From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 27 Nov 2025 15:36:08 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-lj1-f184.google.com (mail-lj1-f184.google.com [209.85.208.184]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 5AREa6Q1020207 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 27 Nov 2025 15:36:06 +0100 Received: by mail-lj1-f184.google.com with SMTP id 38308e7fff4ca-37a46c5d929sf6986581fa.0 for ; Thu, 27 Nov 2025 06:36:06 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1764254161; cv=pass; d=google.com; s=arc-20240605; b=aZ8r8YC+fhyUJmOETEKZW2LAy8MayCVzHyNdtOLJ/C9Dw3rY5njU9nLZpFAC1i5hay RtJqXBD41O0orNUdRpCJNB27HDO32icdDqy/kcR2KerY3XTRqRTOsf4MDE//2v7hyW2H yUWPGbXdlU13vs1ibaTzxPKwxVR9+tKAZe0s7/1/EFG66Z/30lh1/nHcN6vabk7tfnfq BSYoXcKGLeSMoaROlFN9FBcMvTFcSoJjEvCtyMCwhO0B96WNs5sMMv1P2+YvhxfXzMPm Ykdt94EHnbh2oW8fqkDgj9tIjiKVSRveceF4Em1O1BBm58nMVi+a8jWwe3WQ2Fc5QyZk W2gg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-transfer-encoding :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:sender:dkim-signature; bh=JvDpEn0DRGf22cHCB23siXZC+7jEfOlhDMA+In2xaCg=; fh=M6DVHi9qTmGNyTyQEve4v6c9TAiAhrbBSMWW6UaSsWU=; b=QUatQqd2VGrQIw1nodt4oWPy7HEN8gPZ71CplhL4MZuiiPhE+/YD7i7pZ2v3ygtxiK GOAQAWfQ76ba2Jlg3Hf4Fe9Iptn9mpOhtgQUFp+UYT72dko8vOvZ+ZJxavSGPVaNNsrJ AmZQ12OyBCp1zMatJNLFocVJxLYwFhwIJmxcLRDIhwoZwsC5auptEnAurDiPBU7iOKzw UwznTcAulm1MyMUSXJekWl4Ld1aQyEmIFde63+q/JRdycHutrM6UPK0bHI5N5uMhWYRE fMKtpos09aUW4pej0vLDVDqXt5wcd39upOUWabVkGwoNu7bIQUj+QzJ5HxG0AzpVU1A4 cD/w==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1764254161; x=1764858961; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:sender:from:to:cc:subject:date:message-id:reply-to; bh=JvDpEn0DRGf22cHCB23siXZC+7jEfOlhDMA+In2xaCg=; b=AXLP4ZKpaODLFt+v4Xbxzhpl2cEOQ45WneNKHPqo/QmFCfxrHlIAOyK+k4y42KFDuu uyz5Dnz5jBup2u9YYBsWxn8LRv/z7GStQUtt25m+GJHoLvCJZjvovRTGxSi2ekRTe8NL DW+9LWw7ebaUI0OBvuQRAv8GZ80rMdLGMHuujPPhGrqwsukL0OdodCtJMVlHJ8p6JXSj 8gzO/Kp7fJgqpFn2bjlj7Inby3HIygVUYFjMWPzH0r4lIgzHYHXz8hy1xJnA9Rw8r6tG 6W0h0os4tVc9VDdub4vbNsO5HNUDWu2XlZTTRHVStYMU1mRfYbfnHZu9GoihkrSEEb3v GW4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764254161; x=1764858961; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender :content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to; bh=JvDpEn0DRGf22cHCB23siXZC+7jEfOlhDMA+In2xaCg=; b=sTPlLcrHi7uVbplfHGmYUimSW0oJe76Btpg06uAxaGEpuPIMe8XG/K77EPm5LJa/2y JQz54eTK+smHPueqKB5eOtkFOszP2xi984SaYSLMTNzXKMBkJnZedlZVx6KHzLfeYqxk zybuoR7UW1ISYc/rD/ppkHt7dZPGjk9sisaL4OJEuM3y3ylY5gfuwexNsOWuC27bTzvm EQ8uWzyefZ0IV5zfC0QZCdiEjOMlu4AEr2NmLAgJI896l/c79bSxfIjDtP7qx9m31bG9 E5/Z7RIHbQxrVk51iTrFYx1myE1EMqXTrZ2NyJ8ZXJ2NDa+TkJ/x6VnElX+Km5HDkFbW kPZw== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AJvYcCUK5gSX+PWGKoVQQmcTxd5zsCiT7decU5CpEEDSR1QYvUPcz8W5wCtSU8TpWXG4S4H14YJF@ilbers.de X-Gm-Message-State: AOJu0YydmwFB+bT07ku0oCK0cB4ugW8Ig3pyY00itwMtXL8txNGUj2LB CoXeS63nZl9f0njg1wmacjkaLBGSIPfrPM8Lj2qaRhM6Z2fJ77DogpQZ X-Google-Smtp-Source: AGHT+IF8ckF3DBRyWj3Gv5xdEOY/jCXFwALxYm9bK14uIn8dpIJDduRU2eu82/cpvlBmXMa/ITuvUw== X-Received: by 2002:a2e:8a9c:0:b0:37b:b7cd:b31b with SMTP id 38308e7fff4ca-37d078dff16mr32325781fa.41.1764254160354; Thu, 27 Nov 2025 06:36:00 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="Ae8XA+YV4mHDJ3hmwGWG3uPFE+ztu+ym89sOVXK1l7lANFo8+g==" Received: by 2002:a2e:7202:0:b0:378:d368:a117 with SMTP id 38308e7fff4ca-37d2051c177ls1154911fa.2.