From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 01 Dec 2025 09:58:49 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-qk1-f190.google.com (mail-qk1-f190.google.com [209.85.222.190]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 5B18wm8x012730 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 1 Dec 2025 09:58:48 +0100 Received: by mail-qk1-f190.google.com with SMTP id af79cd13be357-8b2e9b2608dsf672887985a.3 for ; Mon, 01 Dec 2025 00:58:48 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1764579522; cv=pass; d=google.com; s=arc-20240605; b=AQHdENhvBk/AoS2JgyAIvKLxOeBgRDz11FoZyZIdyui+EDRJowyE4pTd4TFfmpb4T/ wvxjc6uIrw9eTivvE+uBSpHHIMleTtPyVECOezLprzhfEOe2f3Pi5hXjrYqz4y48xEMz 07XGFhr8I/b+QnJL9W6Z7ttjT3btK01fTJrJIN0SZVLgNoeNPeGaAXHvyl0uOoasZhlm B1d4uhv/dXRtlyhjATBEQXwuD8xZ5viAM/fukD+qLQ/sVNciiCg+wvjvd9ohOm8dY3It 9iWXZYFlDbL6f9GW7jFrspK05Q6bymnS78MF8aw7MyyI6c+KCLLU2EheWd9Fy0tchVL3 nrXw== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=+YN5OadmWicDaHMVum5f0qUp2G59B3c+0u0Vszo9WAs=; fh=86q5j7S5H3V24x4NXDa6h9QR42T1duT+5EhRDtXkY4Q=; b=MVWbrQf6s0IKihcY48SSdhdvwy13jidXqnxOl+dfpFH1RjwNFitb26oPedmW49NAft +HxkO3am+yViPDzGyW5mbj82+/9RYXAVXG0rdWbhkmKsDP6ZsFEHKp2tYo6o3KFZfSjn ua/kpFiKj9MLw4F8+deJZpYgRqxWOA03fdYnREbT0/A4nP6TU+oaebe8tOKyU1Px72v7 Eu2oWj+XNfWCkprLlm+3GmA5mC9TxDh9O7PMtwp/pWejVqaabi7USMKhr7SZYmatfR77 l3dRFVB/butqrWaaXX8f8zjY+aBd44X0Dj0smT72VhkFU04FQiZ8ST4/Gn0XtnVadV3u Fdvg==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=f8fhtHXM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1764579522; x=1765184322; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=+YN5OadmWicDaHMVum5f0qUp2G59B3c+0u0Vszo9WAs=; b=uuK9h8zhoi6/euxQwgJN6PNImQY3FVFdYR9H/ccXDXpePAqpeUiLX3von2MWRKidTa eSuZdiSQaRM3xsmNmP7bZXufopbnEbb9KV2WsnR8OpERIKCPPf4imE3uivxt+S5fv++k toiu/zBb8pW2hiplOi0Abr+yz+uckAcKauLwihXuVuTvASkEPm2Eees1YxHR+piOD9WH ox/n9tTs/QxVi8ffm8Eo+Fh+HRW0KVyCa2UI9o1wvbZZ9WzAkgw7pN4B/ccekRH8bdRW MiJS/BomVI5bMeCwC86jaO3KgYkC8wpE86xsGLRpu7VfpOlV/Vtz5EQ4YGP6S+KmlncA bRsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764579522; x=1765184322; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=+YN5OadmWicDaHMVum5f0qUp2G59B3c+0u0Vszo9WAs=; b=FxKgDnL7K1cFprMolUjjCSxSl0SwRyTUhIChsXojrV9JMmLMMYPq9cnquCK539AppC 9kOBivXLswDBJX4fbZ11W9en7iScAmFIBEsKN/b7XEI5R+I7h5aERGI0kMDqzN+IRvbz UXPGD6rrNLsTd7qxvT4Ween90g8DL/IyWhW/LvrzUjKudxyewxn4Gq6FsEAjO2eZGGza XjEebkt7+kQf+69kJzP7Ss8dURHbyJh+Jp64SxPBTl1t/hVcSkWidzGld6cMnkw6rw33 ONrMOPyPjdmOI/IqlA19S8JtyUFtJr2br5Y19CE4it03XL7ke8ZVgC9eCDJIHkfTzcoY 0ACQ== X-Forwarded-Encrypted: i=3; AJvYcCWMtuFelNTyKSxaIPAxDM38n5fEnyAC8uLTCg6bC3CZyZwP5GlgnL0Zf1TJNCOmaVuYni6g@ilbers.de