* [PATCH v2 0/3] Update debsbom tool
@ 2026-09-07 12:37 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 1/3] imager sbom: simplify invocation of " 'Felix Moessbauer' via isar-users
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: 'Felix Moessbauer' via isar-users @ 2026-09-07 12:37 UTC (permalink / raw)
To: isar-users; +Cc: christoph.steiger, Felix Moessbauer
Changes since v1:
- bump debsbom version to 0.10.2 (which fixes the issues
found on 0.10.1)
Felix Moessbauer (3):
imager sbom: simplify invocation of debsbom tool
debsbom: update to v0.10.2
rootfs sbom: directly use captured apt state without extraction
.../image-tools-extension.bbclass | 6 +--
meta/classes/sbom.bbclass | 10 +----
...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
.../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
4 files changed, 47 insertions(+), 14 deletions(-)
rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-1-felix.moessbauer%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2 1/3] imager sbom: simplify invocation of debsbom tool
2026-09-07 12:37 [PATCH v2 0/3] Update debsbom tool 'Felix Moessbauer' via isar-users
@ 2026-09-07 12:37 ` 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 2/3] debsbom: update to v0.10.2 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 3/3] rootfs sbom: directly use captured apt state without extraction 'Felix Moessbauer' via isar-users
2 siblings, 0 replies; 7+ messages in thread
From: 'Felix Moessbauer' via isar-users @ 2026-09-07 12:37 UTC (permalink / raw)
To: isar-users; +Cc: christoph.steiger, Felix Moessbauer
We don't need to create the output directory upfront, as bwrap
internally does this on bind-mounting. Further, we avoid being extra
verbose to align the debsbom CLI with the other invocations.
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index 8f666444..754db7a6 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -102,10 +102,6 @@ EOAPT
}
generate_imager_sbom_in_chroot() {
- run_privileged mkdir -p \
- ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}"
bwrap \
@@ -114,7 +110,7 @@ generate_imager_sbom_in_chroot() {
--bind ${SBOM_CHROOT_LOCAL} / \
--bind $1 /mnt/rootfs \
--bind ${WORKDIR} /mnt/deploy-dir \
- -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} \
--from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \
--distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-2-felix.moessbauer%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2 2/3] debsbom: update to v0.10.2
2026-09-07 12:37 [PATCH v2 0/3] Update debsbom tool 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 1/3] imager sbom: simplify invocation of " 'Felix Moessbauer' via isar-users
@ 2026-09-07 12:37 ` 'Felix Moessbauer' via isar-users
2026-09-08 6:13 ` 'Florian Bezdeka' via isar-users
2026-09-07 12:37 ` [PATCH v2 3/3] rootfs sbom: directly use captured apt state without extraction 'Felix Moessbauer' via isar-users
2 siblings, 1 reply; 7+ messages in thread
From: 'Felix Moessbauer' via isar-users @ 2026-09-07 12:37 UTC (permalink / raw)
To: isar-users; +Cc: christoph.steiger, Felix Moessbauer
This brings a couple of bugfixes, as well as support to read the package
data from a tar file.
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
.../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
2 files changed, 44 insertions(+), 1 deletion(-)
rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
index 7fc9a8eb..fa0b9b38 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
file://rules \
file://0001-Use-old-license-description-in-pyproject.toml.patch \
"
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
+SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
do_prepare_build[cleandirs] += "${S}/debian"
do_prepare_build() {
diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
new file mode 100644
index 00000000..1aec1369
--- /dev/null
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
@@ -0,0 +1,43 @@
+# This software is a part of Isar.
