy_bom` is the tool designed to create directories and symbolic links, copy all files and directories defined in a bom file to the root directory. Internally, `copy_bom` will use `rsync` to do the real file operations. `copy_bom` will copy each file and directory incrementally, i.e., only changed parts will be copied. The permission bits and modification times will be reserved. This is done by the `-a` option of `rsync`. `copy_bom` will not ensure the whole image directory as described in bom file (sync behavior) because it will not try to delete old files. To pursue a sync behavior, one can delete the old image directory and copy files again.
+
+### dependencies
+`copy_bom` will analyze all dependencies(shared objects) of each ELF file via the dynamic loader defined in the `.interp` section in the file and automatically copy dependencies to the root directory. Currently, `copy_bom` only copy dependencies with absolute paths. We support only one dependency pattern in the result of dynamic loader.
+- name => path   e.g., `libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6`  
+All dependencies will be copied to the corresponding directory in root directory. For example, if root directory is `image`, then the dependency `/lib64/ld-linux-x86-64.so.2` will be copied to `image/lib/ld-linux-x86-64.so.2`. An entry named `autodep` with value `false` can be added to each file to avoid finding and copying dependencies automatically.
+
+### log
+`copy_bom` uses the same log setting as `occlum`. One can set `OCCLUM_LOG_LEVEL=trace` to see all logs printed by `copy_bom`.
+
+### prepare and install
+1.prepare. Since `copy_bom` relies on `rsync` to copy files. We need to install `rsync` at first. On ubuntu, this can be done by `apt install rsync -y`.
+2.install. `copy_bom` can be installed via `cargo`. e.g., `cargo install --path .`.
+
+### basic usage
+`copy_bom [FLAGS] [OPTIONS] --file <bom-file> --root <root-dir>`
+- bom-file: The bom file which describes files we want to copy.
+- root-dir: The destination root directory we want to copy files to. Usually the `image` directory for occlum.
+
+### options
+- dry run mode: pass an option `--dry-run` to `copy_bom` will enable dry run mode. Dry run mode will output all file oprations in log but does not do real oprations. It is useul to check whether `copy_bom` performs as expected before doing real operations.
+
+### flags
+- -i, --include-dir: This flag is used to indicate which directory to find included bom files. This flag can be set multiple times. If the `include-dir` is set as a relative path, it is a path relative to the current path where you run the `copy_bom` command. 
+- -h, --help: print help message
+
+# known limitations
+
+- The use of wildcard(like *) in files or directories is not supported. It may result in `copy_bom` behaving incorrectly.
+- If we create symbolic link in bom file, it will always delete the old link and create a new one. It will change the modification time of the symbolic link.
+- Environmental variables pointing to an empty value may fail to resolve.
+
+# demos
+1. The demos with `copy_bom` are in the `../../demos/bom-demos` directory.
+2. Before using these demos, `rsync` and `copy_bom` should be installed. The file `base.yaml` should be copied to `/opt/occlum/etc/template`.
diff --git a/tools/copy_bom/example.yaml b/tools/copy_bom/example.yaml
new file mode 100644
index 00000000..9f9c1af9
--- /dev/null
+++ b/tools/copy_bom/example.yaml
@@ -0,0 +1,38 @@
+# include other bom files
+includes: 
+  - base.yaml
+  - java-11-alibaba-dragonwell.yaml
+# This excludes will only take effect when copy directories. We will exclude files or dirs with following patterns.
+excludes:
+  - .git
+  - .dockerignore
+targets: 
+  # one target represents operations at the same destination
+  - target: /
+    # make directory in dest: mkdir -p $target/dirname
+    mkdirs: 
+     - bin
+     - proc
+    # build a symlink: ln -s $src $target/linkname
+    createlinks:
+      - src: ../hello
+        linkname: hello_softlink
+    copy: 
+      # from represents the prefix of copydirs and files(to copy)
+      # If there's no copydirs or files, copy the *ENTIRE from directory* to target: cp -r $from/ $target
+      - from: .
