From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 06 Feb 2026 12:41:22 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-oo1-f57.google.com (mail-oo1-f57.google.com [209.85.161.57]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 616BfKjQ023818 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 6 Feb 2026 12:41:21 +0100 Received: by mail-oo1-f57.google.com with SMTP id 006d021491bc7-662b9af3988sf5495527eaf.1 for ; Fri, 06 Feb 2026 03:41:21 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1770378074; cv=pass; d=google.com; s=arc-20240605; b=MtK2QnYT7hRShkHPNPT/Ply2vF/ajLKlulVvWThIkd7EvOhzxJYpZmRgjoMjHs8XZv N4i356BWN+uW/UIAXw4bw+uz3U2UG77IqWwHVF1I5/w+uo1B5v6IfdK/odHecKoWoB3T 50mGCRbv/6h1KxEmuaGOyUd82f7aLoa8KaWBwlqwjsEa4zImwd5iUIpkO7YHWqJVr4Db OFVGynU1A8u3pCqQOra3TOm+K0qTzUO4JQQKDIUxuPKvqgHJcmyCgxy53KIftDKsfw82 RA9h2cu45tC9k5XHAY/w5VW6hTWhsGB2VpdfwBKmhEIZA4d9J11AjkIBNHxJAV6R+xc3 TZaQ== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; fh=+rwxvU1t6E35vh0o6HjfaofJjJPzXdiIyvp2DLnLVo0=; b=IaKd/gVUStbhXEZkzO/2jnH3VRDvccY3vdDdjqbD8f7eoggrP2LM1Tn38oAuC/6Ax7 ICevTdaBkJCOxcvKrZ99ojirlRu4mYuFXD97mmFz6r1HO/0O39qgi6UP5EZpHTAwju7y wq1oIqIStXx6LUQaE2oaPH6jaBvp/WnMVRU5C1a+qxP2z3dhElNRc3EIF0ctDgr2ZRnD +ULSYoNf0kY2JJ52jGFzKarlvvFKlOL6QU9i/1WLqMoBQxiDND8a5HwQ+GWEIiMFQO0K NuTD2C3BtwINcTSC2WH9tOH8BhniD9i32DFqvDyVLXOrBhn8HTQxBKWpUr8B5whiuRNR 8zxw==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1770378074; x=1770982874; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; b=tIRgM+XoUcMMWOr/yzDqHCmmnVxe8qQvRW5NiMmhCqWlPGvYg/bjqveVnP5V+UZ2Gs qrEwoGCbU9mzZCx59AxJuUrbofYsl5/AN/0CF8RgWQqsiO0e0kcNHK/ZU3fBWKEwh8dH vLv7Pbo2m9nVdZXHrsgew+vRIGNyLDtQNkP0fiU+VIk1mA8iB19epnhF/IIzbL4uvigK y+9DqZGawYrA8gDp2GFaKgKVwJyz7/k/dlyf2PUPKFext5cP4CCqXEcNVczdkA+uyJJS r8vfVnmTxTqPkcZuiU6/yjC2SU/dFSexTwSEqM70Io4/MnqJdYHHPSvIVPxNc7ucGS0m kkxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770378074; x=1770982874; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; b=YdPvYLZBh/XoEoE06Eks1vWCTImibttDuudnm6Ztlinpw4+9ZC76Is50Dyp9hFzdwB NUW6533mu2nRNV/BmUifjZOHqbyJ5Kt+ZQZ0iy1c+UN3NwFdigWN4rOuvcX1h4e/jYO+ IcNypgu16Hf04IYZM02FgMLbP41+955Y2wCJA+4oYgAqOdtwdk1pqoDeYm9f5yuR7NYS 3tDN09Yuw0FbqALO/7Imfmg+dekF+/oMVALOTa/rKOTY0Dcp6ilM7WDTI1GMotM/QDBq IZ70D7p5vNopJL9cShPtjlU0O/H+uL8Qnz6J+a3JdTnvvyNkxigjiAXeet7Sq74sTrHn OmfA== X-Forwarded-Encrypted: i=3; AJvYcCUuT0NL/ruUlj6h2/m2WZFdsDGr7OEuVIIRReJkGUq5ylMykVGRrWSUnoXpOQeSGK2Ix2FD@ilbers.de X-Gm-Message-State: AOJu0YwTAqBqx7CcOeBAI5UMhAFekWobugb/xcnA5xpLDNqJGv8TnWwH PWOCDqRhnHd+6GwAOmnzAUrMB3mOOtX7lnZejnDtdjImkJ6dY8XzzRAv X-Received: by 2002:a05:6820:1527:b0:662:b70c:a414 with SMTP id 006d021491bc7-66d3262b652mr992885eaf.14.1770378074023; Fri, 06 Feb 2026 03:41:14 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="AV1CL+GNQP4rdSCvYwHLvaJ8ERvFzyP6IA4neTZMiENZnN4Ztg==" Received: by 2002:a05:6820:80e:b0:662:f8fc:6675 with SMTP id 006d021491bc7-66b99e687afls1337922eaf.1.