From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 21 Jan 2026 16:07:46 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-yw1-f188.google.com (mail-yw1-f188.google.com [209.85.128.188]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 60LF7inW003787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 21 Jan 2026 16:07:45 +0100 Received: by mail-yw1-f188.google.com with SMTP id 00721157ae682-78e778d774csf57157007b3.2 for ; Wed, 21 Jan 2026 07:07:45 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1769008059; cv=pass; d=google.com; s=arc-20240605; b=ElyQUkIQPqYxK49llHFQrvYY4YJDQ1w/rC72+qFMSswLlLz5G93d5alolV2THEs5eZ xTB3lWHbHd5pF/TcvysdPbZ+taFpzbGEiHpQwvFhsAwl+dZJxDQ+9G6dUgwLRVLH6cE6 Cp57e8iUdITWImT03UqUsPm43rfjwcGeLY8bcB1gFA8hbGt3azTG/O204roLqMBcG50b GPuAEEqed7ry2u3kt66M/0FOv83+b5rl4Zud3GDN02LeQqN+yTDuMgHzOrTn8AfSMaqE EBb9vDSyy9+XNIF8pFqIUEPFtQWL2YCo51rCn8vKO5/iVovuJRUtBjasefyUruhozVav 4pmg== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=6MobZbBZ/r3hJfExS1l50Oa9k+zxCq5Gmbx+LdwUhEI=; fh=sPfrB7UqnNejgX/ZuvKMASL6SGLqRkb7f+R3mHSa0lA=; b=WhBooIT54vrGkLmG390ljRN8VFhHoaLA6F1s3dDbyiPoTzKILGxH9c09bSWaSObCBj 1NXXa+9VyKMtvJ1qSQxvi8VE9sbNPA3NMYZKm00CMj4sKnzTM/tsbsyvmXbUDxf78chc ptTR5looO15BEVLXfUQmIQ4wpBHzh6OmKDo+c3g6EDsK5ECqYxllC4WxdSgS0wGtJp6f VAZzoAl9ojwTNqoDr2U9rLkk911iS0EdsvRG4QHEvil0OBJKWnWxnUPt5etBsiVwB6qW Xn/mfqml+WoXJPx21KQx6VDlB5DSLgICUdJ8/LjbN4Y+/O6OqGfz5kcTJFVkGA48pwoq X22A==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Wf1RUFxO; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1769008059; x=1769612859; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6MobZbBZ/r3hJfExS1l50Oa9k+zxCq5Gmbx+LdwUhEI=; b=Vs66LhpMFS4J+hMKjFAx1A2N0vv4EjSvt64p6PxgL3OnpUVD5NeszkmW49hL+xCtDc 2kvRer4WJcwJ8R+p0XxMU8Qqvk0q5jWpVEAxisADoYrgRVQBH4uxqif30859oOPZyBEc W2IcBdQIKBgA4tlJp8xuYj6Y6d790/Sq4pVXZEN4SonUJhGTNkg2V4Nfgwf/QFzIvx9+ 8jDmHjFPd97rqxsZ9JvumHpJOIbfxDj6m0dYPxTpAiPPVFnYlLgJrXarC/AJL49/J/r5 b4ToXMH6tLZcZjvsqKnExmj8JKOFNK+tmlu2Hymc9eQrw73LmNqVedsYBfOhE8/TH4Mg C+3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769008059; x=1769612859; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=6MobZbBZ/r3hJfExS1l50Oa9k+zxCq5Gmbx+LdwUhEI=; b=NhAIY2e/xdcyjwCjbHScIqi0kmXGhalhc6POXiJnB+f+DJTXaBQ9J5934H2ZrOaAW8 P2bbYmC3F3F11ftLBZPH/9nXiwEDIS/NBlUf41kT8S4DT196REhpzzKiiiGfVV2raHb3 FAgMkF77B7Kwp8B6q/ITt4/jyOwis0eEr9aqJ7e9drzDp6KsC3TFtXezPSYGvJJYPBIL UCC9BNZsHTQ7N7W7UxCnylHfYnDgUw2E0KDqrvAO8c5BvsJErVmpo+4RRb0aRPHd3wK2 25rBZPZrVgnQS4nWqdlwEmyOCua00OVoel6MtKpYCcrjiIoHe6LdAF8V5IuhWKpktmYf