-pod-prod-07-eu; Thu, 27 Nov 2025 06:35:57 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCUVpJhtiDbXW1eaFrvID7pbphGnGCMEMGMeB7HlUeVBlnJpKPJ2J3+ilYmgnUimj0uW/2Qodd84JX1D@googlegroups.com X-Received: by 2002:a05:651c:4214:b0:364:f7e2:3908 with SMTP id 38308e7fff4ca-37d07857358mr27380681fa.26.1764254157509; Thu, 27 Nov 2025 06:35:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1764254157; cv=none; d=google.com; s=arc-20240605; b=IB4CTBGMEz37Ww6Pt+E8yA3Kio7/ERqe0fHIRULd8IL+yUMvx1Oqa38trT7QXEi+PT VKpx35h4Subg7eXY4daS/Dr8zQfh9iuFaIKEtd+8crCzLUuns0C0ghDXw+uoD01tjafl Q1rd+1Ht/SZOlkVWlqRBglNIBMaNs5EsMMmKSSlMO+jNLRJM79y6Q1HeZa95bmb5Gxp1 jkGDIA6HnNq91pQG/QFMwFCDJXZcP1sDePJ5JXsALxuPHu5oDLjgZgs2MKgaVh+Kp5a6 Nv4Wo8THYimyht6iv4E/h2ubZkvVUsw5K86QJzKEHfP4V2nVAF4hi0Tv3v02AYeSuQiy q0ZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=d6TdVv+2thZweNRFbVgO+qAlh0BRl3QXCFBLm4+9DF8=; fh=KxuzQJaKET/BytpkIhEFTopEdBRTvhBw7JSrBnisyuE=; b=SnACiyz9AKPqBwlB2+i3LqqZNh4fu2AjvEg+nje8H6nbfRsLMqc311n8Kh06acVCaP 6QCD3JRL0PPKCENNleU7jdgZjb9hH/vgQSytqEJxrGiVwUz38IdSj8rrZDhpRoutons3 G/fKcULUSuSbmeC8iDaciMEXwYiD53Ix04CSWeobE2aGw4AAAaaFrNlrvDSFVFisCNUc MSlnRy0aj4Be5PLdagQ21k0AC094RJFvwSHIj3wZbnsqX/HGCPGAux5cyAV3lwKoa7/Z 3sJNx/umfO0F1JY5JMYnXRcc8XxljuB6yxf4ySuuVuRRWvciCVSOU/gVnfleRaidjjgM wK4w==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 38308e7fff4ca-37d24088923si215811fa.6.2025.11.27.06.35.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 27 Nov 2025 06:35:57 -0800 (PST) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.117] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 5AREZtvJ020195 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 27 Nov 2025 15:35:56 +0100 Message-ID: <1e26bd54-623a-48f0-a400-34a454ba4993@ilbers.de> Date: Thu, 27 Nov 2025 15:35:55 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v5 00/10] Add SBOM generation with debsbom To: Felix Moessbauer , isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com References: <20251124114638.2238090-1-felix.moessbauer@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <20251124114638.2238090-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: mWvr16JznAnl Hi, A CI failure occured in full test suite: citest.py:CustomizationsTest.test_single_customization Log follows: builder@13751127e9ed:/work/testsuite$ avocado run=20 citest.py:CustomizationsTest.test_single_customization JOB ID=C2=A0 =C2=A0 =C2=A0: 5a0c694b516485d29feccb614eb23dddb0b667af JOB LOG=C2=A0 =C2=A0 :=20 /tmp/tmpo3rzdofv/avocado/job-results/job-2025-11-27T10.47-5a0c694/job.log =C2=A0(1/1) citest.py:CustomizationsTest.test_single_customization: STARTE= D ERROR: mc:qemuamd64-bullseye:isar-image-ci-1.0-r0 do_image_tar:=20 ExecutionError('/work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qe= muamd64/1.0-r0/temp/run.do_image_tar.8314',=20 1, None, None) ERROR: Logfile of failure stored in:=20 /work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qemuamd64/1.0-r0/t= emp/log.do_image_tar.8314 ERROR: Task=20 (mc:qemuamd64-bullseye:/work/meta-test/recipes-core/images/isar-image-ci.bb= :do_image_tar)=20 failed with exit code '1' ERROR: mc:qemuamd64-bullseye:isar-image-ci-1.0-r0 do_image_cpio:=20 ExecutionError('/work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qe= muamd64/1.0-r0/temp/run.do_image_cpio.8315',=20 