X-Gm-Message-State: AOJu0YwKgSip9o/hChoE6LNcNQ9jQjjzv1RBaGBF3VLoh7pSc1GYnozO BDbWOXUD2eI5QEe5MCy8jcwySCAFckJrQS7XYKZJMT2Rta2XujGmWC37 X-Google-Smtp-Source: AGHT+IGcA8cAIu2L87NZ1Rx549wTjKnnbWNw4DuFnJMldDebH/4+VmVOnWfJtF5HGpfgim1GpmmCrw== X-Received: by 2002:ac8:7c43:0:b0:4ed:b1fe:f87f with SMTP id d75a77b69052e-4efbda3957amr369765751cf.20.1764579522301; Mon, 01 Dec 2025 00:58:42 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="Ae8XA+bYJ7jCR/Cr2ZIcAdkgeM3ziHHPw4yRZvAs0e+nMrOydQ==" Received: by 2002:a05:622a:2d4:b0:4ec:ff90:36a1 with SMTP id d75a77b69052e-4efd0492f20ls96501861cf.1.-pod-prod-09-us; Mon, 01 Dec 2025 00:58:41 -0800 (PST) X-Received: by 2002:a05:6102:6c9:b0:5db:32dc:f05b with SMTP id ada2fe7eead31-5e22446490cmr9684771137.42.1764579521507; Mon, 01 Dec 2025 00:58:41 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1764579521; cv=pass; d=google.com; s=arc-20240605; b=G8v2O9wJRycxPj4rjCrR7qFBqaeFVQUPNOd6bMzVz/G3h1IygsBUX9ggJXPJmhFA2T KWkY3q8W2oMsFGg52Fd2EXuOp1ss4ZZwDcptaCnE7bNbl+LSe//oFhnrXQb4IKSd2MxO kHWDFaHt7gA24doCFJIRbYHXbKqWZfxa1ApOF7javlmkHpAZr79j9yhVR4Hdbw1f67ss pL2a6ayocPEVUy2nW3oKOm8+4j79gCqJVnMdO+niiCs2byn8URxnxvB57NRRfE4u1d6z yWqitg70AJ+7UuCpSPawFZQ1Ti4Q+wqzy2VXumFNtkL8J+0eZX6qcH3Jus472DawTDOe Yj9Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=SmU/8gC5EUv1uyFYD1v8Hu71ZaXjyH3m2mqru/SUfuI=; fh=YgHcU2amhotomeH1Rv2VyUlgPjm8wpulXwrBvcHF4rI=; b=eOt/P3Y66vb5Ggj1BvMpaRrYLod/UTtNsgX67sXTWfKUM32XTSt9zfZsYGKmdYDZeX onIQ/4+PMZpPKEemWADb5XBAEsuiH9D0JWqr4iKUAp7CvWU+eYTsuFbYcg2l6SkaTauI u89fTB8mWwI/8vFssgtORlNCTfvpNEVGvefzAb4rEsEjQsuwRg8XDku/kTnrdHPmo/8t tfhmPj4n+5d3kuYAMapqRdE8rsXmKmQgGyGo7c3ZYOgWZGgIrC8JD9O0GbnLa9OSQFrl 5uQNaDBU8+YxZwUe74j3iJGe1FOMTdnbyVF1exfi5WeWNsKF5tKf1Ojf3UTefmOcnSRn hWXg==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=f8fhtHXM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c202::7]) by gmr-mx.google.com with ESMTPS id a1e0cc1a2514c-93cd69b7192si200792241.0.2025.12.01.00.58.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Dec 2025 00:58:41 -0800 (PST) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) client-ip=2a01:111:f403:c202::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=xguR2zz2oiNY0nhOq3i5B+H+PZ9OUBZOVX8VZyrcj6pEwGZbFqZC8e7gQFTOTCEjyaxXGwSklHwa/JXuFGHJ62Rb+jQiql7xopwSh43yC/gvlZVngw+nI4+DBFBTHs85XiWl/0FzX9rTP1kEwC50lZM047qLALISNlhIW2yjbDxBKMhw4FS69zlFdM9R2uKv7HVOshU4bRvqsadbkchSB7DTHjWjm9nhdEKlealdMAlrSU8saLC7LJc4NHdarte+ENXA6WJq+cVF9/5todgM4mWp8o9nBS4+pVw2qFyBac3KBbNJ6KImf2LEwBIrBvS1aS8DEhfc1EmRW3Mnn78/nA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SmU/8gC5EUv1uyFYD1v8Hu71ZaXjyH3m2mqru/SUfuI=; b=F7vmRw9SPxPEnO9413ZueDFApQcOFFCW55DjarwsutVtp9c/SIpzX9DpJSslpOytttrLdeDm6/xzZXBtbe/ZtWX9SXtC9bdVh72lEgmisAb2lMywz+z63jwJXlxcu6CZoZIVs/L+P1+b7V9XAHpeuA/UUMl321IbFUCbwoELMoVa2+fGeTC3J/TLSIF9VwOsqVNXZdY0ZUwMc1fR/hR8gTOqr+RVeecV3C/5508JlyBvJBSmGUJdfTzYO6Wdo7ZsGhMSm+zBJ6MvvJg0gSjhLVLQKtRSIbdbP6UblG/uOhyML2hXKcPrIDfGAedsCt7mHViqwwclzFYrLfXzSCbg1g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by DU4PR10MB8880.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:55d::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9366.17; Mon, 1 Dec 2025 08:58:37 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe%4]) with mapi id 15.20.9366.012; Mon, 1 Dec 2025 08:58:37 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, Felix Moessbauer Subject: [PATCH v6 10/10] wic: create uniform SBOM describing all image components Date: Mon, 1 Dec 2025 09:58:13 +0100 Message-ID: <20251201085813.1616095-11-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251201085813.1616095-1-felix.moessbauer@siemens.com> References: <20251201085813.1616095-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR5P281CA0016.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:f1::14) To DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR10MB6828:EE_|DU4PR10MB8880:EE_ X-MS-Office365-Filtering-Correlation-Id: a983672a-a91e-4f87-1617-08de30b7d0a9 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|376014; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?MNlcqkDpCdUfKIU0VCH0oM1YYkuBSx2XZrhqnjfOFnBJARXuwgM12JTIMkvm?= =?us-ascii?Q?HyOMXCwc/d4j/Q36gvt/g48uMU0x5ItOGzoxuv0CNUVdLX8uBsfAWLDQYBOf?= =?us-ascii?Q?BUYcPEpqd0qtlJBkCIC2SQAzZb1pSsRK0nKHLfZj+xQ1O4k/1/1TV3nvl7+G?= =?us-ascii?Q?ttK4SjaQmuDh3Zz3sFa17msMxYTxFD7q/BESoAWxrCHZmDN06KywigX7YDcl?= =?us-ascii?Q?UxDGom/K7pc+bgWRptMxRYxVMzM4b1HepiQO/3OVf0zx9HWp8HOwVg4EqdNs?= =?us-ascii?Q?AyOoJUASqoYnNo2P4ipkGp6NuFBwXeTNWU4iKQ8SAH4IO4HOGQ9WS6zAmcAJ?= =?us-ascii?Q?4o8+jGWf0wt8FKMQwr9/ByYMVyprmq2L7dB9jQS7jz/0ycBxB24+WA5eQaax?= =?us-ascii?Q?nsiA5ScFlYwFV4Lm7XPGZybx70VK/k66MYU/z7TcDR9IAmF2jiupyQRO7W9v?= =?us-ascii?Q?tpSZ6VanmsjKX9/3cC7E36D6HiM3GwMjoOS9hlkq82QzsjThAliMo9T4vx0q?= =?us-ascii?Q?B7G16iuoje4vuptSqAewvWt+6PFdgrD0dNrluj/loz7cFSQOhVr9/tpvZvwE?= =?us-ascii?Q?5vp+8HCXuwgjA6vyPOl6dXiVJkS2uVFx6feaO2iXikQ0OKd9wOa4Q3ZMpAPi?= =?us-ascii?Q?Aq7dHeb7qOOhGAh29j30m8lvVxna8KAmmEYSeGIcXQzr66LiWlbWSLfax+Ch?= =?us-ascii?Q?OioG56wYmh0YpUhRcf/tekHs/uMQ/aOGMG8rAbKqYjuHgq2dXUVP5Wol6arQ?= =?us-ascii?Q?jz4IcXi3KmLEjRGKtXDSCgjoXIVk43IaFKLvwKg+23Xf6BpTbzQI3i6hYq3E?= =?us-ascii?Q?SvpLT4YXESi1EvD+92DLMGbxDnualeRdMkmTaAU/akAedZjICHiGbQryahXR?