XWJg== X-Forwarded-Encrypted: i=3; AJvYcCUuENYMuGxa3ASvTon8ACvzqxleURS1kMUgsmIwBe1HeVJsK903LpQHQ73GD19v2EEPzM9K@ilbers.de X-Gm-Message-State: AOJu0YzppQQNPE6Ro4UukwX/t0MxutZktS3EKVq6UserxqjBf7WA+I6K EZi+qY8YHe7ZuiKUDP2AoVFCIviyfGxfhbngc8AuaYmVacFMvz4br3Ra X-Received: by 2002:a05:690e:151c:b0:647:fee5:5d24 with SMTP id 956f58d0204a3-6493c84902cmr4495162d50.51.1769008058741; Wed, 21 Jan 2026 07:07:38 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="AV1CL+GH/Ge88VMJ72YdTHCBSjK3+NeRcJIPsJK3ClLL3Srn0A==" Received: by 2002:a05:6214:2b9a:b0:894:6476:2ca with SMTP id 6a1803df08f44-8946476043cls31015236d6.2.-pod-prod-07-us; Wed, 21 Jan 2026 07:07:37 -0800 (PST) X-Received: by 2002:a05:6122:8702:b0:566:24fc:94f2 with SMTP id 71dfb90a1353d-56624fc988emr378340e0c.9.1769008057105; Wed, 21 Jan 2026 07:07:37 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1769008057; cv=pass; d=google.com; s=arc-20240605; b=Atm7IEd1rVGIdFNtmtNmWUHai8HlchZaLTmfi7fLvcHs91xS3cgLS1KacE0BRj4VNE OWxdNx4+7mTia/jN4tJjoBHz7E8u2JVPu9V1WEWML2Qnwnoc2mdJtnpnsMaXwlP206M0 HSje2n+EWkok/LjNr0clQOaZLglMp+Tkk6SM4g2u34cKqFfJ3kJGY7FLUX6e2fLb41nR G7jJCXKUPYfAA8gQeHZIThi0oNDr/C2bt7MZC+o3gJpoLJJzwawCcXi9rfHGE9ylLzGJ A9XYKOxWNS0PQdXyw4QRb/s1Yt2ng2ZPE/0sVSBmpokUGxNFy7mhOxibyJXZpiOOSBD6 Er2g== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=cEWuq5mN608KoNzZZ3Ubt5YInmzJfwviTsFwSrEhp3E=; fh=3TZ2kfKzTV0uAG2uKD8NJHxpu4kGHzyonq8tLR1Voro=; b=Mt6bkE68sAEQODNHeW+MK57A9nkblbU3we2cHHFwenCROuhXg5h2AkqE5wDsZGX4+x IpTEt0Mcsqg6no1tg6O2YnyVM6MqOJo0Op/pyGLtRZ0YbYvvuNRcEKzCPR68A8V9vFPc N6AbIh8zzXHLlPKM2p7JZbuMQcYzMSMbOB5Zfaj6NCW19iTYkrkxFnH5S8F/KbMfO/tU jwFHPRrd+lDCJ7fVu5SpQJqFlGzrs16/NDP7kIFFwf+gjLyx1MsXzAz6OCcTCPy5RIaW QwQI/u5EWLkfubD4fVSKCI7OYS+DihPOxXB5phAP8TiCV7z1N5AzSSAEKDf4ts7boUVl d2WA==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Wf1RUFxO; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazlp170130006.outbound.protection.outlook.com. [2a01:111:f403:c201::6]) by gmr-mx.google.com with ESMTPS id 71dfb90a1353d-563b7114810si455032e0c.5.2026.01.21.07.07.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Jan 2026 07:07:36 -0800 (PST) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) client-ip=2a01:111:f403:c201::6; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kz9Vl9wgMj/xr2G9jE5lgGRf6uc88vjmFqTO7oRD83X+hu3wGOuYpGvbQud30kpuMLhi+BNEsbXVu5WTz9mkeBeVhfCPQYRsU0JrHa3/BEbmgHgQ1YjIq6MlnweidlMx9dfyFRgksRBlNiEKvKoxiH2/H7UlLahkl9rYemFumedfvGocdxXLSpFA6Z3GjrdN3y0S+q36NUdBSde69ILFtE/saOKp7rRT2zenAtUQ0pUIrLVLAYIlnUC1SQzoO9V5ccHn62FDDPwCFqJdolpNF/suwFz2EMcsrjhoI71lk0BaZRSPVu2NdsylDrUc2EsD7L6BYB+Igi1hUatIrBiGIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cEWuq5mN608KoNzZZ3Ubt5YInmzJfwviTsFwSrEhp3E=; b=rp50IfFXV2sZM2VciJB+tRgZXU1URvXfQhCS5fZlS8OE/5/KW2emheFqVnIydreM8JfzhM8ZDvQm+HQQ+5OD2GCNZsC16kg7jmydG+iAB5wBzXrP7ma4ScLlbZD74JkXuR8PG4OcUQ9RrvMRlQWr//pu4GKG17gr2xVGuyxutshYGls8vNSGpDmtaoj2Gg7Fs7lbWQvjWYoEce7axUta7jMoVNvkLv6yeFNVIoGwE7TKIZuwJA7QnCX2dBWJEyiWnUuygFcYjdTmC6QmaTTopi27SJj068PKTzgI4ey4Ysj0coS4WqzaTiZ4w9aVYgDRH2Jw32KSjc23A+Pskxx15A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:5f6::12) by VE1PR10MB3806.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:148::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9542.9; Wed, 21 Jan 2026 15:07:31 +0000 Received: from AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM ([fe80::349d:731e:a849:b4a5]) by AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM ([fe80::349d:731e:a849:b4a5%6]) with mapi id 15.20.9542.008; Wed, 21 Jan 2026 15:07:31 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, stefan-koch@siemens.com, Felix Moessbauer Subject: [PATCH v7 0/7] Add SBOM generation with debsbom Date: Wed, 21 Jan 2026 16:07:12 +0100 Message-ID: <20260121150719.2719579-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.51.0 Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: CH2PR17CA0026.namprd17.prod.outlook.com (2603:10b6:610:53::36) To AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:5f6::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS2PR10MB6823:EE_|VE1PR10MB3806:EE_ X-MS-Office365-Filtering-Correlation-Id: 78e86e01-c7a4-418c-2750-08de58fecc57 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|376014; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?KpmkJj2z6yMXBH5Ilp07HoBr4eQRRQVyXRnIApNugXLpqm5j/MD+zoTmCjPM?= =?us-ascii?Q?NqpDOGS8t47pEKrtkfhJwFeT9dDPPqFJc4lwckOf8sZQpla83UJ1ZPTP/y6e?= =?us-ascii?Q?+q/V8ft5X88M8rB2eqlhsT0/9WIoGSZrFekiS/+HlrjTWUlw86uIngusqNPc?= =?us-ascii?Q?I6q+0pSh/JbByk+XF3pp4qfChrdbcLJUD66MgJS08deTPko5X5PHheMXGweB?= =?us-ascii?Q?V0nD6Ud3+74hP0qT+I/GfqNtKUnozRweV866eLrXWd32PMdYi2iPGFtbFhWH?= =?us-ascii?Q?CtN8eTxwt9swzuS45EQ4UEaYjdZC+oIaZhhYQ8IKmRjV5yl4ukQh0rl9E1FJ?= =?us-ascii?Q?2ZqtIWFn9rNWzhJ283IIecENGjMhZKM7T8S/R56Hv2mzaROURZXcD6anWkuB?= =?us-ascii?Q?eA5byKZbs6MNYoC47F1hOZG/6YUYgalctg/4m4SQLeK1x2w7KzItW495TqvD?= =?us-ascii?Q?PD+xsPO2EdUYAaBWZQUxz0dP+As9icXmHpR5gcNahyNIz0MB//TK5s8VBymb?= =?us-ascii?Q?O+/mDf30VQxz2aODNa+HDUIxoP0L7ejPgW5lSLS7SdiurU2OcVUwBpcVeS2d?= =?us-ascii?Q?U8BXODJq+IruPpCtLA6wVjGfHu/YlEHdc8BYO5VFthtkUEXOz83HSLY25Nwl?= =?us-ascii?Q?lu+0IMIy+OMayV6rXeHL9v9wlbUnK5vhkY6DN6SISVSxtL8aCd208VW60git?= =?us-ascii?Q?Lx0AhB3btY1BJNqJ1O2HEL9H4ef1wNdouqO/5ZXL9t65l8Clk9DfZ3ggtImn?= =?us-ascii?Q?5VkVJrseQHG7RxCYmfkEU5PF0TxegGS2d8FVbPdUYjO1iIYvg5lNwy9MX25Z?= =?us-ascii?Q?g8zdMFfEKrbRVCcUB2q+76hr8o/ukrcoUHeWtMX1JebAhC83tHxg/PMLMd6x?= =?us-ascii?Q?P8iEGbJR7QnobWk/p5zlA80Sk5v2kSQyoLFWTdL8zPgrQq6+XH+Au3IONzAb?= =?us-ascii?Q?hi/fVAwC7d0wRi+JfGj3G9oj89t6ggTJWcFFi9GotbTJY5XuZWKra2CGna5x?= =?us-ascii?Q?laDPVYRyHqMqqs2Bj42PLq1bcs56P67g44PImGkFJiX2rbwbX9p4T5pssLNx?= =?us-ascii?Q?2BtCS7VPxWckZyPbXcx2azm56IX+z8p5MupBqRqnqFzsiXHq3OdGNjnoQoJx?= =?us-ascii?Q?aRgCs81zMpCav8u4TkRh/RCmJS2sCDt1Q4qVOrHQjTCLq8XLJzWK8BjVmSqR?= =?us-ascii?Q?6QXQJN8mIts7tmhv+BilSSoaexGOBHv+y1aa7u6JS/gk6b3LMcK8+r+yYvjb?= =?us-ascii?Q?aTdfEaPWkkpl2IPOObMMBJT3ASm6VfAczVkdl2O9q8GC6u2gtoZ2ATa7YsMT?= =?us-ascii?Q?7+W1efKjBPiSoU9EJ8NdapnQzdX8ibufDGDere+F263DKiGa2AEG22yYAMvp?= =?us-ascii?Q?1uTseCVmm59LANeMEXG0eZTsBfj+RQ4OsbIJVP2Wy+lyLT6rA9IavbTQ4BcX?= =?us-ascii?Q?3kWKiE5SC6QouU3ujiSkXLQg/9L7H/MngQHMT+pWWrsADyQeaDvgdbpteTZJ?= =?us-ascii?Q?6690NzmRcEmx+0E9KVOzT/9tsYoMADdnbD8G?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vGKpZAcoW7JPf7i1gkbdM9xqcPSqHYifXTQl3WU+vPEQU4wUvy5NUKEXMD2M?= =?us-ascii?Q?WzDJ9WYfxbOxNi602uJOJSKVTUMX5SOAvAEhEmD+7/7YUX1JgNeuRihT44D/?= =?us-ascii?Q?BguCpC3+jMLRNCigCSZwjHEZBpf1VR7qfbLG2O4rVIbPJ68ME9BqBafWn3Cx?= =?us-ascii?Q?I+wWP/uIxTnjVaDcteaXBsCXaJMgHVxzvFr2Q9K+ALbdjretkJw5zhlCg/lc?= =?us-ascii?Q?h02IgvkntdRF76rR3zbiTLBIRae9172+dSgJfgBiUoyoMqP6QnZYAQjevF7P?= =?us-ascii?Q?2zm5KsbkpVaaxN4u5Jksuiyr8hFQQKoNv6HFOXnzgbaZi75zyqy9dupHi2Gr?= =?us-ascii?Q?TGIEiYRI/ZUrIyXlRni7n/XBhTBYZkZCzv5l0runCAgONYGyofZ07mJr6/1H?= =?us-ascii?Q?R+1/Xol/9/cAP/FpUEg2LwEtZkmNEgtc1ysz+vdcaKs88lqyzUuzADZnyk5S?= =?us-ascii?Q?GzBho/yl/4B3I3a2KcRSBx2PpoaM6fe3HMXvwVucF3Fp3fp5OXaZarPEJ0+A?= =?us-ascii?Q?5CKDOSAO352kV+WKRifXKlHKX0HFbt7GWxLPq42HSyLaUkgByG9Csvl3EAVQ?= =?us-ascii?Q?4dhLMlFcNFqiSTlY5+KCmBycYYpgNpwsPkRuB6nn4WuJ8G3xZZ675aEiYdcz?= =?us-ascii?Q?sy49iv3gRU3z5L0MNhdz6eaUa9NF7AvF1yNvM2oZjdupv1Qe+UlyOGj9e7YQ?= =?us-ascii?Q?rr7rK4Eo7jxUN5Q5gH+VrrntsHo/77c432+izvZqEMuFJ+UEbkXYd3jNflo1?= =?us-ascii?Q?gpVIwZi0dHcz6xmQ70L5OpV2JvxxsvQnbX3OQO22GTi09lWBdbDHn9o1O59E?= =?us-ascii?Q?9YAoDJIOVn931GaFopm8luuQKzrx/Hfa9Mo7E/L5boFFbDqdq9iIAMHEXJqf?= =?us-ascii?Q?2How6DRGfVOJ4ZM+kUWyeM81mBxPLa/tYiHt+UAlbzmGz95PfDQ/b9/9ZgQV?= =?us-ascii?Q?cTPrKD4iIbsYuAYJjffsZL+S5O67LlSseEOxvCs/xzgVq2/OGDgx81RtQgt9?= =?us-ascii?Q?SyugBdQPtQAhrs8g2U0Z0dUQ625Be1esIk/LdcM8UCZFvrDO3mJoW/7d3g4i?