Re: [PATCH v6 00/10] Add SBOM generation with debsbom

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 12.12.25 11:24, Jan Kiszka wrote:
> On 01.12.25 09:58, Felix Moessbauer wrote:
>> This patchset adds proper SBOM generation in the two standard formats
>> SPDX and CycloneDX during the rootfs generation process.
>>
>> The generation is itself is handled by a SBOM generator  `debsbom` [1]
>> which is developed as an open source project at Siemens. It is still
>> early in development, but it has enough features for what we require
>> in isar. The required dependencies which are not yet available as
>> Debian packages were minimally packaged directly in isar too.
>>
>> This is a followup of the previous RFC [2]. Since then the series has
>> changed a lot. The SBOM generation was moved from a simple OE lib to
>> `debsbom`. This also meant the introduction of a separate chroot was
>> necessary. The SBOM generation process was also moved from the image
>> step to the rootfs step, along with a lot of minor changes and
>> improvements.
>>
>> [1] https://github.com/siemens/debsbom
>> [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ
>>
>> Changes since v5:
>>
>> - fix isar-image-ci on qemuamd64-bullseye (set IMAGER_BOM according to
>>   machine changes made in image file)
>> - rebased onto next
>>
>> Changes since v4:
>>
>> - rebased onto next
>> - fix race condition on creation of ${DEPLOY_DIR_SBOM} (aka ${DEPLOY_DIR_IMAGE})
>>
>> Changes since v3:
>>
>> - fix issue on external bullseye initramfs (we now disable sbom generation
>>   on all unsupported distros rootfs instances)
>> - update debsbom to v0.4.0
>> - rebased onto next
>>
>> Changes since v2:
>>
>> - fix issues when HOST_ARCH != DISTRO_ARCH on derived distributions
>> - update debsbom to v0.3.0, which fixes the Origin: bug reported in v2
>> - generate SBOM for imager as well and create merged sbom of .wic image
>> - resend imager manifest + wic manifest patches to reduce conflicts
>>
>> Note, that the patches p1-p5 are most important as they add basic SBOM
>> support. The remaining patches address the imager + .wic bom part,
>> which also can be merged later on.
>>
>> Changes since v1:
>>
>> - remove tarball
>> - refactor packaging (auto-derive python dependencies)
>> - only build missing packages (varies on bookworm, trixie, noble)
>> - add ubuntu support
>> - only generate sboms for supported distributions (bookworm/jammy and
>>   onwards)
>> - update debsbom (includes bug fixes and more information for source
>>   packages)
>>
>>
>> Christoph Steiger (3):
>>   meta: package python libraries for SBOM generation
>>   meta: package python3-debsbom
>>   meta: add SBOM generation with debsbom
>>
>> Felix Moessbauer (7):
>>   refactor: move get_rootfs_distro from sdk into rootfs
>>   override distro vendor in SBOM on Ubuntu
>>   add support to add imager dependencies to BOM
>>   wic: create uniform manifest describing all image components
>>   qemuamd64: add IMAGER_BOM entries
>>   imager: create SBOM of IMAGER_BOM packages
>>   wic: create uniform SBOM describing all image components
>>
>>  doc/user_manual.md                            |  1 +
>>  meta-isar/conf/distro/ubuntu-common.inc       |  2 +
>>  meta-isar/conf/machine/qemuamd64.conf         |  1 +
>>  .../recipes-core/images/isar-image-ci.bb      |  1 +
>>  meta/classes/image-tools-extension.bbclass    | 29 +++++++++
>>  meta/classes/image.bbclass                    |  7 ++
>>  meta/classes/imagetypes_wic.bbclass           | 30 +++++++++
>>  meta/classes/initramfs.bbclass                |  3 +-
>>  meta/classes/rootfs.bbclass                   | 23 ++++++-
>>  meta/classes/sbom.bbclass                     | 65 +++++++++++++++++++
>>  meta/classes/sdk.bbclass                      | 10 +--
>>  .../sbom-chroot/sbom-chroot.bb                | 30 +++++++++
>>  .../python3-beartype/files/rules              |  8 +++
>>  .../python3-beartype_0.19.0.bb                | 29 +++++++++
>>  .../files/pybuild.testfiles                   |  1 +
>>  .../python3-cyclonedx-lib/files/rules         |  8 +++
>>  .../python3-cyclonedx-lib_9.1.0.bb            | 48 ++++++++++++++
>>  ...icense-description-in-pyproject.toml.patch | 28 ++++++++
>>  .../python3-debsbom/files/rules               |  8 +++
>>  .../python3-debsbom/python3-debsbom_0.4.0.bb  | 45 +++++++++++++
>>  .../python3-packageurl/files/rules            |  8 +++
>>  .../python3-packageurl_0.16.0.bb              | 33 ++++++++++
>>  .../python3-py-serializable/files/rules       |  8 +++
>>  .../python3-py-serializable_2.0.0.bb          | 38 +++++++++++
>>  .../python3-spdx-tools/files/rules            | 25 +++++++
>>  .../python3-spdx-tools_0.8.3.bb               | 46 +++++++++++++
>>  26 files changed, 524 insertions(+), 11 deletions(-)
>>  create mode 100644 meta/classes/sbom.bbclass
>>  create mode 100644 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
>>  create mode 100644 meta/recipes-support/python3-beartype/files/rules
>>  create mode 100644 meta/recipes-support/python3-beartype/python3-beartype_0.19.0.bb
>>  create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/pybuild.testfiles
>>  create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/rules
>>  create mode 100644 meta/recipes-support/python3-cyclonedx-lib/python3-cyclonedx-lib_9.1.0.bb
>>  create mode 100644 meta/recipes-support/python3-debsbom/files/0001-Use-old-license-description-in-pyproject.toml.patch
>>  create mode 100644 meta/recipes-support/python3-debsbom/files/rules
>>  create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.4.0.bb
>>  create mode 100644 meta/recipes-support/python3-packageurl/files/rules
>>  create mode 100644 meta/recipes-support/python3-packageurl/python3-packageurl_0.16.0.bb
>>  create mode 100644 meta/recipes-support/python3-py-serializable/files/rules
>>  create mode 100644 meta/recipes-support/python3-py-serializable/python3-py-serializable_2.0.0.bb
>>  create mode 100644 meta/recipes-support/python3-spdx-tools/files/rules
>>  create mode 100644 meta/recipes-support/python3-spdx-tools/python3-spdx-tools_0.8.3.bb
>>
> 
> Can we please make sbom generation opt-in for distros that require
> building the tool with all its dependencies manually? It's those extra
> package targets that are only interesting if you plan to ship, not so
> much while you are developing.

At least I now know (and practice is xenomai-images) how to opt-out:

ROOTFS_FEATURES:remove = "generate-sbom"

e.g. in your image recipe. Would still be good to flip the default.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/3a94e788-0998-47f8-a200-c8e2af99b002%40siemens.com.