From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 17 Nov 2025 14:25:08 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-qt1-f189.google.com (mail-qt1-f189.google.com [209.85.160.189]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 5AHDP7Gs025305 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 17 Nov 2025 14:25:07 +0100 Received: by mail-qt1-f189.google.com with SMTP id d75a77b69052e-4ed74ab4172sf130461031cf.1 for ; Mon, 17 Nov 2025 05:25:07 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1763385902; cv=pass; d=google.com; s=arc-20240605; b=NB+HlOkyeUhBe5VbNUYWDPuRDWY9z6VIoT9ztYMRWWhp+H4KFrtEbWVtIpDXTFPcyx YuBkWiTFT3cywsf5P1GZPGgb/DSutNq2lOoE0oyGOcLSCPCNij6By1vypNxwRDQ/QQ2d /AnjzrvnTPY8gp3NXTYdUrTfHGvgr5e7aX5kUOuf+fDXV+tlPoqGO/nydEqm6IzoDccb 86YHH5OJwi98OyOWCURsrEdtl3x8Cv9RV7BqbrND5NDGgnErp3qM5Q6DeXlWt69AjQ1v NX0b0q3iPMhHiv4LEu/ZsAYI2j5O7p93/GpuOUtBcz2+Fi4w/fO+AcH6ma+6TFZuOvkT 2rgQ== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=vg5tJQEdPKlcueSUnhwicIYcKP1KeM1MjmN0EAjNx/M=; fh=NN4dCx/69ehrv+cC5yyarOMDX4SoWERNVA2L7FD9cAs=; b=g0wrQQgz4KgyiGpTjlQm/NV9iG+Be9rYCafSXZhnOZ/z6ob6YWO3BmysRA8EfKZvEo 7V2ZPJxURNDtNfVUs7zT8H4nWiLFV87M4F82zjtsDggGFs26SQqLvIgNGuqI5gSMtpjX Ybo+71Yau+EPNWl5lZCOrXiMs2vJU0JYNmxZW21MB2sz/1/JRB8e/8WkjbygnaLHu0R9 J9RCGPlBa5b56CENDWc9+QRvz/a6WJBmjg4cRgArka+tuzJrHX9A+kXR5gR9sY5w2ci1 w0lP9Evmh0VTeQMREcbPvTqNGALcw8hdye8UVes6EIXZbUdaXx1S0k8pEmAIYCPdJ0jW 3L3A==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=kMq98VuR; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1763385902; x=1763990702; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=vg5tJQEdPKlcueSUnhwicIYcKP1KeM1MjmN0EAjNx/M=; b=nEWn+sYs0XnmGQuEmAM75scl89x7sVZVOsFZKQ8Z/pf2Ofpz5EUxdhLRpAS5i2gsAK sU4rIgWiqPNO59FF+T95I/qMFQ+GpBx5Pw4T2eyogSDSQhL3qQnfmjNFHPNSvBPAuQQz fyCPXcmr8GkrXfeXMWlSz8PJ1WGUD/+BcKmAH8jX2jqZhwcHlrxCUV+lQ74q+r22TEXt 4UnSybHlCsNidIKXfx2yRmkwQQpSbvU9kvBo9QULBLbW6SDaEi9puCoLZaOZOU5sdg+6 7V1y6+UdPBjd1ycWWye6V/c85CfJ8qze9YH6sNFquqbOeczURNd+b1CR6hPAbyR80CXM P5Pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763385902; x=1763990702; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=vg5tJQEdPKlcueSUnhwicIYcKP1KeM1MjmN0EAjNx/M=; b=r6S7YFFPFCg0H+yr/J1gvVabnNxN28xd1ia3pQKaLQdq06Jn5D/MkECDJOG2JNWbPt qEXpT0QNdIRB1fYV+S6oCg784CT2/1xFP5k+65QelkAEGM8KXQK4yJx22p9sI817ImHW n3m2c6BiZ9zcufLT4pq/IHat1bCH4cZJvupB6vfVOyvCfdRP1fe35p6VRe36xlLNBhys wK5BL0KXmaHk9ZAVxYVK/aLIdASEimQ90aDysGL9CCw829ujptkkPbyde9DdG2HDBKzP O9pzS5iYWN2Q188KbZI6Eom1e0b8nWdftRHnTrLBAq0DZf3ZTvhrX6a94u8R7Eazq5Sg dK3w== X-Forwarded-Encrypted: i=3; AJvYcCV5G4TDPoG6rCTBuAav5pdF/bP5oYzyYooMN6xxdwXbgtiJLhAlQCBufvjx7AegW5ElMDO6@ilbers.de X-Gm-Message-State: AOJu0YwbH+GJr0NX9+3iGiJFbbRTRXRgM/m22z9MhcClH6DB2JiCtUms OQckG77K4SVpTxViX0/VT545Rh7PNpymJXEbYilF91hR/zhYSL5uULgw X-Google-Smtp-Source: AGHT+IFFbNbst1s6ApoeXnz1fm/tfjsOf97hPtZJw9rfyBrB8enxX2Ed3FNDsSncjT+pBbScem4jcw== X-Received: by 2002:a05:622a:9013:b0:4ee:739:142 with SMTP id d75a77b69052e-4ee0739160cmr91241601cf.51.1763385901518; Mon, 17 Nov 2025 05:25:01 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="Ae8XA+ag3kzxqHYZWR9OaJbu0oYe/QIaay4Hbl9OjUhIhdXqaQ==" Received: by 2002:a05:6214:403:b0:779:d180:7e3f with SMTP id 6a1803df08f44-88281ad3224ls79886156d6.1.-pod-prod-01-us; Mon, 17 Nov 2025 05:25:00 -0800 (PST) X-Received: by 2002:a05:6102:cd0:b0:5db:d60a:6b24 with SMTP id ada2fe7eead31-5dfc5b6fe54mr3575282137.22.1763385900252; Mon, 17 Nov 2025 05:25:00 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1763385900; cv=pass; d=google.com; s=arc-20240605; b=NXpwriPkEw8z3DNe6dapdL6yGuDoFqYvJG36Jn4MKANvkdE9hxxox1/BcbQP1YG9Rc RUCXOWraTbixdtgG4FneBo4td6qxeCHKBWryI09ns0D6nIBEIYcAXSODz0k5fOm+u0e4 4hdVBg2pyxO5u5tVbQuOigxpDXDYPkOp3kK1RI3Zg8GKJAHmhbgHzPH0MVrWgDQm4a5W +DkyiXMsh24foTSkX508UBRhlAytACczJFd5AcNCA8NACvRTd7NpsctobQapX4VR9zbk jPdPras+QgtWzsBGzuUmCbWEVO4WB+/QdtckbQY+GOKJUg90lo6e9/lekg4ildMFoW13 FfCw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=SmU/8gC5EUv1uyFYD1v8Hu71ZaXjyH3m2mqru/SUfuI=; fh=U8bm4dTYQmv4LpgB7HlcKSsNa947JBNKOeDeOLKSao8=; b=B3QSr/6iraBfGBnhr8s4wQGWpyEjvX87ctRK7/k+h0c2nePEy1SnVWObtPFU/E1IAo CKnuzQgGGPGzZe+AQ5xNHdsGQDq/cWGhDTLuBOlTnVmArZAl2Z7dJIOZTBQmejsgI1B+ QTU4PoD8/GCfcOeLlkoJjveiYlVkSXYq0FELnIf4lJgLTF4oP8qEjzRC6C7fs2nrGOVq hMZX+ipWGuyIP22EW1SObTZoGolqEfTNliuQ6xgEoWCkmippMwtwKev4wK/pihzm2GZW 4JqzXRdoeQb/jNtmoA9eHHeMRiwAtVwUAKbEqLfErgLh4L5F86Wxm4v6UgZs1FnwKexJ 95vw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=kMq98VuR; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c202::7]) by gmr-mx.google.com with ESMTPS id ada2fe7eead31-5dfb71a44bdsi220418137.2.2025.11.17.05.24.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Nov 2025 05:25:00 -0800 (PST) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) client-ip=2a01:111:f403:c202::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cRQYb/JbRTcYuJmKsUrLDHwyQJ4/49LZUUlFIktRvL1FfB4mULedD6e7ovWI8MKrnBClift0+AwaJV9hUJMu0/BkoBzMLb3vHpTUthQUXoJWCbH8bmCykmD4WGp2RXsSP59orZyzKmeH6//ls07j37ZkBtjtwlav1Ynbz+DQ3cYQm6jo3tpFIb2VdA/IhlzWsyln1J5gCdkgmLG2L3asL+swRWxmZIpIQoA+23AWtakEFOJ6fA6r8UDnTKnsazmbeHHuxbIBcmwOmgOCcVuhQI8K+2LEBLjcP4CcEBGrSM6Xu/8/ojEw0mek94k8jyJXWYYXoTY7slcrbMsLQazvdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