= =?us-ascii?Q?D8/mhEg6eDAIcTA5vKMUjJpvp8K70FP6x3E5XEs5LAHCErSErrsI79ww9aOw?= =?us-ascii?Q?GcJyQnh8AnCk6XlQ9DyXCVHy9Y93RnVEreoBgcCBIy8IBZXb3mbl+OW6uMzE?= =?us-ascii?Q?9ljHWQLjbPCHJx3MKHSEDsXsIFogpdj9o0voAos3RPjWDtmhFiUS0SsFm4Rl?= =?us-ascii?Q?evUPh78eF30e7zwYtmDJrQWH13u+8yEPYVHQCs1Vc/grOW1FkBJiInmma9Nx?= =?us-ascii?Q?Ljj5gsGgTfX+FNKbxq44qcO/uk/AFHeEazAnLJD3+nB5y6NZtn15BlPtMOdX?= =?us-ascii?Q?FVVLr3gHdWig2fo4xXBu5jmimQ65yM0L7FuboN/QylCqj31kbTR+ebS7n9Fo?= =?us-ascii?Q?R65BNqnIWSBAY0hkH8Hjm+z16rXkbQGWild1TLppTjK3XDkQKBnmekmGLKHd?= =?us-ascii?Q?iFqjpEdB4VjaQ14Ym7DctAEkWsxVfkzKz1ggQORbCEsAG3QHSRibBI7Nlyt8?= =?us-ascii?Q?voKvxTk9hligvc7ztOQljRwpQYcX1ll8kV8TkxhWbkQOfZ2+eaAJlCKXjuF+?= =?us-ascii?Q?1dJnjJFmmXdAM07wZgvRJ/ZtcdHfSQx2ZwI4z6sJgDft+iUtDO/Hf5dUvKoe?= =?us-ascii?Q?aXkcNJCoh3h2hzUL3IshdIR2Hp49gLSfY98QdzvH7VISexjY0dbL8UsQWMo8?= =?us-ascii?Q?y5SRtQHq1A8eh5aLiXZ3aDiI2mdxcAE=3D?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 78e86e01-c7a4-418c-2750-08de58fecc57 X-MS-Exchange-CrossTenant-AuthSource: AS2PR10MB6823.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jan 2026 15:07:30.9231 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ysZc0hISm0OBAr99W7wJqMCVQbnqH32RCSEX+qGWqsyJHuH4JviYmIJfJd7kzzzmHzZeCp2nnnEKivXjGRVxQZaDtMKlh7amajkdDiDMKOA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR10MB3806 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Wf1RUFxO; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: rIexunnOi2ps This patchset adds proper SBOM generation in the two standard formats SPDX and CycloneDX during the rootfs generation process. The generation is itself is handled by a SBOM generator `debsbom` [1] which is developed as an open source project at Siemens. It is still early in development, but it has enough features for what we require in isar. The required dependencies which are not yet available as Debian packages were minimally packaged directly in isar too. This is a followup of the previous RFC [2]. Since then the series has changed a lot. The SBOM generation was moved from a simple OE lib to `debsbom`. This also meant the introduction of a separate chroot was necessary. The SBOM generation process was also moved from the image step to the rootfs step, along with a lot of minor changes and improvements. [1] https://github.com/siemens/debsbom [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ Changes since v6: - fixed imager bom failure on transitive image types (detected in isar-cip, wic -> squashfs). - updated debsbom to 0.6.0+git - add support for