1, None, None) ERROR: Logfile of failure stored in:=20 /work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qemuamd64/1.0-r0/t= emp/log.do_image_cpio.8315 ERROR: Task=20 (mc:qemuamd64-bullseye:/work/meta-test/recipes-core/images/isar-image-ci.bb= :do_image_cpio)=20 failed with exit code '1' ERROR: mc:qemuamd64-bullseye:isar-image-ci-1.0-r0 do_image_wic:=20 ExecutionError('/work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qe= muamd64/1.0-r0/temp/run.do_image_wic.8316',=20 1, None, None) ERROR: Logfile of failure stored in:=20 /work/build/tmp/work/debian-bullseye-amd64/isar-image-ci-qemuamd64/1.0-r0/t= emp/log.do_image_wic.8316 In all of these three failed tasks, error log includes: dpkg-query: no packages found matching grub-efi-amd64-bin To redo the test using avocado: 1. Have a clean clone of isar, checkout to branch next and apply your=20 patches: $ git clone -b next https://github.com/ilbers/isar.git $ cd isar $ git am /path-to/0001-my-contribution-to-isar.patch 2. Run kas shell, setup CI prerequisites (avocado, qemu) and cleanup: $ ./kas/kas-container shell kas/isar.yaml --command \ =C2=A0 =C2=A0 "rm -rf /work/build/conf && /work/scripts/ci_setup.sh" 4.Run the failed test in fast: $ cd /work/testsuite $ avocado run citest.py:CustomizationsTest.test_single_customization$ Zhihang On 11/24/25 12:46, 'Felix Moessbauer' via isar-users wrote: > This patchset adds proper SBOM generation in the two standard formats > SPDX and CycloneDX during the rootfs generation process. > > The generation is itself is handled by a SBOM generator `debsbom` [1] > which is developed as an open source project at Siemens. It is still > early in development, but it has enough features for what we require > in isar. The required dependencies which are not yet available as > Debian packages were minimally packaged directly in isar too. > > This is a followup of the previous RFC [2]. Since then the series has > changed a lot. The SBOM generation was moved from a simple OE lib to > `debsbom`. This also meant the introduction of a separate chroot was > necessary. The SBOM generation process was also moved from the image > step to the rootfs step, along with a lot of minor changes and > improvements. > > [1] https://github.com/siemens/debsbom > [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ > > Changes since v4: > > - rebased onto next > - fix race condition on creation of ${DEPLOY_DIR_SBOM} (aka ${DEPLOY_DIR_= IMAGE}) > > Changes since v3: > > - fix issue on external bullseye initramfs (we now disable sbom generatio= n > on all unsupported distros rootfs instances) > - update debsbom to v0.4.0 > - rebased onto next > > Changes since v2: > > - fix issues when HOST_ARCH !=3D DISTRO_ARCH on derived distributions > - update debsbom to v0.3.0, which fixes the Origin: bug reported in v2 > - generate SBOM for imager as well and create merged sbom of .wic image > - resend imager manifest + wic manifest patches to reduce conflicts > > Note, that the patches p1-p5 are most important as they add basic SBOM > support. The remaining patches address the imager + .wic bom part, > which also can be merged later on. > > Changes since v1: > > - remove tarball > - refactor packaging (auto-derive python dependencies) > - only build missing packages (varies on bookworm, trixie, noble) > - add