+# Copyright (c) Siemens, 2025
+#
+# SPDX-License-Identifier: MIT
+
+inherit dpkg
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+S = "${WORKDIR}/git"
+
+DEPENDS:append:bookworm = " python3-packageurl"
+DEPENDS:append:noble = " python3-packageurl"
+
+S = "${WORKDIR}/git"
+
+MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
+DPKG_ARCH = "all"
+DEBIAN_BUILD_DEPENDS = "dh-python, \
+ python3-all, \
+ python3-setuptools, \
+ pybuild-plugin-pyproject, \
+ python3-packageurl, \
+ python3-debian, \
+ python3-requests, \
+ python3-zstandard, \
+ python3-license-expression, \
+ "
+
+DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
+
+DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
+
+SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
+ file://rules \
+ file://0001-Use-old-license-description-in-pyproject.toml.patch \
+ "
+SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+ deb_debianize
+}
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2 3/3] rootfs sbom: directly use captured apt state without extraction
2026-09-07 12:37 [PATCH v2 0/3] Update debsbom tool 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 1/3] imager sbom: simplify invocation of " 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 2/3] debsbom: update to v0.10.2 'Felix Moessbauer' via isar-users
@ 2026-09-07 12:37 ` 'Felix Moessbauer' via isar-users
2 siblings, 0 replies; 7+ messages in thread
From: 'Felix Moessbauer' via isar-users @ 2026-09-07 12:37 UTC (permalink / raw)
To: isar-users; +Cc: christoph.steiger, Felix Moessbauer
Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
meta/classes/sbom.bbclass | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..43b8a71e 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,14 @@ EOF
}
generate_sbom() {
- run_privileged_heredoc <<'EOF'
- mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
- tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
- -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF
-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
+ unzstd < ${WORKDIR}/${ROOTFS_APT_STATE} | \
bwrap \
--unshare-user \
--unshare-pid \
--bind ${SBOM_CHROOT_LOCAL} / \
--bind ${SBOM_LOCAL_DEPLOYDIR} /mnt/deploy-dir \
- -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r - -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
--distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
--base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \
--
2.55.0
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-4-felix.moessbauer%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/3] debsbom: update to v0.10.2
2026-09-07 12:37 ` [PATCH v2 2/3] debsbom: update to v0.10.2 'Felix Moessbauer' via isar-users
@ 2026-09-08 6:13 ` 'Florian Bezdeka' via isar-users
2026-09-08 8:10 ` 'Christoph Steiger' via isar-users
0 siblings, 1 reply; 7+ messages in thread
From: 'Florian Bezdeka' via isar-users @ 2026-09-08 6:13 UTC (permalink / raw)
To: Felix Moessbauer, isar-users; +Cc: christoph.steiger
On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
wrote:
> This brings a couple of bugfixes, as well as support to read the package
> data from a tar file.
>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
> ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
> .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
> 2 files changed, 44 insertions(+), 1 deletion(-)
> rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
> create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>
> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> similarity index 95%
> rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> index 7fc9a8eb..fa0b9b38 100644
> --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> file://rules \
> file://0001-Use-old-license-description-in-pyproject.toml.patch \
> "
> -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
> +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
>
> do_prepare_build[cleandirs] += "${S}/debian"
> do_prepare_build() {
> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> new file mode 100644
> index 00000000..1aec1369
> --- /dev/null
> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> @@ -0,0 +1,43 @@
> +# This software is a part of Isar.
> +# Copyright (c) Siemens, 2025
> +#
> +# SPDX-License-Identifier: MIT
> +
> +inherit dpkg
> +
> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> +
> +S = "${WORKDIR}/git"
> +
> +DEPENDS:append:bookworm = " python3-packageurl"
> +DEPENDS:append:noble = " python3-packageurl"
> +
> +S = "${WORKDIR}/git"
> +
> +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
> +DPKG_ARCH = "all"
> +DEBIAN_BUILD_DEPENDS = "dh-python, \
> + python3-all, \
> + python3-setuptools, \
> + pybuild-plugin-pyproject, \
> + python3-packageurl, \
> + python3-debian, \
> + python3-requests, \
> + python3-zstandard, \
> + python3-license-expression, \
> + "
> +
> +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
> +
> +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
the tool is part of forky that means someone must have done a the same
work already...
> +
> +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> + file://rules \
> + file://0001-Use-old-license-description-in-pyproject.toml.patch \
> + "
> +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> +
> +do_prepare_build[cleandirs] += "${S}/debian"
> +do_prepare_build() {
> + deb_debianize
> +}
> --
> 2.55.0
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com.