= =?us-ascii?Q?IAEe7GjWeNr6VDR5zy0HVnPqJZZfx06ae2ptsEPdoJvgYkapN54jza2yHX3e?= =?us-ascii?Q?6aFUA0fgTvb0Agay2ZrmXwRTTY1BvClABqDBg3zzY9YbHbG+R9VtG7b62Yvy?= =?us-ascii?Q?oR4fnNAVuptLAFbzAlzkGUVqU0GxcNZ3J38m4UKetbfAk1b6bG+tqXDEzmPI?= =?us-ascii?Q?W/zbkJjO51JL3DOoXfX4NKWRwtNYfEtAxS5mbVIO6x9fRN0e/zkLJraJlUnh?= =?us-ascii?Q?RpDuHE6c8ALnkccbjdxloXZlufioPYvto/NQ8cZunkxD0XL2aPst2vSbxeUC?= =?us-ascii?Q?0BI22tMLzZREMM7D2Xl6dKUs3a6kODxsLgmcUOTrjzFH/HP/kz7pHX3JRvld?= =?us-ascii?Q?4k2iH6qKJ3d/AQJWLJTZiMI7zIYgsZDfSOZzDRVHXrR6ixfNyvF8AeU+OxjX?= =?us-ascii?Q?on8dvmBNt/m3cuTxbf9ecoMyypalS3LDak6hcXP/RANZiqvN/7Gv4oKS6AEY?= =?us-ascii?Q?I5A0TS9L6ZiBpV1r8otKrNN7bt+QJie8sO70ViDVRwAUFCH85OJYW/9rVM70?= =?us-ascii?Q?VK0nJ3IpOq5qwBkY5PhhEGY5D2ERYPGX?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?y/poFfHX3Hcpy20VAU9RzivFZH3LCewyDzgDCSPTJoBnGhugHBEadRCjEO6a?= =?us-ascii?Q?xmm0pGPzyLRP82LZ8LzYSU0tB4Z/X5DurvMcIDlmz/9Q45MeG63NnUSXMr46?= =?us-ascii?Q?l8mf4VFEswoJWiBWp7TRi2hQER/vQ/072T/9dZwUpN/Fz3Y/ZG8APWn+KVUr?= =?us-ascii?Q?BUuD/Je5rCV9ZJoFcmXzHS+q57U25iphyYgt0Yw4xdqptEURSwI/UJzQPwKN?= =?us-ascii?Q?3ZO5GhztLlKMjOKDrTH5NZLdnaGz06bYxqiZN5YwYFbFn9YCzKQp91yZagZ3?= =?us-ascii?Q?qjd9IhN172rBCKODKR9CfqIcd4z0qBbrRo8/VDC7J/sus/LDdGMJyb/O866u?= =?us-ascii?Q?xkwS8EttDmtMYVFaMKboBla4ZinHEHU7D9K56npLt9TeQpYFS18yxbq8lSIJ?= =?us-ascii?Q?eXr0bC4VBMjxKs1czNaEuJlk1habz8ioZG1E5BhLY9G5XnG9yattH3fe8hAJ?= =?us-ascii?Q?3fOzO69EIiF2lMTF6BvdCPBOgjHPpB3NtRc7M9ucwG0VVJX0KKYdQ6qd6pia?= =?us-ascii?Q?MkzWDLWmbEa/dRdo/by9sUdOoOXNPZWyD+j11A/uZEBtyNLgOgAqhYoKvh3h?= =?us-ascii?Q?dEeakl1N+vQQDKnGw1XJxOY+Z1cEEekXTU+FWjsYMGUapxgHFgXrapMaEGZ9?= =?us-ascii?Q?TFEnrzzwQNMsVXQ24DVz1pingaMAr1VnVINbbKXIIVEt5npiio54B36m/ftx?= =?us-ascii?Q?rV7xf1WgJPZ/qudnOjeBRUTiFnghbUMpSQw9AkXfCmVMqhxyDJMalAlvfUZS?= =?us-ascii?Q?VzqwPoH+gkKxHExZpeg01QtATKmI6v1pmGQWUhTK8yN+Nz36aeI3jjUmP33A?= =?us-ascii?Q?++tl9ZIJjjTXbaLvoD9EH+qXmelm4j4uy07tAVgG32fD2434bKlue0IQ97SX?= =?us-ascii?Q?LyLeIoZKoFrEF1G3rZsI1ZNd4SptjcDdKrO/ZXMw2phz8/39loaCcgmxZ+fI?= =?us-ascii?Q?D9Zh4a4hZABp9hVmHirS46QORhsXGYROZwKCwYLdMrPR4GmHOaXRLxsrPMT5?= =?us-ascii?Q?0kBq/lyyCcOJqZVHteQH2VtXOQh8iRv1hxcXid7dHUr4jAvVm2E9nLHG1nN+?= =?us-ascii?Q?IML1Z7hzAX6JUoKshrI7VGtyC2rMOtp9TDWX9ymoLVt4QBXCvin3hRMJpl/8?= =?us-ascii?Q?iRh3jMiZ3bxDD05yDBPvXFLMqO8wGUOEAUnQUXx0Y1CiI847zA2J9pNAzWGe?= =?us-ascii?Q?6Uc4+wwROJWTMCZBANdWksZFxDl6bsVBG1RZT0SUYEVBwnhkh7VcHPDGbSpn?= =?us-ascii?Q?sYWgWmMMbdBxHaUUNycLJdQW6n0K3GgK+RuIj0svuzjXGs4hcX6E4eUecpsf?= =?us-ascii?Q?sIG5DgOLwkR2rPokalpp2pwNQ2435uqciz7l8+MRYQ7o9mgQdi/XP+cE8nnX?= =?us-ascii?Q?Q8sihqcIlaSovJtQZDRh9up5KCvXQRQpyVwVCajTjbts1gnXcFK08YRtaz5o?= =?us-ascii?Q?cE4i3p2JtDvLy1WMup47cLrghWAom0Eav6y7j1Z0n+/hgtI7O6HNbRvk5QI5?