[PATCH v2 0/3] Update debsbom tool

[PATCH v2 0/3] Update debsbom tool

['Felix Moessbauer' via isar-users]

Changes since v1:

- bump debsbom version to 0.10.2 (which fixes the issues
  found on 0.10.1)

Felix Moessbauer (3):
  imager sbom: simplify invocation of debsbom tool
  debsbom: update to v0.10.2
  rootfs sbom: directly use captured apt state without extraction

 .../image-tools-extension.bbclass             |  6 +--
 meta/classes/sbom.bbclass                     | 10 +----
 ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
 .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
 4 files changed, 47 insertions(+), 14 deletions(-)
 rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
 create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-1-felix.moessbauer%40siemens.com.

[PATCH v2 1/3] imager sbom: simplify invocation of debsbom tool

['Felix Moessbauer' via isar-users]

We don't need to create the output directory upfront, as bwrap
internally does this on bind-mounting. Further, we avoid being extra
verbose to align the debsbom CLI with the other invocations.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index 8f666444..754db7a6 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -102,10 +102,6 @@ EOAPT
 }
 
 generate_imager_sbom_in_chroot() {
-    run_privileged mkdir -p \
-        ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
-        ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-
     TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
     sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}"
     bwrap \
@@ -114,7 +110,7 @@ generate_imager_sbom_in_chroot() {
         --bind ${SBOM_CHROOT_LOCAL} / \
         --bind $1 /mnt/rootfs \
         --bind ${WORKDIR} /mnt/deploy-dir \
-        -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
+        -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} \
             --from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \
             --distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
             --distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-2-felix.moessbauer%40siemens.com.

[PATCH v2 2/3] debsbom: update to v0.10.2

['Felix Moessbauer' via isar-users]

This brings a couple of bugfixes, as well as support to read the package
data from a tar file.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
 .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
 create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
index 7fc9a8eb..fa0b9b38 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
            file://rules \
            file://0001-Use-old-license-description-in-pyproject.toml.patch \
            "
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
+SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
 
 do_prepare_build[cleandirs] += "${S}/debian"
 do_prepare_build() {
diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
new file mode 100644
index 00000000..1aec1369
--- /dev/null
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
@@ -0,0 +1,43 @@
+# This software is a part of Isar.
+# Copyright (c) Siemens, 2025
+#
+# SPDX-License-Identifier: MIT
+
+inherit dpkg
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+S = "${WORKDIR}/git"
+
+DEPENDS:append:bookworm = " python3-packageurl"
+DEPENDS:append:noble = " python3-packageurl"
+
+S = "${WORKDIR}/git"
+
+MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
+DPKG_ARCH = "all"
+DEBIAN_BUILD_DEPENDS = "dh-python, \
+                        python3-all, \
+                        python3-setuptools, \
+                        pybuild-plugin-pyproject, \
+                        python3-packageurl, \
+                        python3-debian, \
+                        python3-requests, \
+                        python3-zstandard, \
+                        python3-license-expression, \
+                        "
+
+DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
+
+DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
+
+SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
+           file://rules \
+           file://0001-Use-old-license-description-in-pyproject.toml.patch \
+           "
+SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+    deb_debianize
+}
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com.

Re: [PATCH v2 2/3] debsbom: update to v0.10.2

['Florian Bezdeka' via isar-users]

On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
wrote:
> This brings a couple of bugfixes, as well as support to read the package
> data from a tar file.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
>  .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
>  2 files changed, 44 insertions(+), 1 deletion(-)
>  rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
>  create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> 
> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> similarity index 95%
> rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> index 7fc9a8eb..fa0b9b38 100644
> --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
>             file://rules \
>             file://0001-Use-old-license-description-in-pyproject.toml.patch \
>             "
> -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
> +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
>  
>  do_prepare_build[cleandirs] += "${S}/debian"
>  do_prepare_build() {
> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> new file mode 100644
> index 00000000..1aec1369
> --- /dev/null
> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> @@ -0,0 +1,43 @@
> +# This software is a part of Isar.
> +# Copyright (c) Siemens, 2025
> +#
> +# SPDX-License-Identifier: MIT
> +
> +inherit dpkg
> +
> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> +
> +S = "${WORKDIR}/git"
> +
> +DEPENDS:append:bookworm = " python3-packageurl"
> +DEPENDS:append:noble = " python3-packageurl"
> +
> +S = "${WORKDIR}/git"
> +
> +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
> +DPKG_ARCH = "all"
> +DEBIAN_BUILD_DEPENDS = "dh-python, \
> +                        python3-all, \
> +                        python3-setuptools, \
> +                        pybuild-plugin-pyproject, \
> +                        python3-packageurl, \
> +                        python3-debian, \
> +                        python3-requests, \
> +                        python3-zstandard, \
> +                        python3-license-expression, \
> +                        "
> +
> +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
> +
> +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."

Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
the tool is part of forky that means someone must have done a the same
work already...

> +
> +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> +           file://rules \
> +           file://0001-Use-old-license-description-in-pyproject.toml.patch \
> +           "
> +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> +
> +do_prepare_build[cleandirs] += "${S}/debian"
> +do_prepare_build() {
> +    deb_debianize
> +}
> -- 
> 2.55.0
> 
> -- 
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/04bc2bac7156f18bfa79cb10feb0fdb323b54a6a.camel%40siemens.com.

Re: [PATCH v2 2/3] debsbom: update to v0.10.2

['Christoph Steiger' via isar-users]

On 9/8/26 8:13 AM, Florian Bezdeka wrote:
> On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
> wrote:
>> This brings a couple of bugfixes, as well as support to read the package
>> data from a tar file.
>>
>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>> ---
>>   ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
>>   .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
>>   2 files changed, 44 insertions(+), 1 deletion(-)
>>   rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
>>   create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>>
>> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> similarity index 95%
>> rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
>> rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> index 7fc9a8eb..fa0b9b38 100644
>> --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
>> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
>>              file://rules \
>>              file://0001-Use-old-license-description-in-pyproject.toml.patch \
>>              "
>> -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
>> +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
>>   
>>   do_prepare_build[cleandirs] += "${S}/debian"
>>   do_prepare_build() {
>> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>> new file mode 100644
>> index 00000000..1aec1369
>> --- /dev/null
>> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>> @@ -0,0 +1,43 @@
>> +# This software is a part of Isar.
>> +# Copyright (c) Siemens, 2025
>> +#
>> +# SPDX-License-Identifier: MIT
>> +
>> +inherit dpkg
>> +
>> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
>> +
>> +S = "${WORKDIR}/git"
>> +
>> +DEPENDS:append:bookworm = " python3-packageurl"
>> +DEPENDS:append:noble = " python3-packageurl"
>> +
>> +S = "${WORKDIR}/git"
>> +
>> +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
>> +DPKG_ARCH = "all"
>> +DEBIAN_BUILD_DEPENDS = "dh-python, \
>> +                        python3-all, \
>> +                        python3-setuptools, \
>> +                        pybuild-plugin-pyproject, \
>> +                        python3-packageurl, \
>> +                        python3-debian, \
>> +                        python3-requests, \
>> +                        python3-zstandard, \
>> +                        python3-license-expression, \
>> +                        "
>> +
>> +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
>> +
>> +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
> 
> Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
> the tool is part of forky that means someone must have done a the same
> work already...
> 

There is an upstream packaging [1] which is also maintained by us. 
Unfortunately debsbom is only available in trixie backports and not at 
all in bookworm. When we introduced the SBOM support we needed to 
package it in isar since it wasnt yet packaged upstream and it has 
stayed like this since then. We will at some point probably just use the 
upstream version.

[1] https://salsa.debian.org/python-team/packages/debsbom

>> +
>> +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
>> +           file://rules \
>> +           file://0001-Use-old-license-description-in-pyproject.toml.patch \
>> +           "
>> +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
>> +
>> +do_prepare_build[cleandirs] += "${S}/debian"
>> +do_prepare_build() {
>> +    deb_debianize
>> +}
>> -- 
>> 2.55.0
>>
>> -- 
>> You received this message because you are subscribed to the Google Groups "isar-users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
>> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/500c99d3-f548-4780-975d-63ee29d475cb%40siemens.com.

Re: [PATCH v2 2/3] debsbom: update to v0.10.2

['MOESSBAUER, Felix' via isar-users]

On Tue, 2026-09-08 at 10:10 +0200, Christoph Steiger wrote:
> On 9/8/26 8:13 AM, Florian Bezdeka wrote:
> > On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
> > wrote:
> > > This brings a couple of bugfixes, as well as support to read the package
> > > data from a tar file.
> > > 
> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > > ---
> > >   ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
> > >   .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
> > >   2 files changed, 44 insertions(+), 1 deletion(-)
> > >   rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
> > >   create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > 
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > similarity index 95%
> > > rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > index 7fc9a8eb..fa0b9b38 100644
> > > --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > >              file://rules \
> > >              file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > >              "
> > > -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
> > > +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
> > >   
> > >   do_prepare_build[cleandirs] += "${S}/debian"
> > >   do_prepare_build() {
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > new file mode 100644
> > > index 00000000..1aec1369
> > > --- /dev/null
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > @@ -0,0 +1,43 @@
> > > +# This software is a part of Isar.
> > > +# Copyright (c) Siemens, 2025
> > > +#
> > > +# SPDX-License-Identifier: MIT
> > > +
> > > +inherit dpkg
> > > +
> > > +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +DEPENDS:append:bookworm = " python3-packageurl"
> > > +DEPENDS:append:noble = " python3-packageurl"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
> > > +DPKG_ARCH = "all"
> > > +DEBIAN_BUILD_DEPENDS = "dh-python, \
> > > +                        python3-all, \
> > > +                        python3-setuptools, \
> > > +                        pybuild-plugin-pyproject, \
> > > +                        python3-packageurl, \
> > > +                        python3-debian, \
> > > +                        python3-requests, \
> > > +                        python3-zstandard, \
> > > +                        python3-license-expression, \
> > > +                        "
> > > +
> > > +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
> > > +
> > > +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
> > 
> > Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
> > the tool is part of forky that means someone must have done a the same
> > work already...
> > 
> 
> There is an upstream packaging [1] which is also maintained by us. 
> Unfortunately debsbom is only available in trixie backports and not at 
> all in bookworm. 
> 

While debsbom itself is available in trixie-backports, the python3-
spdx-tools is not. By that, we can only generate CycloneDX SBOMs in a
pure Debian environment. For older targets like bookworm, we anyways
need a custom built in isar.

As the debsbom tool runs outside of the target chroot, it could also be
provided as host tool (e.g. in kas-container), or in a dedicated
(forky) chroot. The latter requires multiconfig for all targets that
want to have an SBOM generated, though.

> When we introduced the SBOM support we needed to 
> package it in isar since it wasnt yet packaged upstream and it has 
> stayed like this since then. We will at some point probably just use the 
> upstream version.

While we could use the upstream packaging, it would significantly
increase the build time due to additional built-time dependencies
(which are optional if only supporting debsbom generate). We could
introduce build profiles in upstream to reduce the impact, but I'm not
sure if it is really worth it.

A third option would be to use Yocto's buildtools feature [2], but that
is currently not used in isar at all.

For now, I recommend to just keep the packaging as is and just update
it from time to time (only needed on generate related patches).

[2]
https://docs.yoctoproject.org/dev/ref-manual/system-requirements.html#downloading-a-pre-built-buildtools-tarball

Felix

> 
> [1] https://salsa.debian.org/python-team/packages/debsbom
> 
> > > +
> > > +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > > +           file://rules \
> > > +           file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > > +           "
> > > +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> > > +
> > > +do_prepare_build[cleandirs] += "${S}/debian"
> > > +do_prepare_build() {
> > > +    deb_debianize
> > > +}
> > > -- 
> > > 2.55.0
> > > 
> > > -- 
> > > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/9b5e7cb996bb7a5dc0511bb0954ed46faf965621.camel%40siemens.com.

[PATCH v2 3/3] rootfs sbom: directly use captured apt state without extraction

['Felix Moessbauer' via isar-users]

Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes/sbom.bbclass | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..43b8a71e 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,14 @@ EOF
 }
 
 generate_sbom() {
-    run_privileged_heredoc <<'EOF'
-        mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
-                 ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-        tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
-            -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF
-
     TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
+    unzstd < ${WORKDIR}/${ROOTFS_APT_STATE} | \
     bwrap \
         --unshare-user \
         --unshare-pid \
         --bind ${SBOM_CHROOT_LOCAL} / \
         --bind ${SBOM_LOCAL_DEPLOYDIR} /mnt/deploy-dir \
-        -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
+        -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r - -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
             --distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
             --distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
             --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-4-felix.moessbauer%40siemens.com.