-pod-prod-01-us; Fri, 06 Feb 2026 03:41:13 -0800 (PST) X-Received: by 2002:a05:6820:4dce:b0:662:f74d:69f5 with SMTP id 006d021491bc7-66d32fdbf3dmr952455eaf.31.1770378073210; Fri, 06 Feb 2026 03:41:13 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1770378073; cv=pass; d=google.com; s=arc-20240605; b=bFfwhzh0dA9REhefelNE0sGKOx2/q2nUQWPl2eNKb6Du6SouCbOENNJzmc+VvCFGLe CeKAGjQI50Ffcdek5zNEPIdsMGrDIhgrU1cz3y+oYfJWGfPPpZ6V0EXAcFRkDhkxn4dL 8lO384ta+8oKPWJwSH6rzr8rjgtBXhez/XSgYKutgwlqi97r6bjUNPf7ycJCfx5OBOr7 88qsU/3gdbTX4gP9wh3A3IkcHo6V/D/pVsHi8Ms8hyR/Oh0rP908PyZtxcUuOXwflrdZ v35GQHYV0IuFZgUbM40sbuwE+VZlItsJAzs6tlbC3RKAvAUJdeFhpCCOBmGKU/FYciiA /6Eg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=zL8s8myVrfLyn7SK2AKrc3W30259/7LN9/Rg9pjiaHw=; fh=3TZ2kfKzTV0uAG2uKD8NJHxpu4kGHzyonq8tLR1Voro=; b=Z0mXtQ53O+SLgxs15lOg1Iv5886uOPhKXM+lAw8VeovdUYMSk2XChBosT+pCGRMMzt 6/U7IaYAj09T/jTz5ZC+soJjwiMHe76zhx+6lceRYBnG2g53k23YP8b9n17wDi8gX/+1 jity8ptvqfnJo6/ms85jXwngZHNoaZKSVVpMu//k0u7kxkceK7s56LhQcqvaynliSbjg ZGMNzM/ldpr6+gGcBvmOh2WGeUGlmxW9CJBD5qfzBvKC1ONt+4nGtSkVodxIjDu2vy4v VxCaeGxCDMO359eNm6yGgYD+6DNY1Ul/7Y1KTGj32aFHwHWK4Cg6rLVuUha7MpEHoD73 63lA==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazlp170120005.outbound.protection.outlook.com. [2a01:111:f403:c200::5]) by gmr-mx.google.com with ESMTPS id 006d021491bc7-66d35f52c55si61432eaf.0.2026.02.06.03.41.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Feb 2026 03:41:13 -0800 (PST) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) client-ip=2a01:111:f403:c200::5; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uaR99kweryqVauIyeeeNGsS2WJPw/7p4IGAXC+lHTAnyRJMX/e2DscIfYGTGz2n4/ca+zatyE/mQ/DXLyNa/6HTXtj2ZG7H1TDqhrNQL3lybUU54LIzPBk94ZHPPboiSnLTerX4e8Zi3Z9VL6LGwASKIE7SmguHfu+KqMTcbT6Huq2+VlxKomu7g1qzT8QSOoOGihW1qM3QuyHvMyhIbsMBh9oETLYb5kdN+QIA6CzQSDLXQ209xrV3qAVIxzbvIOE/ph91j74MMmrBroM5vnmXXXTYWxzixSo3eT/cRv1WbN5W1DqlRly4JAIGQYuGlCJglhkxc70nE/Nt4XbK1sQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zL8s8myVrfLyn7SK2AKrc3W30259/7LN9/Rg9pjiaHw=; b=wGtnPRD5XbAE0qr7hVXhmHiO8WgTccbn8NgGu2qW9Dx60sAWnsU8y3tg+Zmo3nbP2VbJV8slRA7isnSM45MZV+7Ibh2vg/x5Y2KTete8xf2pNeiAoQ5INYTpMsBLQIf9fNKyaLy4LIKZGztsQv0hEkVF0UeT/oxQMFAaRsPnX09+YtZ07XeG5+aT6jTmM/rwTPzWfUgTpB1MY+FDMtXtrO2BJ5OdMPQu4J5o7LRdhjolhrAYUvGRrYNaPYED1srI0ZYAc+fItQ7hHEPetkN066Qdg9Fb7RY2wYgexYZDK8ek54zEayJ7PXwvfbmc51IybG/j/8exY056PZzUmf25dw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by DB4PR10MB7039.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:3f1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.14; Fri, 6 Feb 2026 11:41:10 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::9412:cd7f:3f72:92ab]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::9412:cd7f:3f72:92ab%3]) with mapi id 15.20.9587.010; Fri, 6 Feb 2026 11:41:10 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, stefan-koch@siemens.com, Felix Moessbauer Subject: [PATCH v8 7/7] wic: create uniform SBOM describing all image components Date: Fri, 6 Feb 2026 12:40:54 +0100 Message-ID: <20260206114054.3010883-8-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260206114054.3010883-1-felix.moessbauer@siemens.com> References: <20260206114054.3010883-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR0P281CA0252.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:af::14) To DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR10MB6828:EE_|DB4PR10MB7039:EE_ X-MS-Office365-Filtering-Correlation-Id: c0f15fec-e1ec-45f8-22be-08de65749fbd X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|10070799003|376014; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?9hJlxl9JLni3M2ST1CY8rdZzvUWiq6swpGPQuD1yfX9dZprZ3CrjK7aYNMy5?= =?us-ascii?Q?8irWsmRuYqeCbpGzG8/C1so8Yw+rIT5K15vAA4gRkeba18dvZRd3koxHsIlY?= =?us-ascii?Q?pWIUfhJ0kOYRj/HfzOYPdbpMMj6kIqINJCvi1R/GXTYcDmi0j/N7w6Pc2hr4?= =?us-ascii?Q?T2WxG5lvOafO8FyrVG3CcMeW1UG7KPhF9anXgye65gyajfFgL5FQE2IBeyez?= =?us-ascii?Q?w0z8a8IrpDkhi22TUOa2K6zla8xn+DFzSmjmFW2LYajXnCFArCz10xqEH9Bd?= =?us-ascii?Q?efKNz0vJ1oP5kAE7jALWE6J8sECBaj+S0wqgfXiSXDBYRDtvGJn/c6xFARTC?= =?us-ascii?Q?xxxAWKbwmxiUAU76KM4L7Q2m2ENTPVV+DpPpkscn60yg4jTFmHgdTyLgODX4?= =?us-ascii?Q?JeYK99DTGD46SaRMxOJJMF7UxD8g19zEzjm61uJqiJYjhvVIclL2+bUXZ9MB?= =?us-ascii?Q?MuQbO88HnSr/RfKYeiUsqHmNCH/Gyw29pawsst+D2XohfIJTUx85VqL5yxGs?= =?us-ascii?Q?qcHjfCP52puZiSe9+O3PGlubK8vz9N1j3mmHfo5qnyukNEkCu5hkl/4wAgZH?= =?us-ascii?Q?oGAowdEGTr/H0Q9A6YJk8rwxsyZHH+oqFRieBFacRW5LOCsV5Y/FslVQ2qSl?= =?us-ascii?Q?l6srsOeRmu7Q7ImyKt49RypRnjvRwyNfzMVWbWCv+22NnEJyGiXfSFEUt/Yp?= =?us-ascii?Q?nsChJJdmsOeYBImDXoQUYlrpaZWj5eSyh5ROr204m4deCCuOT2rafHjNJLWW?= =?us-ascii?Q?z7T3ZuNwGTtX2jQCu6WqaZGD5PYemlCNUV6oaVB5DZ7Oiywt7xwDjDyuA/qg?= =?us-ascii?Q?LJ7rWooUpxZAK6+6d0fk6fOCLCwba/tv9fY5EM1+W8w4Y1xL27LnBv4LFtK0?= =?us-ascii?Q?b90HwpSlYH0yaYOPZfFgbdH0pwnkHZKFVOD6iVrjKggHc8pBh3LF1Lw557m+?= =?us-ascii?Q?saEZjGslxeHJ+Uu02F3BQXJ2qUnY+PAXhLjX50StzshccYpvq1I9/HLH146b?= =?us-ascii?Q?OSW4QlyiPPuCWXxY99akh1AglnObbCQgVj4tDZmc4MUfLn8yQ2fs2EJw8Zrm?= =?us-ascii?Q?r61iF1NMrsqpBkx4PAuR98gSgtuNIL8berhB/HoepOHhzdEUuq9W1QUfO2ED?= =?us-ascii?Q?bzLmjm94ipTdLiRyFUzi2s+HjBM6cPfVkQQ3HVc1xAulIKtGQzbIvhP8bZUg?= =?us-ascii?Q?rKFwda4vmOl5SaeaA5uWgJ3UOXbmcU8BsREUHjliGqmvQzmC9Ir0psY/zjsd?