Re: [PATCH] meta/classes: generate bill of material from image

[Henning Schild <henning.schild@siemens.com>]

Am Mon, 5 Aug 2019 16:48:36 +0200
schrieb Jan Kiszka <jan.kiszka@siemens.com>:

> On 05.08.19 16:43, [ext] Henning Schild wrote:
> > Hi Quirin,
> > 
> > do you have a real use-case for that? In fact we do have similar
> > things internally already but did not propose it yet. Reason is you
> > still need to find all the magic switches to collect the source and
> > binary package versions, and you most likely want a machine
> > readable format.  
> 
> The use cases are the same what we have that internal stuff for.
> 
> > 
> > In fact we should just fix that broken offline cache thing and
> > enable src-packages for it. That would generate a list that will
> > hopefully be complete and in a well defined format.  
> 
> Good points: The format should be easily parseable.
> 
> > 
> > Without the real use-case and the post-processing this is just
> > another obscure Isar feature and i am against merging it.  
> 
> How would you do it otherwise? Tell the beginners to remember which
> command to run with which switches on which subdirs?
> 
> Quirin and I were also discussing the first extension: We need to
> collect information about additional packages that are not part of
> the rootfs but the image, primarily bootloaders. Providing a
> framework - however that may look like
> - for recipe authors to report them would be valuable and can be
> achieved by any local solution that cleanly.

What i meant to say was. Please contact all the people that are already
doing that and collect the requirements.
Because if we miss any of the known ones, the feature will be an obscure
one.

Henning

> Jan
> 
> > 
> > Henning
> > 
> > Am Mon, 5 Aug 2019 16:07:42 +0200
> > schrieb "[ext] Q. Gylstorff" <Quirin.Gylstorff@siemens.com>:
> >   
> >> From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> >>
> >> To create products it is necessary to have a list
> >> of used packages for clearance and to security monitoring.
> >> To get a simple list of packages use dpkg-query and generate
> >> a list with the following pattern:
> >>
> >> source name| source version | binary package name | binary version
> >>
> >> To use it add following line to the local.conf:
> >> ISAR_DO_PACKAGE_LIST ?= "1"
> >>
> >> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> >> ---
> >>  meta-isar/conf/local.conf.sample                 |  4 ++++
> >>  .../classes/image-package-list-extension.bbclass | 16
> >> ++++++++++++++++ meta/classes/image.bbclass                       |
> >> 1 + 3 files changed, 21 insertions(+)
> >>  create mode 100644
> >> meta/classes/image-package-list-extension.bbclass
> >>
> >> diff --git a/meta-isar/conf/local.conf.sample
> >> b/meta-isar/conf/local.conf.sample index 5b3a0a1..d188051 100644
> >> --- a/meta-isar/conf/local.conf.sample
> >> +++ b/meta-isar/conf/local.conf.sample
> >> @@ -170,6 +170,10 @@ IMAGE_INSTALL = "hello-isar example-raw
> >> example-module-${KERNEL_NAME} enable-fsc # NOTE: this works on
> >> build host >= stretch for armhf, arm64 and amd64 targets for now.
> >> ISAR_CROSS_COMPILE ?= "0" 
> >> +#
> >> +# Generate package list 
> >> +ISAR_DO_PACKAGE_LIST ?= "1"
> >> +
> >>  #
> >>  # Uncomment this to enable use of cached base repository
> >>  #ISAR_USE_CACHED_BASE_REPO ?= "1"
> >> diff --git a/meta/classes/image-package-list-extension.bbclass
> >> b/meta/classes/image-package-list-extension.bbclass new file mode
> >> 100644 index 0000000..558922e
> >> --- /dev/null
> >> +++ b/meta/classes/image-package-list-extension.bbclass
> >> @@ -0,0 +1,16 @@
> >> +# This software is a part of ISAR.
> >> +# Copyright (C) Siemens AG, 2019
> >> +#
> >> +# SPDX-License-Identifier: MIT
> >> +
> >> +ISAR_DO_PACKAGE_LIST ??= "0"
> >> +image_package_list[dirs] = "${DEPLOY_DIR_IMAGE}"
> >> +image_package_list() {
> >> +    if
> >> [ "${@repr(bb.utils.to_boolean(d.getVar('ISAR_DO_PACKAGE_LIST')))}"
> >> = 'True' ]; then
> >> +      dpkg-query --admindir=${IMAGE_ROOTFS}/var/lib/dpkg/ \
> >> +          -f
> >> '${source:Package}|${source:Version}|${binary:Package}|${Version}\n'
> >> -W > \
> >> +          ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.packages.lst
> >> +    fi
> >> +}
> >> +ROOTFS_POSTPROCESS_COMMAND =+ "image_package_list"
> >> +
> >> diff --git a/meta/classes/image.bbclass
> >> b/meta/classes/image.bbclass index ec6bd39..85bab64 100644
> >> --- a/meta/classes/image.bbclass
> >> +++ b/meta/classes/image.bbclass
> >> @@ -68,6 +68,7 @@ inherit image-tools-extension
> >>  inherit image-postproc-extension
> >>  inherit image-locales-extension
> >>  inherit image-account-extension
> >> +inherit image-package-list-extension
> >>  
> >>  # Extra space for rootfs in MB
> >>  ROOTFS_EXTRA ?= "64"  
> >