+        # copy directory: cp -r $from/dirname $target
+        dirs:
+          - hello_c_demo
+          - example_dirname
+        # copy file: cp $from/filename $target
+        files: 
+          - Makefile
+          - name: Cargo.toml
+            hash: DA665E483C11922D07239B1A04BEE0F0C7C1AB6D60AF041DDA7CE56D07AF723E
+            autodep: false
+            rename: Cargo.toml.backup
+  - target: /bin
+    mkdirs:
+      - python-occlum
+      - python-occlum/bin
diff --git a/tools/copy_bom/src/main.rs b/tools/copy_bom/src/main.rs
new file mode 100644
index 00000000..0696d0f8
--- /dev/null
+++ b/tools/copy_bom/src/main.rs
@@ -0,0 +1,112 @@
+#[macro_use]
+extern crate lazy_static;
+#[macro_use]
+extern crate log;
+extern crate elf;
+extern crate env_logger;
+extern crate regex;
+extern crate shellexpand;
+use bom::Bom;
+use clap::{App, Arg, ArgMatches};
+use env_logger::Env;
+
+mod bom;
+mod error;
+mod util;
+
+/// The command line options
+#[derive(Debug, Clone)]
+struct CopyBomOption {
+    // The top bom file
+    bom_file: String,
+    // the root dir where we try to copy files to
+    root_dir: String,
+    // set dry run mode. If this flag is set, no real options will done
+    dry_run: bool,
+    // indicate which dirs to find included bom files
+    included_dirs: Vec<String>,
+}
+
+impl CopyBomOption {
+    // use clap to parse command lines options
+    fn parse_command_line() -> Self {
+        let arg_matches = read_command_line_options();
+        // unwrap can never fail
+        let bom_file = arg_matches
+            .value_of("bom-file")
+            .map(|s| s.to_string())
+            .unwrap();
+        let root_dir = arg_matches
+            .value_of("root-dir")
+            .map(|s| s.to_string())
+            .unwrap();
+        let dry_run = arg_matches.is_present("dry-run");
+        let included_dirs = match arg_matches.values_of("include-dirs") {
+            None => Vec::new(),
+            Some(values) => values.into_iter().map(|s| s.to_string()).collect(),
+        };
+        CopyBomOption {
+            bom_file,
+            root_dir,
+            dry_run,
+            included_dirs,
+        }
+    }
+
+    /// copy files based on command line options
+    fn copy_files(&self) {
+        let CopyBomOption {
+            bom_file,
+            root_dir,
+            dry_run,
+            included_dirs,
+        } = self;
+        let image = Bom::from_yaml_file(bom_file);
+        image.manage_top_bom(bom_file, root_dir, *dry_run, included_dirs);
+    }
+}
+
+/// use clap to read command line options
+fn read_command_line_options<'a>() -> ArgMatches<'a> {
+    App::new("copy_bom")
+        .version("v0.1")
+        .about("copy files described in a bom file to a given dest root dir")
+        .arg(
+            Arg::with_name("bom-file")
+                .short("f")
+                .long("file")
+                .required(true)
+                .takes_value(true)
+                .help("Set the bom file to copy"),
+        )
+        .arg(
+            Arg::with_name("root-dir")
+                .long("root")
+                .required(true)
+                .takes_value(true)
+                .help("The dest root dir"),
+        )
+        .arg(
+            Arg::with_name("dry-run")
+                .long("dry-run")
+                .help("Dry run mode"),
+        )
+        .arg(
+            Arg::with_name("include-dirs")
+                .long("include-dir")
+                .short("i")
+                .multiple(true)
+                .takes_value(true)
+                .help("Set the paths where to find included bom files"),
+        )
+        .get_matches()
+}
+
+fn main() {
+    // the copy_bom log environmental variable
+    let env = Env::new().filter("OCCLUM_LOG_LEVEL");
+    env_logger::init_from_env(env);
+
+    let copy_bom_option = CopyBomOption::parse_command_line();
+    copy_bom_option.copy_files();
+}