= =?us-ascii?Q?hZYCnUNRriI+desyKhlz6OIPszEF6dzCEUtRo62+5/Ki0mCr8JdFZyQKVrgS?= =?us-ascii?Q?aKOQ2QpP97p1XGXSSb41gNJ+9WkZ24lMSUPQ0mpL//KjBR+XTulDmG53gc8r?= =?us-ascii?Q?hx/6Ot0CSfjAUkPLMtEJrs4527B6kmPHLw2ZvC8SZdQtBg6MYKuKSbj0JIlR?= =?us-ascii?Q?e3Bd+6D8WK5VuE0dYFhxc+oWLa6NB5eD8ofgSr313FhMoSYrWbyQdOBmlPyP?= =?us-ascii?Q?rZZc5HAXmkwrJHETnSXur7L9L8XDb48CyvodtLhPJh8IOti+zxcqBVLnN0ji?= =?us-ascii?Q?eVULQA88Fgaijs/y+Pk=3D?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(10070799003)(376014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?6iT1gpxTgv03lXwHWe9AWGojR7R2Gl4212J3PIdvn80AlhMkBitKtMcPEA/J?= =?us-ascii?Q?9reIXve337YcyD1cyHk4n1H8b2mF33vfiEq2vbYNPvgjh4fVSj4YTrTvPCDs?= =?us-ascii?Q?o2e8twmDgwqocNJnohfbLOT5JtllT+6I0ZkrSAmC8omoZPk3yU1yYgO0YWVO?= =?us-ascii?Q?QFkX7CgN0tYLf1H9T4qUAs7rav9tpxKQFu5Yhie7PBB6N6/mdpKr75FzntEC?= =?us-ascii?Q?oW4769cy/4tbQ1qK8Ro8nPCPlagLUeVFCLPfvg7YezcaHmiSSvLFbKkKtaFA?= =?us-ascii?Q?S8RtMXycJqSt9fjo5LvArFxLSXQnnrGIDprM2XIe7ToJwT0AJzPnga9JHiDz?= =?us-ascii?Q?La54zlaZ8JNIOksqb3F3Yx6LoU7+JMp+kClXEyhPYr15WRgWyEgrlZI3c6Lo?= =?us-ascii?Q?8+wnpnXvJqBrl+17j9ZtDy8Wz3cq04lCWSCc6Bvd+q6Sp/pTCHoJDiqBMcG7?= =?us-ascii?Q?lD5sgqJkqAnHt6goG9+KRO3/EMd9SnfPMd8GVzKSTWKcCIUZR2WkASQ1Q5KK?= =?us-ascii?Q?AYtALyd3ZDsOJL8mQCY1XD3Cdqf+bQlsVNntlXnvk2WHEDXmIxzGowiVUVcO?= =?us-ascii?Q?25L4DFdTYfUqU/CEB6DVoI1dt9gJT+4298QcBvsMFR8r5MKs+4/Ga5hqO5ZY?= =?us-ascii?Q?ciAJZ64nHa5u22AqLmNWyQyu4QJOATg4464hkc7nNEuBa444BBm9dh7rI8I8?= =?us-ascii?Q?lZvDRfmziolJSrEH3biJybU8BHEJrgf6ILc0Mgf0XEUKOt2rqvQlE3ntQM9y?= =?us-ascii?Q?tBpgBYRrecOl3y+dpaypAHhbPZwApRNSehPj2H+Z4nGKaSgw8rriZzvmVqf5?= =?us-ascii?Q?O4QFo1g9AqeBGo0niedzsqoGKUlLh4lGcB/qkzvBwPJyQ4LLO2/7Y1RLN7J/?= =?us-ascii?Q?QPP61dzJB7a6S/HCeVoKOwKFdAZq4/L/Ug330+8M1fhFHkn+6gp2k2Lm8URz?= =?us-ascii?Q?dzK306pu3xnAdPXxkfciBw5m0hQtNOfmEhMBdAM5+SvZjCRmy8Z9ebWqmCbG?= =?us-ascii?Q?JGUvThQJ4+aHcGyKJef5BuXn0RXSe+XSNmt8SWLdIcwWZLbxI7bybK3RRg9b?= =?us-ascii?Q?V9xDCNNZFE29wMAYmM34HtHX8scUPiv5jwTwtsxoPRgqqH98c1rfI/1vpPmn?= =?us-ascii?Q?TZxmQdjeu+eAzd2AHEAlCGmTDd6ocun/9BDuCqB9ppz9RYx3/L9hPSNPwbTr?= =?us-ascii?Q?EYXgmAJ2rFS1RBzbkX5qKUIiUffUdsrPhHZW1bdPvRLsfZS2pqxi2S1PY2SJ?= =?us-ascii?Q?l2BjZ7OiXJidEyfsCKZUBzHssdwFcRVH1pkYsFNW82Irl0PIXeLiksLOEO4z?= =?us-ascii?Q?e69VW7oNxelX65H/PpBHzmXv7gu+rFmN1yEopKw/HF26QLkuj2iFSnXmJ2aZ?= =?us-ascii?Q?RMPFWD33lw0MuSvFzo6PmlPMMvFeN2PapNTyfm0HWz9lDl7TQMVo5dYSU/tI?= =?us-ascii?Q?7FkEBtT8N7M1jcIay1LW9yfF4Are4LCSNxbvwgf1lFXVff8C8LZR2S8ax7c5?= =?us-ascii?Q?od44l0PfBL4l5MSHUD7HCtONGLV6OiQhUT2p3yJX5y8jribiTV03hO6ZZei9?= =?us-ascii?Q?chOt0s9dY8bAillwKDr7MAQnL72YppHNZW8uu+4qG1aGHnkxDWrqL59AAu6G?= =?us-ascii?Q?U702wXbs0rZ/fdXo3tMvsMfwB+iakbU8vBOJjibfpN77ZnV/JJkWpRHmK7dZ?= =?us-ascii?Q?SU6OS9ZWuvboEo9mmEFbvbT+z39rxUMKB87Vq9In2bInnm4bYivSEw8ZVCYn?