[PATCH v7 2/7] feat: add license information to SBOM as well

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

We now have support in debsbom to also extract the license
information from the packages. We now add a parameter
SBOM_DEBSBOM_EXTRA_ARGS to add extra arguments to the sbom and set the
default to --with-licenses. By that license information is added. If
this is not wanted, the user can overwrite the bitbake variable.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes/sbom.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index 3ed755d9..a16f6ea0 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -15,6 +15,7 @@ SBOM_DISTRO_VERSION ?= "1"
 SBOM_DISTRO_SUMMARY ?= "Linux distribution built with ISAR"
 SBOM_BASE_DISTRO_VENDOR ??= "debian"
 SBOM_DOCUMENT_UUID ?= ""
+SBOM_DEBSBOM_EXTRA_ARGS ?= "--with-licenses"
 
 # SPDX specific user variables
 SBOM_SPDX_NAMESPACE_PREFIX ?= "https://spdx.org/spdxdocs"
@@ -55,7 +56,7 @@ generate_sbom() {
             --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \
             --cdx-serialnumber '${SBOM_DOCUMENT_UUID}' \
             --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-'${SBOM_DOCUMENT_UUID}' \
-            --timestamp $TIMESTAMP
+            --timestamp $TIMESTAMP ${SBOM_DEBSBOM_EXTRA_ARGS}
 }
 
 do_generate_sbom[dirs] += "${DEPLOY_DIR_SBOM}"
-- 
2.51.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260121150719.2719579-3-felix.moessbauer%40siemens.com.