SmU/8gC5EUv1uyFYD1v8Hu71ZaXjyH3m2mqru/SUfuI=; b=eCd6RzcWNX4HBWZEIKKl7dLGW75m/GQI24J9hBdh1Ka194HJ784q7X03npCa2Hmv0IGM45th+ZDvsM0I31Dm0xNCfNxJR9tp1VwftzAtr2qQ1NGeAmupWRtXEAo9WLPRni940Pg1+NL4bHRmLv1sIL4Ksn08GQJV6PR+oa0K08NujtYt78ZO6ZHso04F6ZcPY1CwV6sx/P3Pk5FrBHtuemQ1KMRj7sm6L4l5iWPtrH1Ibs/UlqZibTffYkDlAdMAz+4wgpdWhw8zf2syzz2ahE/Z29IMxE8kZ0gnPJutgw+k3Yg8bqbNXw9/zo1EeN6wTBruxXZLWtWQoC2C6lcWjw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by DU4PR10MB8513.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:561::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9320.17; Mon, 17 Nov 2025 13:24:54 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe%4]) with mapi id 15.20.9320.021; Mon, 17 Nov 2025 13:24:54 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, Felix Moessbauer Subject: [PATCH v4 10/10] wic: create uniform SBOM describing all image components Date: Mon, 17 Nov 2025 14:24:36 +0100 Message-ID: <20251117132436.511686-11-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251117132436.511686-1-felix.moessbauer@siemens.com> References: <20251117132436.511686-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR5P281CA0026.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:f1::11) To DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR10MB6828:EE_|DU4PR10MB8513:EE_ X-MS-Office365-Filtering-Correlation-Id: 27c67b4f-d67e-469d-3f97-08de25dcb0fa X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?wO3lTnYgwalzyQ1D5cZn5WnS2blrJ8BjPmFjMc/MbcMN9XSsZyuCAjWbnVcu?= =?us-ascii?Q?E1w9HJqppGqh0fRvLRnTTqawR0bZQ+E7cJsYhi52ca9Fkk4YHd7hQeMN9AY7?= =?us-ascii?Q?xtq6W633PTm76lOPz6NwT1DHe8dDpYfkCJZ1N/KD19RLBUlGoYktnCwBMey+?= =?us-ascii?Q?AnBVQN4oMzztvUGZoB+38mbq76qQoT5YpHMGIh4xNV4K9r36+mKPv0PZx0Y9?= =?us-ascii?Q?Nk8cxuT26qCscGPxyz6RPkouIbwSvnivQLGtCCTCbEn5HACSnF41p7G0nEU7?= =?us-ascii?Q?5QG8Y75kf235x3cF8v2qjT8hu8O8HFp5AWSj1G1uZJEkb02xO522bY+xAJSK?= =?us-ascii?Q?LB/Ua1zvMT/8kQvNTQ3JqcRhTeUO8Dgr1gXhshT/vSQrSiOn//Re8I0u/iH0?= =?us-ascii?Q?Z8w/+Nu/iG+h8qnXFgYjd6ZAs8220B4TSHqheqV7KAMNKCl9bryxC6qWmeMR?= =?us-ascii?Q?fIBaIazvJy+OEWFDr6ucWNwekZIUlqoIwQ3uhxGnxqRpAWmqOUESK1wZleGF?= =?us-ascii?Q?rbZlEk77CTJ0J53CjYvFfwZuk7rUm3I60n9YOFD95VSOt/sWp7x5M5fGxlXa?= =?us-ascii?Q?W47bfcrX44vNUDHMiYSBxduOWAZDxYX0xFe2wPB3Qll9GCEczbKvwOJgZQa8?= =?us-ascii?Q?JhiRIGmj3AwhpBBVo5kQAe+ybMVhT3ucKCmMxaGTeNCl6tVJAjK4U9YQ88E2?= =?us-ascii?Q?O1ggYc1mIu5XtCR3n8it0NYzaaYZCwsrPUDZFWaJZwdra6s2+InWsyh8n2r3?= =?us-ascii?Q?YAmCZ+FYryOv1LmNx7MBycjeFCB83VkRF476vBdsB+6KhUgV/mHEqZpEwXPV?= =?us-ascii?Q?YQbpkDUSe+bKqVsvkbguz3Yfx30stNTUzrDakZznd6Y41E/NCedEqWo5WX5o?