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/04bc2bac7156f18bfa79cb10feb0fdb323b54a6a.camel%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/3] debsbom: update to v0.10.2
2026-09-08 6:13 ` 'Florian Bezdeka' via isar-users
@ 2026-09-08 8:10 ` 'Christoph Steiger' via isar-users
2026-09-09 5:48 ` 'MOESSBAUER, Felix' via isar-users
0 siblings, 1 reply; 7+ messages in thread
From: 'Christoph Steiger' via isar-users @ 2026-09-08 8:10 UTC (permalink / raw)
To: Florian Bezdeka, isar-users; +Cc: Felix Moessbauer
On 9/8/26 8:13 AM, Florian Bezdeka wrote:
> On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
> wrote:
>> This brings a couple of bugfixes, as well as support to read the package
>> data from a tar file.
>>
>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>> ---
>> ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
>> .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
>> 2 files changed, 44 insertions(+), 1 deletion(-)
>> rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
>> create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>>
>> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> similarity index 95%
>> rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
>> rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> index 7fc9a8eb..fa0b9b38 100644
>> --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
>> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
>> @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
>> file://rules \
>> file://0001-Use-old-license-description-in-pyproject.toml.patch \
>> "
>> -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
>> +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
>>
>> do_prepare_build[cleandirs] += "${S}/debian"
>> do_prepare_build() {
>> diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>> new file mode 100644
>> index 00000000..1aec1369
>> --- /dev/null
>> +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
>> @@ -0,0 +1,43 @@
>> +# This software is a part of Isar.
>> +# Copyright (c) Siemens, 2025
>> +#
>> +# SPDX-License-Identifier: MIT
>> +
>> +inherit dpkg
>> +
>> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
>> +
>> +S = "${WORKDIR}/git"
>> +
>> +DEPENDS:append:bookworm = " python3-packageurl"
>> +DEPENDS:append:noble = " python3-packageurl"
>> +
>> +S = "${WORKDIR}/git"
>> +
>> +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
>> +DPKG_ARCH = "all"
>> +DEBIAN_BUILD_DEPENDS = "dh-python, \
>> + python3-all, \
>> + python3-setuptools, \
>> + pybuild-plugin-pyproject, \
>> + python3-packageurl, \
>> + python3-debian, \
>> + python3-requests, \
>> + python3-zstandard, \
>> + python3-license-expression, \
>> + "
>> +
>> +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
>> +
>> +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
>
> Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
> the tool is part of forky that means someone must have done a the same
> work already...
>
There is an upstream packaging [1] which is also maintained by us.
Unfortunately debsbom is only available in trixie backports and not at
all in bookworm. When we introduced the SBOM support we needed to
package it in isar since it wasnt yet packaged upstream and it has
stayed like this since then. We will at some point probably just use the
upstream version.
[1] https://salsa.debian.org/python-team/packages/debsbom
>> +
>> +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
>> + file://rules \
>> + file://0001-Use-old-license-description-in-pyproject.toml.patch \
>> + "
>> +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
>> +
>> +do_prepare_build[cleandirs] += "${S}/debian"
>> +do_prepare_build() {
>> + deb_debianize
>> +}
>> --
>> 2.55.0
>>
>> --
>> You received this message because you are subscribed to the Google Groups "isar-users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
>> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/500c99d3-f548-4780-975d-63ee29d475cb%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/3] debsbom: update to v0.10.2
2026-09-08 8:10 ` 'Christoph Steiger' via isar-users
@ 2026-09-09 5:48 ` 'MOESSBAUER, Felix' via isar-users
0 siblings, 0 replies; 7+ messages in thread
From: 'MOESSBAUER, Felix' via isar-users @ 2026-09-09 5:48 UTC (permalink / raw)
To: Steiger, Christoph, Bezdeka, Florian, isar-users
On Tue, 2026-09-08 at 10:10 +0200, Christoph Steiger wrote:
> On 9/8/26 8:13 AM, Florian Bezdeka wrote:
> > On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
> > wrote:
> > > This brings a couple of bugfixes, as well as support to read the package
> > > data from a tar file.