ubuntu support > - only generate sboms for supported distributions (bookworm/jammy and > onwards) > - update debsbom (includes bug fixes and more information for source > packages) > > Christoph Steiger (3): > meta: package python libraries for SBOM generation > meta: package python3-debsbom > meta: add SBOM generation with debsbom > > Felix Moessbauer (7): > refactor: move get_rootfs_distro from sdk into rootfs > override distro vendor in SBOM on Ubuntu > add support to add imager dependencies to BOM > wic: create uniform manifest describing all image components > qemuamd64: add IMAGER_BOM entries > imager: create SBOM of IMAGER_BOM packages > wic: create uniform SBOM describing all image components > > doc/user_manual.md | 1 + > meta-isar/conf/distro/ubuntu-common.inc | 2 + > meta-isar/conf/machine/qemuamd64.conf | 1 + > meta/classes/image-tools-extension.bbclass | 29 +++++++++ > meta/classes/image.bbclass | 7 ++ > meta/classes/imagetypes_wic.bbclass | 30 +++++++++ > meta/classes/initramfs.bbclass | 3 +- > meta/classes/rootfs.bbclass | 23 ++++++- > meta/classes/sbom.bbclass | 65 +++++++++++++++++++ > meta/classes/sdk.bbclass | 10 +-- > .../sbom-chroot/sbom-chroot.bb | 30 +++++++++ > .../python3-beartype/files/rules | 8 +++ > .../python3-beartype_0.19.0.bb | 29 +++++++++ > .../files/pybuild.testfiles | 1 + > .../python3-cyclonedx-lib/files/rules | 8 +++ > .../python3-cyclonedx-lib_9.1.0.bb | 48 ++++++++++++++ > ...icense-description-in-pyproject.toml.patch | 28 ++++++++ > .../python3-debsbom/files/rules | 8 +++ > .../python3-debsbom/python3-debsbom_0.4.0.bb | 45 +++++++++++++ > .../python3-packageurl/files/rules | 8 +++ > .../python3-packageurl_0.16.0.bb | 33 ++++++++++ > .../python3-py-serializable/files/rules | 8 +++ > .../python3-py-serializable_2.0.0.bb | 38 +++++++++++ > .../python3-spdx-tools/files/rules | 25 +++++++ > .../python3-spdx-tools_0.8.3.bb | 46 +++++++++++++ > 25 files changed, 523 insertions(+), 11 deletions(-) > create mode 100644 meta/classes/sbom.bbclass > create mode 100644 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb > create mode 100644 meta/recipes-support/python3-beartype/files/rules > create mode 100644 meta/recipes-support/python3-beartype/python3-bearty= pe_0.19.0.bb > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/pyb= uild.testfiles > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/rul= es > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/python3-c= yclonedx-lib_9.1.0.bb > create mode 100644 meta/recipes-support/python3-debsbom/files/0001-Use-= old-license-description-in-pyproject.toml.patch > create mode 100644 meta/recipes-support/python3-debsbom/files/rules > create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom= _0.4.0.bb > create mode 100644 meta/recipes-support/python3-packageurl/files/rules > create mode 100644 meta/recipes-support/python3-packageurl/python3-pack= ageurl_0.16.0.bb > create mode 100644 meta/recipes-support/python3-py-serializable/files/r= ules > create mode 100644 meta/recipes-support/python3-py-serializable/python3= -py-serializable_2.0.0.bb > create mode 100644 meta/recipes-support/python3-spdx-tools/files/rules > create mode 100644 meta/recipes-support/python3-spdx-tools/python3-spdx= -tools_0.8.3.bb > --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= 1e26bd54-623a-48f0-a400-34a454ba4993%40ilbers.de.