= =?us-ascii?Q?DtXuzOhbyoX3Nza586v8PY8/0qa91m0McmvgOThpZ2CG6SXHRcqlGrIOzdv7?= =?us-ascii?Q?NwpMgkAI0+idrvyt3R1Jq7mSZLfXDgCz04xaHoo5pKFfNK/5tHTauMPATK+X?= =?us-ascii?Q?+D5I988PjqW+ZKmkEO+1sR5cuOXVFE2PRqQw+WbBenISvOm+WQXqolNijU0F?= =?us-ascii?Q?YOXjfvtzHKQzWF7a31Z/rAw/kc+EeeZtTotoQeog+FYY79wLktbzvx4SapgG?= =?us-ascii?Q?8cUyGo9wtHfoq6B0kMwYbzoU6nD0W1YKTNDmJOIMwRr3J2i7wqWP5usGuRvZ?= =?us-ascii?Q?yNzWydYczxHnfJosgd9Wau5o0KtyL5KvevHWosK3tNLrfZ5XiPEZ+CUBrF5A?= =?us-ascii?Q?7WTj3xHMDAxRudc4QeJh/t/ozAMbR8uYTwJl5SwR4FS6HmOeKrxzlvoqu3Rp?= =?us-ascii?Q?Vj3517tfTkfWh7XEhJE1WPZizZeSq0KwWIT4xTS6NGWjVPrTtlzYyYG+g8la?= =?us-ascii?Q?hSUqTx8rfjUgVeFAdsiBvj6Tp5vFZTzfwGxWEtd2690aI8nWKbGEQ5WlSD9B?= =?us-ascii?Q?EtTU6HJZY2o1Sxzj8gKWZfbY20CprLAj?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?H/zSiIEivekoEUhSU0Qk+mTp6pREyuGG7nmqLBzfrEFyrQz3we+Ua2g7i6VT?= =?us-ascii?Q?7nK7nDsFftupiNZFP/1B53k2lKn6aA9QSQROwAHbaBzAKy7nmruDrAMr0SDv?= =?us-ascii?Q?VU2wsACzc3u6+OiYoCy2IUdA5m5upDVaNQxly0tbQbbtRyVcSuMfLoHlJ5Ly?= =?us-ascii?Q?2PxqYGCpCERznRIYfMd6OH+4bPDJOIoO2wMQ8EeShcRtcQakO0MZMEmJaT+E?= =?us-ascii?Q?pqBUI8n8fyqbafCxGXmI2lUZ0ah1CVgBPjkNG+S/jMtOHUWyDK+5z50X0D1J?= =?us-ascii?Q?3c2+h1tpuJJkvr0EQDKEAUnv5OUU5J69W8Y4T3MrCz+UADqt9LHZiV+k7jCZ?= =?us-ascii?Q?4Ee1xGz5CPkHsRzbDTAXBh+oJOCE4c6EaY6BxLFdrrElm5304hHYuJ7T/djh?= =?us-ascii?Q?Xi+QaM7EFtCbM3JKvU2HzJjPW6NToEg4lNUxlXb7cWppw+7qukZ2/vVR/+pw?= =?us-ascii?Q?vNVcAiHNCd2OgbIeZ6Jhn/6Jla1xRYhKLibw+X0Ih04LIjYgiZQQssbHheeq?= =?us-ascii?Q?Q56hfo4Ek448dECpm8CP7Y4AKCy0ba3oLHcopK2D8JyA54fO7DVFjl6x/nG7?= =?us-ascii?Q?m07YXrM7f8QXnBDLAzrwVitSU6PJpOshQ9R1mSiyt68B2A++JiQKWt6pRpXt?= =?us-ascii?Q?r5sAel19q80kkiMTMn1s2Q0ZcBcpQMLnzXVei45k89nU7b3EX7BkbfSBBb/0?= =?us-ascii?Q?vTggfEm1kow1Fh2cD2RVDjiSZM5tNr6OHJb8Lzt3Nmhy4Vw1p2Uw67F5vnoQ?= =?us-ascii?Q?5ZQAWYlksCHQh184zdqzwoa9vHFvkZX6MXLbdZlYKKgrZPc2Vng1/aYHQ5Ku?= =?us-ascii?Q?bS86lozAHD5Xeuehn7nKPMaIXb4y1/nhTDEIrqK0cbMl/gfWTxg/PX/BqjsH?= =?us-ascii?Q?1KhfKhaLzt33y3JVjLPuQd29KDr4fprqBqyBlE0X7z2toU4oLIe5nG5EubIr?= =?us-ascii?Q?blDDuQ/ByOWzF1Olbgz829BVnXQUd5ffuf3iquvjkdWKiLMbZHLCUmT5Gx36?= =?us-ascii?Q?i8FpB6Bq6PWBBghzefXlR1eR76JF1BEKO6WRpqfNgzrfTmwmnAqMI5qNY9CC?= =?us-ascii?Q?f+5h5WhZNG2ebp2+aqV6QGb+iakgtZh1aMQKcxOjbPUOc/uIA0/YrTooC3rD?= =?us-ascii?Q?Qry/K1WtfiZvVkhSpBL0EKfsSu3iWw8sermFrew4zDMyRXL9T71BbxouP2cU?= =?us-ascii?Q?ooiQkPhtLM8yf/0YLMfJ0rqqXKtZr/f7603+QtotIakBGQClZc3TdzItPD/Y?= =?us-ascii?Q?qAOkjMZkeiLRsNJySJP7lxZPloR2P4xRoQ/c9oCNBmNUYIQ0DGKo/nn3XkHH?= =?us-ascii?Q?yQI62VhuWeqREVa3GH+LbbVE/T9nH8/LMcN3AjuGQg3rQKH+hD1VwI8raVcU?= =?us-ascii?Q?hpDnrkVFO1pJdihmTv2XlFUiE7i6QeREXZkzo/J/RiKUqJ7kO5UOplv2V4EH?= =?us-ascii?Q?CbiZOHe3lIAVjMuPxTj0GaOIrewjqfjF9taRA2z+UuNicn2Pr3UrqEkyTsQ8?