[PATCH 0/6] Rework SBOM generation

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

The SBOM generation currently fails to capture the package checksums
in case of partial rebuilds. This is because the apt-state is not
captured before the rootfs cleanup.

We fix this by capturing the apt-state (and copyright data) while it
still is available. Then, we run the SBOM generator against that data
in a dedicated task. By that, the SBOM generation also can be cached,
if the rootfs does not change - speeding up the build on repeated runs.

We further fix a SBOM chroot deploy race on multi-config builds.

Best regards,
Felix Moessbauer

Felix Moessbauer (6):
  rootfs: capture apt-state before rootfs cleanup
  sbom: run generator as task with apt-cache as input
  wic: make dependency to sbom chroot explicit
  sbom: deploy sbom chroot to distro specific file
  sbom: align deploy dir names
  sbom: cache artifact in sstate cache

 meta/classes-recipe/imagetypes_wic.bbclass |  1 +
 meta/classes-recipe/rootfs.bbclass         | 27 +++++++++++++---
 meta/classes/sbom.bbclass                  | 37 ++++++++++++++++------
 3 files changed, 51 insertions(+), 14 deletions(-)

-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260720081347.3835974-1-felix.moessbauer%40siemens.com.