= =?us-ascii?Q?mG+Sw65KNwWiD3ZAA57511allY7l1qXOMpapWMXa6jp6Y2OS7mnRxgYPbW0m?= =?us-ascii?Q?h6a0GlRSKUeQ4HFbKZFKyqvWRnh71ZOKy6De9qKQpjtvZUOFjEPTnuIeTuUA?= =?us-ascii?Q?zw=3D=3D?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: a983672a-a91e-4f87-1617-08de30b7d0a9 X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Dec 2025 08:58:37.2892 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: z+eAU+rpoTcUdP5FOVSHM4ow2jW+AfhRieHHAEygJJWGxm4zCrygbB7DUcWEPidXdF5odqKifzPYcT8j6lpSGEpWIbx/EDTV4uQms3ppxeE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR10MB8880 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=f8fhtHXM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: V+MAUrWJzn5X A wic image consists of potentially many different components. All these should be covered by a single SBOM. After creating the wic image, we collect the individual sbom files (rootfs, initrd, imaging) and semantically merge it with the debsbom tool. The merge SBOM is then deployed as .wic.(spdx|cdx).json next to the wic image. Signed-off-by: Felix Moessbauer --- meta/classes/imagetypes_wic.bbclass | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/meta/classes/imagetypes_wic.bbclass b/meta/classes/imagetypes_wic.bbclass index c75d481d..fe31e4e6 100644 --- a/meta/classes/imagetypes_wic.bbclass +++ b/meta/classes/imagetypes_wic.bbclass @@ -201,4 +201,29 @@ EOIMAGER ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.manifest \ ${WORKDIR}/imager.manifest 2>/dev/null \ | sort | uniq > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.manifest" + + for bomtype in ${SBOM_TYPES}; do + merge_wic_sbom $bomtype + done +} + +merge_wic_sbom() { + BOMTYPE="$1" + TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH}) + sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}" + + cat ${IMAGE_FULLNAME}.${bomtype}.json \ + ${INITRD_DEPLOY_FILE}.${bomtype}.json \ + ${WORKDIR}/imager.${bomtype}.json 2>/dev/null | \ + bwrap \ + --unshare-user \ + --unshare-pid \ + --bind ${SBOM_CHROOT} / \ + -- debsbom -v merge -t $BOMTYPE \ + --distro-name '${SBOM_DISTRO_NAME}-Image' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \ + --distro-version '${SBOM_DISTRO_VERSION}' --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \ + --cdx-serialnumber $sbom_document_uuid \ + --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-$sbom_document_uuid \ + --timestamp $TIMESTAMP - -o - \ + > ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.$bomtype.json } -- 2.51.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20251201085813.1616095-11-felix.moessbauer%40siemens.com.