= =?us-ascii?Q?cP9eQAVphEWiqwyrx3ZnBV4LoPs9nUCyHvv1ibYne3KoQFkK1zRyygpQY7JI?= =?us-ascii?Q?IRSDXnWdvLNNtUmoyeMJGUIBHqVgyMw5rqlK4T7aC96WMupNd7DRBrW36880?= =?us-ascii?Q?Yg=3D=3D?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 27c67b4f-d67e-469d-3f97-08de25dcb0fa X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2025 13:24:52.6899 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MpsQ0F0n19wuv4gOOAVeXZ7YnNhHBatuPi/QRHVClB133jcEjn5yhOMNVONXPFpgUIEF11smrF6w01w2xVMaoN2CPwjVDt5gFDKtpwr0CBw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR10MB8513 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=kMq98VuR; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: MNFDzzCaOj9e A wic image consists of potentially many different components. All these should be covered by a single SBOM. After creating the wic image, we collect the individual sbom files (rootfs, initrd, imaging) and semantically merge it with the debsbom tool. The merge SBOM is then deployed as .wic.(spdx|cdx).json next to the wic image. Signed-off-by: Felix Moessbauer --- meta/classes/imagetypes_wic.bbclass | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/meta/classes/imagetypes_wic.bbclass b/meta/classes/imagetypes_wic.bbclass index c75d481d..fe31e4e6 100644 --- a/meta/classes/imagetypes_wic.bbclass +++ b/meta/classes/imagetypes_wic.bbclass @@ -201,4 +201,29 @@ EOIMAGER ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.manifest \ ${WORKDIR}/imager.manifest 2>/dev/null \ | sort | uniq > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.manifest" + + for bomtype in ${SBOM_TYPES}; do + merge_wic_sbom $bomtype + done +} + +merge_wic_sbom() { + BOMTYPE="$1" + TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH}) + sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}" + + cat ${IMAGE_FULLNAME}.${bomtype}.json \ + ${INITRD_DEPLOY_FILE}.${bomtype}.json \ + ${WORKDIR}/imager.${bomtype}.json 2>/dev/null | \ + bwrap \ + --unshare-user \ + --unshare-pid \ + --bind ${SBOM_CHROOT} / \ + -- debsbom -v merge -t $BOMTYPE \ + --distro-name '${SBOM_DISTRO_NAME}-Image' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \ + --distro-version '${SBOM_DISTRO_VERSION}' --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \ + --cdx-serialnumber $sbom_document_uuid \ + --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-$sbom_document_uuid \ + --timestamp $TIMESTAMP - -o - \ + > ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.$bomtype.json } -- 2.51.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20251117132436.511686-11-felix.moessbauer%40siemens.com.