license information - rebased onto next Note: I'm still not able to run the full testsuite. The related patches to cleanup the testsuite are pending on the list for quite some time. I did some extensive local testing with isar-cip core and product layers, but any additional testing is highly welcome. Changes since v5: - fix isar-image-ci on qemuamd64-bullseye (set IMAGER_BOM according to machine changes made in image file) - rebased onto next Changes since v4: - rebased onto next - fix race condition on creation of ${DEPLOY_DIR_SBOM} (aka ${DEPLOY_DIR_IMAGE}) Changes since v3: - fix issue on external bullseye initramfs (we now disable sbom generation on all unsupported distros rootfs instances) - update debsbom to v0.4.0 - rebased onto next Changes since v2: - fix issues when HOST_ARCH != DISTRO_ARCH on derived distributions - update debsbom to v0.3.0, which fixes the Origin: bug reported in v2 - generate SBOM for imager as well and create merged sbom of .wic image - resend imager manifest + wic manifest patches to reduce conflicts Note, that the patches p1-p5 are most important as they add basic SBOM support. The remaining patches address the imager + .wic bom part, which also can be merged later on. Changes since v1: - remove tarball - refactor packaging (auto-derive python dependencies) - only build missing packages (varies on bookworm, trixie, noble) - add ubuntu support - only generate sboms for supported distributions (bookworm/jammy and onwards) - update debsbom (includes bug fixes and more information for source packages) Felix Moessbauer (7): debsbom: update to version 0.6.0 feat: add license information to SBOM as well add support to add imager dependencies to BOM wic: create uniform manifest describing all image components qemuamd64: add IMAGER_BOM entries imager: create SBOM of IMAGER_BOM packages wic: create uniform SBOM describing all image components doc/user_manual.md | 1 + meta-isar/conf/machine/qemuamd64.conf | 1 + .../recipes-core/images/isar-image-ci.bb | 1 + .../image-tools-extension.bbclass | 29 ++++++++++++++++++ meta/classes-recipe/image.bbclass | 9 ++++++ meta/classes-recipe/imagetypes_wic.bbclass | 30 +++++++++++++++++++ meta/classes/sbom.bbclass | 3 +- ..._0.5.1.bb => python3-debsbom_0.6.0+git.bb} | 3 +- 8 files changed, 75 insertions(+), 2 deletions(-) rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.5.1.bb => python3-debsbom_0.6.0+git.bb} (91%) -- 2.51.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260121150719.2719579-1-felix.moessbauer%40siemens.com.