= =?us-ascii?Q?MwTFoVWT1d9BCnAJdPgGgjcV3lnRTH4SYai4LibILIFKLSiYJWChR8H4CEza?= X-MS-Exchange-AntiSpam-MessageData-1: 8KgnhxuRg14LYPZux3gU2rQq5YggWvqs3Ps= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0f15fec-e1ec-45f8-22be-08de65749fbd X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Feb 2026 11:41:10.5643 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: yvBhXy6XSwAozCZ6MOE3m1oZbaw3QsNJbBEzJcQ7OkAKsxfPd15dG23cgQo/FYmSKzpVlCDA1NQsXm4KZXTn0dCs3LVnSpk3Rs9d25r4p38= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR10MB7039 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: sAw9W+ompdZl A wic image consists of potentially many different components. All these should be covered by a single SBOM. After creating the wic image, we collect the individual sbom files (rootfs, initrd, imaging) and semantically merge it with the debsbom tool. The merge SBOM is then deployed as .wic.(spdx|cdx).json next to the wic image. Signed-off-by: Felix Moessbauer --- meta/classes-recipe/imagetypes_wic.bbclass | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/meta/classes-recipe/imagetypes_wic.bbclass b/meta/classes-recipe/imagetypes_wic.bbclass index c75d481d..6b82add3 100644 --- a/meta/classes-recipe/imagetypes_wic.bbclass +++ b/meta/classes-recipe/imagetypes_wic.bbclass @@ -201,4 +201,31 @@ EOIMAGER ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.manifest \ ${WORKDIR}/imager.manifest 2>/dev/null \ | sort | uniq > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.manifest" + + if ${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'true', 'false', d)} ; then + for bomtype in ${SBOM_TYPES}; do + merge_wic_sbom $bomtype + done + fi +} + +merge_wic_sbom() { + BOMTYPE="$1" + TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH}) + sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}" + + cat ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.${bomtype}.json \ + ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.${bomtype}.json \ + ${WORKDIR}/imager.${bomtype}.json 2>/dev/null | \ + bwrap \ + --unshare-user \ + --unshare-pid \ + --bind ${SBOM_CHROOT} / \ + -- debsbom -v merge -t $BOMTYPE \ + --distro-name '${SBOM_DISTRO_NAME}-Image' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \ + --distro-version '${SBOM_DISTRO_VERSION}' --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \ + --cdx-serialnumber $sbom_document_uuid \ + --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-$sbom_document_uuid \ + --timestamp $TIMESTAMP - -o - \ + > ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.$bomtype.json } -- 2.51.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260206114054.3010883-8-felix.moessbauer%40siemens.com.