> > >
> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > > ---
> > > ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
> > > .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
> > > 2 files changed, 44 insertions(+), 1 deletion(-)
> > > rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
> > > create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > >
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > similarity index 95%
> > > rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > index 7fc9a8eb..fa0b9b38 100644
> > > --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > > file://rules \
> > > file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > > "
> > > -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
> > > +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
> > >
> > > do_prepare_build[cleandirs] += "${S}/debian"
> > > do_prepare_build() {
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > new file mode 100644
> > > index 00000000..1aec1369
> > > --- /dev/null
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > @@ -0,0 +1,43 @@
> > > +# This software is a part of Isar.
> > > +# Copyright (c) Siemens, 2025
> > > +#
> > > +# SPDX-License-Identifier: MIT
> > > +
> > > +inherit dpkg
> > > +
> > > +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +DEPENDS:append:bookworm = " python3-packageurl"
> > > +DEPENDS:append:noble = " python3-packageurl"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
> > > +DPKG_ARCH = "all"
> > > +DEBIAN_BUILD_DEPENDS = "dh-python, \
> > > + python3-all, \
> > > + python3-setuptools, \
> > > + pybuild-plugin-pyproject, \
> > > + python3-packageurl, \
> > > + python3-debian, \
> > > + python3-requests, \
> > > + python3-zstandard, \
> > > + python3-license-expression, \
> > > + "
> > > +
> > > +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
> > > +
> > > +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
> >
> > Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
> > the tool is part of forky that means someone must have done a the same
> > work already...
> >
>
> There is an upstream packaging [1] which is also maintained by us.
> Unfortunately debsbom is only available in trixie backports and not at
> all in bookworm.
>
While debsbom itself is available in trixie-backports, the python3-
spdx-tools is not. By that, we can only generate CycloneDX SBOMs in a
pure Debian environment. For older targets like bookworm, we anyways
need a custom built in isar.
As the debsbom tool runs outside of the target chroot, it could also be
provided as host tool (e.g. in kas-container), or in a dedicated
(forky) chroot. The latter requires multiconfig for all targets that
want to have an SBOM generated, though.
> When we introduced the SBOM support we needed to
> package it in isar since it wasnt yet packaged upstream and it has
> stayed like this since then. We will at some point probably just use the
> upstream version.
While we could use the upstream packaging, it would significantly
increase the build time due to additional built-time dependencies
(which are optional if only supporting debsbom generate). We could
introduce build profiles in upstream to reduce the impact, but I'm not
sure if it is really worth it.
A third option would be to use Yocto's buildtools feature [2], but that
is currently not used in isar at all.
For now, I recommend to just keep the packaging as is and just update
it from time to time (only needed on generate related patches).
[2]
https://docs.yoctoproject.org/dev/ref-manual/system-requirements.html#downloading-a-pre-built-buildtools-tarball
Felix
>
> [1] https://salsa.debian.org/python-team/packages/debsbom
>
> > > +
> > > +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > > + file://rules \
> > > + file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > > + "
> > > +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> > > +
> > > +do_prepare_build[cleandirs] += "${S}/debian"
> > > +do_prepare_build() {
> > > + deb_debianize
> > > +}
> > > --
> > > 2.55.0
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com
--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/9b5e7cb996bb7a5dc0511bb0954ed46faf965621.camel%40siemens.com.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-09 5:48 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-07 12:37 [PATCH v2 0/3] Update debsbom tool 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 1/3] imager sbom: simplify invocation of " 'Felix Moessbauer' via isar-users
2026-09-07 12:37 ` [PATCH v2 2/3] debsbom: update to v0.10.2 'Felix Moessbauer' via isar-users
2026-09-08 6:13 ` 'Florian Bezdeka' via isar-users
2026-09-08 8:10 ` 'Christoph Steiger' via isar-users
2026-09-09 5:48 ` 'MOESSBAUER, Felix' via isar-users
2026-09-07 12:37 ` [PATCH v2 3/3] rootfs sbom: directly use captured apt state without extraction 'Felix Moessbauer' via isar-users
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox