From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 19 Nov 2025 16:55:20 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-qt1-f190.google.com (mail-qt1-f190.google.com [209.85.160.190]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 5AJFtIBS004715 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 19 Nov 2025 16:55:19 +0100 Received: by mail-qt1-f190.google.com with SMTP id d75a77b69052e-4ed83a05863sf25543911cf.2 for ; Wed, 19 Nov 2025 07:55:18 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1763567713; cv=pass; d=google.com; s=arc-20240605; b=jky7l3BDVV0L9As63HkvXdLx9MpT3x2hY7kgC5ZtW0+/8VsmXfdAG6ukdf1WV1Bphr VdWj73xi3nBQSlXaXPSwaAmVOh/t58etmrTR0kvV2wgEeuhAxwWona3eNRNAG7ix09PC QtAXF+WxcifZsGDrlbrabyq5v0mNuW68Qv3zLsZKE4bWTXR2lB+Y6yrbvTMJXl3I6FpE 9YGkYA69w3C73YLtYJcJ2Mnuu+cs9BSDqXY6ZL6+CdH36rlIE/YUpWkIVknVeUS88T1E YofsPZiLC2kske08JfJDrW74p3Jv6XhjSW4MppacoxI2/Y5rm+8gon40WHMrKuvLmTIQ 8W6w== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:in-reply-to :autocrypt:cc:content-language:from:references:to:subject:user-agent :date:message-id:dkim-signature; bh=AxrVmmPsPajBnAVhC0JvFKroCYrnh+GeprmBzteTWp4=; fh=IR+xNst5U9ZnxJwuAt7X7bFHYgBXWI9ih4ylyb1bi5Y=; b=Bf3AlRtloWnu4EIQzzkeOI/+Px7tPseOxHl/yg4AusquUTY/wZ3WjvFKm7qsglyeV2 6nZmRD0Oikw2i9/BbKiPukkhmOQQerQYXxwUS5HEllqebOhjtOMWvqjyo4CBijw09iqB EJLZzCvHcAmFbugGkmCPUrFz1dJixbJ37pt3w9w5ddSf6nCgMsYIjnm9UDdUCKqPF1wQ Z+uke9rUO3uJXrKIY1+ZEgg3P/kweof7IUDLe5kSMjjAFDb70VZ/axzgLgz3AiNVnDSV nUytNuqyuzniwbOp2LaHrIYIaanvVN209RtVs2gO24VTUTFad9VSIAayR2t+1V+ksZnr x3vg==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=KExz7YUc; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of quirin.gylstorff@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=quirin.gylstorff@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1763567713; x=1764172513; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :in-reply-to:autocrypt:cc:content-language:from:references:to :subject:user-agent:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=AxrVmmPsPajBnAVhC0JvFKroCYrnh+GeprmBzteTWp4=; b=tSDxbX+wPANffhAutjRlSqliXpaeoNCNgu3n5CrjfszjZV9TPfADNVmP4Qr8vv+7h7 uJbUqHE7bjtPub3r1kk47BEnEKF5kl3LUsDHX1BfTWbAHAIBr1GCvqplIi9H7DA+q9Yj nXO59jrbaNlce2U5y2JR5WoEAq1BLzlSbC+h0yoq7wy2hm7tUKXAgjgeVkUj4519aOCA l7AaprL+ptqK6kiHrlWC5ZmBEpaRPxV78Ecy5tlmTsu+D1FL/Bn+XU2/p/T1Y1U8DRSm d7+NfGSrl8FPYCownsntg1FxHfz8sMViAo23TBK0/D00TxIPe1+Ez/LTe40ARz8Jj8KN B39g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763567713; x=1764172513; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :in-reply-to:autocrypt:cc:content-language:from:references:to :subject:user-agent:date:message-id:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=AxrVmmPsPajBnAVhC0JvFKroCYrnh+GeprmBzteTWp4=; b=fNXxek8ZWjOOBLOanrLd87AOXbQE58DWFSF0ucXOyPGb7Lpt3HMtQicU/6dvhc/fRL MGvf5RpiozQuM3mhEWlbLe2OttKD1DLfKUrRXS17j68IMZdTQWTAgKK/Qnx5WLHsvWoq k/SjO1mCdR2pJROenRNmD7AHNbUBWBmAvaWjipxxbyM6tDvUFO1kXSMhr5C3FeWHHVJY C/SiLzxjI7bqhTlnQhWQyf8Fsble+hkcH2Rpp8d0EuIn8eXayz/f0DqqgNvZ7dLKg35X thGFqg9L7bECrXiDY84bHkjj8LDaVX+rNFVMoG8K/0zyTwrUJp0yQ3IJEMUgdyFwbzai NP9g== X-Forwarded-Encrypted: i=3; AJvYcCUwspfbjhFAsImteGnWYVd/YLHKUQ/d68UtYxA7QUhdEcOO6W2jF+BTyfKYFzQf63bosEuS@ilbers.de X-Gm-Message-State: AOJu0YyXvC5COLND84VLfrgHs/IWr/iiHiVkoH57/3m/EDeZ8dq4iT7O Lu4v6hXjV5tE0t/fqjZ4PzPujKuri/9qdHjEJxjlYgmVcRnmNwKWH9Qt X-Google-Smtp-Source: AGHT+IERKYJFX/FF5Qr+YKXJX2KG5csFb8ALG8/Om/69H7fz7SN3npDNbyhDVFbBpaLd4Q2h52PJQQ== X-Received: by 2002:a05:622a:24a:b0:4e8:a001:226d with SMTP id d75a77b69052e-4ee317b3acemr69971251cf.7.1763567712364; Wed, 19 Nov 2025 07:55:12 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="Ae8XA+ZwijUmC2ikvZxh5msCqqUphvUTZ7kOToYsxdj8Epcdig==" Received: by 2002:ac8:5751:0:b0:4ed:9424:fa31 with SMTP id d75a77b69052e-4ede6cd50b0ls38168551cf.2.-pod-prod-01-us; Wed, 19 Nov 2025 07:55:11 -0800 (PST) X-Received: by 2002:a05:622a:a941:b0:4ee:4709:8515 with SMTP id d75a77b69052e-4ee47099b10mr9506171cf.50.1763567711018; Wed, 19 Nov 2025 07:55:11 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1763567711; cv=pass; d=google.com; s=arc-20240605; b=LWRyVhX0x25iXhYtbhmJh1DC38QVWluTN7K33cG36plchiT/gX2e67pdQwkfDqlizf MLp9Zm+CZUZEttAM7yMtGuapnyclgVBZCzUrCwvaF5YMRc1oqRmLNgVasD57QpoXOO1T OsBSsJb6ey18KmhWO/O+wz4yx7HrP8ut6H/D9rzpqFQ0Vsk7hlurIOfj4yFei0q6LAfi W9LzZ2cSD7oL9Z8Qmuukq+wl3DLQGTgYScACKLnp521colPm5qeUUitzL2Z8mRyrDLrI SKROx6iwj+lUP2tdvTP40ux+/qzn/UePLXJGMTT0jCmWTyEPyX+JSeOFIhvPWJCK3iv6 U74Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:in-reply-to:autocrypt:cc :content-language:from:references:to:subject:user-agent:date :message-id:dkim-signature; bh=tc9BW1HNG1InijuqbTv1JC3XM7Iscyt00Z5twK8Fwww=; fh=y4Q4sSo60XIDMfQl4kOzeqW/gQkja1RlhaZM6hZs/O8=; b=C1ZQnkRjXHp92Y45m6kh5nx8CuxZW2jWBXid4yw7VnQUX9Dt33axNbbSUjEAsnUBAc tbWJIeOrJTmhFgvXHq2hcu5dEZNtEJ2h1B8RO9cDitmirre9DICF9F+O0ld+E4h9IQTK maYavD9Of6oaSIR13kpTWd6y77sTittDIvmUC/nr/IuI4wpi+o6vPXg3gQ/vno0hiSKU kVxnhA6hxGygK8KsWON/H1eoeeH441a9mQj7IqxNQCcFAxnKZnZYG2XJ8nGM3jqhcmb1 hLNji3wFwCTnHbXSV8oTtV6VJggvwNT6Cl86v9txqVd8VECYpA5lsZ665b9I/9npnrr9 KoPw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=KExz7YUc; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of quirin.gylstorff@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=quirin.gylstorff@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c20f::7]) by gmr-mx.google.com with ESMTPS id d75a77b69052e-4ee21b1cf6fsi4441881cf.0.2025.11.19.07.55.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Nov 2025 07:55:10 -0800 (PST) Received-SPF: pass (google.com: domain of quirin.gylstorff@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) client-ip=2a01:111:f403:c20f::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DfmoedG6Fhy79CBGnz6AhqWT3EPfGdSmnUokqRPjwDq0Kl5eJFIhJhllTymbUjk1AM8vLkbOINr2hq36CiwW6M/wie/7gxLH3Sri1O9LQQu+APIVQw+6OkciL2QtgX7FPguu2sUQNwtnM6kJXgDzk/CmQD50bSlliBt/jlPZoqFkh0oGZye7voF/bXqnpHHVbZWadrvvhUEGnsy7+F5Rcg7cWp7VfNjUIvWrL+utP+5YINCQM9UoYUto6QRk7y2qdppywQx7yK+NOGtOdAARrMw+b/IEvId+KiMiMYpQnnLYVkT2iKvwSFUg6NjJTvSMEs2F6WsxTodm7KDlD7VHnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tc9BW1HNG1InijuqbTv1JC3XM7Iscyt00Z5twK8Fwww=; b=VrLhF/uk0TocNBFiXN/GyPx1zQzOsnWR761xgLuIgyqTg6nzDygY93srUI0dDLY8rTwvagL2Bk0Ha5pn+02i69Z4no0Qmz9b13dtBoTpEFkiVEg7LFHWOuiA23kD9DyLNExg+RChVRu5DITJRSQouWHIElOpf8XTgg8LjYkxB8V/kGFOGPlapqIqk1zDlTFHzDj0RcumOUuw5Je6qDmhPfbEIfBTBfCtqBEgyEVOKnoCwSKKQVcjZdjAmwurz5Af1ZKoYlLKSLZkoPavQrkBnYNhVJFsd4krRBidwoCN5yXuxmWo6NxDEr70rsGXIYH+d8BSytUHkb7SMNVNFraOow== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:1c7::15) by PA1PR10MB8501.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:445::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9298.16; Wed, 19 Nov 2025 15:54:21 +0000 Received: from VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM ([fe80::c496:3783:a660:9769]) by VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM ([fe80::c496:3783:a660:9769%4]) with mapi id 15.20.9343.009; Wed, 19 Nov 2025 15:54:21 +0000 Message-ID: <3e82b347-3151-414f-9eb8-dd63108294f7@siemens.com> Date: Wed, 19 Nov 2025 16:54:20 +0100 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v4 04/10] meta: add SBOM generation with debsbom To: isar-users@googlegroups.com References: <20251117132436.511686-1-felix.moessbauer@siemens.com> <20251117132436.511686-5-felix.moessbauer@siemens.com> From: "'Quirin Gylstorff' via isar-users" Content-Language: en-US Cc: Felix Moessbauer Autocrypt: addr=quirin.gylstorff@siemens.com; keydata= xsFNBGhxJPIBEADH6a6idt3FEJo4DFxeRRX2ZUHJjOSPTpBN4vK2FbvDJjBVLs1/xzNpOE/N CxDcH0nd4BApJeGzxjJpsHW9gm9w80oIG2HAZl4es79JdRt6H5GTdFaux1J8tLVTCS3bzeuu ydAUTesliWxSiEb4vqpmcduI42edmJF9E43jjLXDyJcXJa0qYXA0qvChJr7gbkGmWc7iR8A5 ZX1CrJJbwUBtzXGGThDPycgPYB1eR9OcFWJ2E6dBcLQiNxyOvxfpTKf09eZi2hBrZESpjMKo U/t9LX9SbyRwzpIeXQe8LQgyhppENmGSjc+Lm0YIreIU4ODbt1takxHTIpin1Po7lFiDMQmW aZrfNFKNQoffVyHq1gpV5BGIbnm8yJixpEueL2oygnN/evyNPQV7NzSoQaJy2lJRGjo4YrQy dfpJyaajNeO1njSttdWC30q28ZUorPzBPfLwt7B/BXyiMiY6/SZunfKQDAY+g835YTjEhBgl KtXEamOfypEvYfvzQUpLrFgK55yrDSndtNm71APD4oVNeV1I0KqbuBQk4o3TkR6ZYb4RLp9O dKGEnKCBaBaWJgf/1v4BLJ/ge8k135R1JLiyK/FylJbnsABE9k7/lELFKrwW22qgspkQAf13 h2+T65+637hkxhGRYnrtmxjOUk4EbYbAA+rtj0mpBxnziWojQQARAQABzS9RdWlyaW4gR3ls c3RvcmZmIDxxdWlyaW4uZ3lsc3RvcmZmQHNpZW1lbnMuY29tPsLBkQQTAQoAOwIbAwULCQgH AgYVCgkICwIEFgIDAQIeAQIXgBYhBBvkezJSXuvL6yeVgtxQXbgz0zl1BQJocSb5AhkBAAoJ ENxQXbgz0zl1vv8QAMVze9Jevd0Qe9iYY64RX1rQfGv0xI094u9+4fOsIOXUjX70cbRgOZzk muPuEj96pBh77vGWb19dyWmzlRL0tTGg4ACcbHXgy93l6HaUTlVLUFpEKx1ufo2StSPPZ1i9 4PBTfnyAhQqYH6dibaFpCHvhrNvLIidA/C3qBx2b5k7H9k/Hta/lhNPkJTSqLnUl2sU36ihb QFGvEOUnJjFVo7eUBDNjEDGXETfI2tfHuER7GxZZINFpzf1mnvgobaai0pt26XUrt0cdONGR slIv6hEQ4BcyuYEN5wZz68eMMQtaTXRoCGYPYpTEYu23BKYTPebIUAbM+CiEVHTkH2TSeDwM kc25z0ydFbA2D8I8J+atdBsmHlGCq1gMnSMZ/TtOrlL6OHFoVlaq95Z55a5cq72DF1BQBk1t jaPgiI3Frzn/ZLFfldakTbkd2vsZjBJEkcUtnc+Rm7x1Sn3X855zJmvYRzdLAPMsi/zVMsy6 tvoIcJozan1CQE/vC1S5V8BXoE0PRointtfTxPDuX2//sSzlRgBVWIQJHuQ0asb+gzptVZT+ naNdi+fexKfoSv6bxbsG2Bg7Pm3OZNASmaUodGNixZ3/y/VdzvvSaPPULYPuUCdZrTtX4wML ae1/UjUw7jUoEXOalGior+tSEUpvhfa9y8kzJswmtZW90lFYNuCtzsFNBGhxJPIBEACi38/X QWBviWYBLlk2czd15VQFpsfYFKzgO010e300DAL1D+CWatD7yiEK30m3vvHkOkyHaOz/DB18 ksr1czcbQLYSpdC4JKlsUu75tf9EI32QBPRMms7mJ+qewti4xj1sjrBpuczzLC0CG+dkxTD2 38AbgGW3m/o8zBsPGhVnJlRVGsYU/YiYxaE6MC/l5bzmb0ay58ySnSS32zALKBfXGpWmk1td KbcHNeEBuZu2W3ZYB5cTkDEE/3ycnWwqWh5u24SSLC/83rIeAjeyJ/wQ9+oSIHLlcl296sqM 1wYKVCjwAXfA7vcEBsANUFL6NkdP+Y+HJPRT/EODKZsjqWjoi/5v5GKBLrScLxA9cpjTCYMj +1slg6T9FgUMQ+7GtbGI+/3WA/8ZE8emq4EweLzYT7I6hLB/dnoqRZFmRkLZ8q81r3Oc+xIc PJEnEpQIN/Ky0YelyPY4j+GH+NOlLvv9pH16I46O5PsTCkyhcfgfYUOJgP1BRQrnRmVn6586 R86jfLLhtaagvg4Mb4NtR+ZAO8rF8xmrEv5q0YZBkRmMlRENwHWiCyvDzU7mTsyYvVweGgdL bak4VTz/Bm2kvnJyHAWOhWJk6BAgmQhM1c0eYG/vmyhS6O+omYIyDJFVp0ui71CazCFn7dDI +uzg6o6fHygmWDn43e4mu3WKEXCajwARAQABwsF8BBgBCgAmFiEEG+R7MlJe68vrJ5WC3FBd uDPTOXUFAmhxJPICGwwFCQPCZwAACgkQ3FBduDPTOXXrfw//Rc/CskZYHeM06zTK0NQKTt3+ hgME6rUQh9y4iDF1KjEvmVDGyDma8AQ45WNP5EbWgMFWGtlTYwn3CbFuYlDLMtCYHkth1itN SoUdOttJkQ5ULq8DW+MFrP4xlG0zAx+CWeug6VhujVBro9xK57zgYs+LsCK3nlsYR91ZtZ8E 73Bi58iGZL/DLRFws5ut9hGUE0HoxXAhUZ6de0QxXNmfApzK+rLUye+JYcEVWEfVCCofFy8X lk+r2OzCvMt43xu9OgV1Pg37ez4HVu+ZoPJ94NKteQr9QMR9PIOBXGlOuweKiR1IcYBjQHzL aptU47KTf+lJxZhy8H3l1ySuyQqxbFoPNUuAT9Fu2s7Mg7QzjLVkoIrkZ+YJ+CmgvZT4sPZe YAMMbi+ENwLUg7aYqCy1RHcit2jeoEMyJJ9PFcsbxcqIPaCG3xOurgMdwlGeGdaxSFvq1T4V Z50bOHQvqT4TbOxbxv8RLLtaNfIvudV3J+Xx3QyKY1sySFcCtCB/b4zoKqc73B5B0nXBw931 qIxmFqiZiwfFB91OCCqRFtm2LcfwR1fLrUtSrhmENjdBhZljfJKjxAfFOWXngfT10Sin9h20 4A7NrVMzatAJLl79L0PdJIVpGUDQHU9K7rIs2MoQKzmAvyUSJB4sAChft5wz7JbvFKqY2fW4 Z2NBPBZUysw= In-Reply-To: <20251117132436.511686-5-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-ClientProxiedBy: FR3P281CA0150.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:95::19) To VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:1c7::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI1PR10MB7856:EE_|PA1PR10MB8501:EE_ X-MS-Office365-Filtering-Correlation-Id: e2517945-be00-4f87-6ea0-08de2783e7b0 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|366016; X-Microsoft-Antispam-Message-Info: =?utf-8?B?V2V3ZGp1cUNqWGVZOUZqRGNJR3hiSDRqRlRhVVRNZis0QXl2dUtEckhtRity?= =?utf-8?B?UG5wV3pXMkRvSVhTc0lWS3RMQmNESG8zaGlFVVZEVGNVbVFZUDd2c2JXcXQ0?= =?utf-8?B?WGNBN3J0Vis2b2gyUEwveENkVzJuK1crLzEreUxnQlhGN2hmckNoemh3aDVk?= =?utf-8?B?Tnk3cWF3Y0wvUmdGelA0TFlLRjBscFViWkIyNXFKTDYybFJIK1doZDRHTEdq?= =?utf-8?B?RVZFVVIwWHpsYng3UmdsU2lnaEptTGRMSS9VZFV1QVZoSXJFSndTSFRYaGNB?= =?utf-8?B?Z1VqcHp6OVh4ZWZjMDVKeGxyOXZ6YU8zQkY4eXBmYUpBQ1BrYXhRUjZxRi9F?= =?utf-8?B?d0o5WlplWDF5YW52KzFSR2VHOUh3S21UaXd2WWd6YWc5Z3JHTUVSRDRkKzha?= =?utf-8?B?S1VreG92alpOLzdJSXhiMHJXd0lrQ3JIREc3TTI0aVduUWl1WVhVRTROQXo1?= =?utf-8?B?ZU1RSlZhR3FUeVpqR3J2aUV1RlZTT3dMSEVFTTJkeHNEN2NwSmZyRGFNVmFS?= =?utf-8?B?SnQ0cWw1OWx5cnNYRDhwSFUyZ21LM2NEN2NXalBhYjMrQUhWeTAwcnVjMU1m?= =?utf-8?B?ZjJMMDFGYVBlcUlnMklmcW1nNzljcnZGbEU4dnYrenh4enczUHJVZWN3d1FI?= =?utf-8?B?MGRBaldFVFZya1I3YkZ5Q01yeUtJK05IaTNnT3YvMTJTNFNVb1pqTHMrMEcr?= =?utf-8?B?TU5KRlZGajFvSUs5amNtVWZTUzZZcy95WkdMN1RHTU9laWVwb2huSldBcW9n?= =?utf-8?B?SGdrZGxBbFh5VVh1UklQeGI4TWp2MlU2Z3Q5Ulcyak5lQmFrdHMxMXZRQ282?= =?utf-8?B?L25tSmFOMUtvU0FESVY1aTVSYkVHdWNZVFI3QWU1ZWgyQmlvVjVMRXNOVXcv?= =?utf-8?B?R3F4OG5Kd2ZIMFlDT0ZEQms2UDJWR1czeXZ0bk9RUEVkNWs1Y0N4TW9QYnA1?= =?utf-8?B?R0ZGS3h4Wkd3TVFxUUFDTVpoZ0g4UkJuQlZXWGF1UXBhVGJWR2RWMnlnSTlM?= =?utf-8?B?SG9JTE92SXVBY0NNQVV6SjY2cTlkTGY0TjFnWFgzRFlNblV5UjFCN0tERGpW?= =?utf-8?B?SldKcXQyT2tYdDRPU0VrM1V0T0dHV0ZzbUpmTUNBZ0hETjMwZ08wWHNVcUZB?= =?utf-8?B?WWlqWVkza3hra1dVdWRzOHo3Y2x2Tm9aYlRISUxjZnRxcDRWUlp6Lzk2emh4?= =?utf-8?B?MnVmRWovUEJjZm5yMU1SUlJwakdsMUFMTHVZVFBDNnliV2JjdVB1azgrUndC?= =?utf-8?B?MjJBazh5S205VVJEbSt3SDczNEYrK0tBWElBSWhiM0s3Z3RibGpPUG1ja2dW?= =?utf-8?B?SUJFLzRvL2VyK2IybWsyMTJSdVhJSThrVGNHVVU0N2U2MjZVOUcxQ0Z1SjAz?= =?utf-8?B?V3JjNis1Vk4za3ZzamUvaE9CSGVHWDA1WHpsR0VKS3hqL0I4a0svOE1FY0R1?= =?utf-8?B?S1p5eWJHdGl2ank3YXEzQ0t3MWQySlZ6MzErZGpDMW56dXh5TXhGRUlLeVk2?= =?utf-8?B?Y2o3ZGQra2d5N0hlUzlJUzdyemtxUWJwSW0vSEM4bDkvZUxuNDJaU1BDTFpx?= =?utf-8?B?ZHE1TWpacXEyWWNRdHVXRmxpa002RFRETkZLelJxR0pnNEozSldhWTdSdFFp?= =?utf-8?B?U0NYTDdIZFp3dU1ULy9rTEcxWHBKZmF5dk1BSC9VakNLOUNpdWdYNC8rYUJN?= =?utf-8?B?RTBUeFVlUWhsQWM4b3J0TTZvODlYZlpKemVHenZ5UmRZYUwrZWVsSUZPRzAx?= =?utf-8?B?VTlrSDFiL0hoeWhSS1NzdU1TQTl2cklJM2xaVkxYVVdVZ01leWcxTmwwR3c5?= =?utf-8?B?SzZ6eFFTaWE0WkZScG9xSkQ4TkJsUHg3U2lYRTBSQjg2b1F0UzQ2ek5LVkN0?= =?utf-8?B?ZDJnaXpyRjBpWFlROStHMFpxRndMY0twSVFudzJGRmhlMmc9PQ==?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ajEyM1NXS1RPUlZ4MmsrVHZaeFNaU0MycXFNLzQwd2NYZVRRRjlSV1MwQXor?= =?utf-8?B?SENhblNEREVJM1Yxd3d2L0NoREhpUTcycU1QSzNURDFQeHVWSURjYnFFREZF?= =?utf-8?B?NGxoR1B2bFMzUWVTWGUvMklUYTIxQ1NjUnhzRkpReTVFMGRManpuTGIwVmR1?= =?utf-8?B?ODdQbEFTOHoyL05mYk8zU0pTZFJxOElleUxGY2U4bFU4NFJJQTE5UWtHY0Zo?= =?utf-8?B?bUhqdmhhWTJrSTRUeTl0Yjg5R01Ma21EZUU3Y0o4Ky9BUlppbll1Y2ZjTUd5?= =?utf-8?B?VkREbjVWSlhMNGFDUWpoN3hVWDB6UnFhZzB0dWFMLzZrTnNMZTZDZExDOThk?= =?utf-8?B?VVR4cjRGd3Q4VWYvYTBOMEpIcVZyWElDNjROVjF6czJqM3dRdVduOTllK3kz?= =?utf-8?B?cFE3dFVpYTdwOW9VRjk5U1hzdXp3bzU1RGJCSDJpUFlkSk11NkNNV3BFSE5v?= =?utf-8?B?cjEwbnpvZEtRVXRJR2k0SGtmR1p5d3ByRVZoSU1BdG9zZjFFU3pWUFNlRzNN?= =?utf-8?B?R3FOYkJ2dXBvenY0M0dWSnpkWWNKR2YzQndGV2N0NTduVWpmSk5ESkpYWW5U?= =?utf-8?B?bjQ0aWpOYTV1RmVYTzFsNnc3ZGJFT3dETVNka2VweWw0N3R6dEZ5Tm5Edzhr?= =?utf-8?B?WExLcy96eHNmVnNZdFRDTzlTb3BSTHM5emJYeDg2TlFSUGJNWXhpLzBPSVlE?= =?utf-8?B?aEt2bWE1cXRURjVueDMwcFlpaVkvL294eFRvV0lhZlEvOEMyQVQ0bTd2TGl1?= =?utf-8?B?ekV2SHcxazYwcXRKYlpOSmN5Q1pHZ0lpUzQ0WGtVSVUydVczLy91MUJzRndP?= =?utf-8?B?K2xvZFBKTEU1cFltZmphclhEN2hjSW5yeExHcm9oWW9WNmhib1Qzb01pOTBV?= =?utf-8?B?a2RHWU5JUk1MS0JhOTZiaWErSEkyT09kc2FVV2prdGhNcndJWHI5czNLT0sx?= =?utf-8?B?Y1I2Q0tnUEYyVTNwRmdBWGZLakJjVGxJV1hiaXFTTVBLeUR0YklxVDlLL1Yy?= =?utf-8?B?TU5lU3loT2ZzZXNTSjhHQXJhTUhKRG1QZlhUcnJwZ3IyYWNJUG5KU3c5dUxH?= =?utf-8?B?bS9TcmlZdXFvanAwaUpLZEcwa0FScU5SckN6Z1M3eFJFRjNiend4NDNHaVRO?= =?utf-8?B?ZnBLSlA4UnNWdXE1R2E4M3JLbDU0ZWw1YjF4Nm1SMzUxODhZN09PaUw0ZnNN?= =?utf-8?B?M1ZBNmhOSnYzV0UvU2hUenk4K1ZUVFpDZXhrVUtzZVV4YjhIaTZPV2dsOHdY?= =?utf-8?B?cHMvY0FFSkpOSFRwSUk4TXpUaEh3b2JRUVdmdEtCVFB4Y3dFRnhuVStndjhL?= =?utf-8?B?S3dnVVJPNTg4R3hjamVOcFY3djNEN2hwcWxHS1d4VXlnc2dNMENuK3FTaTEy?= =?utf-8?B?S2t3UUNUTFlTdWlNaS85d09pTkJxUGdKSDR1M0RPVVorMmRDaUhsaDdhbDZU?= =?utf-8?B?SlRDTFppUTN5NHF2RFBOdTdmZ1ltZER5NUVEODBYTFUzTSs5ZFhBY0VicEtw?= =?utf-8?B?b01ldGNBRzZ5RzBSaVRGYXQwa2dNSjJzVXFjUXVlYytSQ0t3SFg3SVRCemtw?= =?utf-8?B?aTE5NVBTVTg3akN4b0ZzT0cwRnJvNGprbHFmT1BHRi9sRCtsUUk4cEU4eHNS?= =?utf-8?B?OGYvVWN5Tmh5blNLcktieHVPSjJIbW9PNCtxZmNDdGg3TXplU0VVL1RkZXpX?= =?utf-8?B?UWJ2YXY3WE9yTkovMGllYUp3WFhaOGpYeXN4bG1oM0duREtJdFh1ZlZsM0dC?= =?utf-8?B?TS81YmhscFJCSWFRZUlVd1lQN1d2R09iZDdrK0FhSk1wQXlWMXdadjNiN1ZD?= =?utf-8?B?Wi9tTng0NU1VdmZwUHBRN3Exd1FCa1F4SVphRmM0eHoyNWxCc2tRUDllSVE1?= =?utf-8?B?MG5md2tuQ2t0UDZGcG9WQ1ptT2JFNTRJc2JRb3VXUk14YUZvZEl6TEw3NXho?= =?utf-8?B?aFJkRE45T3Q3MWZhNzZNWFlPRUgxRnVhaXFDOXVNTml1K0VtTmFsNnlDNHJS?= =?utf-8?B?MmlKSUxPNmhYYnRoNXF4dHJsM1JsdkY5dUlmeDl1S1dUSEVHV0cvZW93SXZF?= =?utf-8?B?QXhKREpycC9iTVNKVUJIdW1mS3grc1Vac29qbzBLYzh6VHNiQVdBellqc0wz?= =?utf-8?B?UzdMaFF5ZlcrQzVtMVRESGU4R0NON28vL1ZKK3FIdmY1UG5YSG9QT1NITk1m?= =?utf-8?B?NWc9PQ==?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: e2517945-be00-4f87-6ea0-08de2783e7b0 X-MS-Exchange-CrossTenant-AuthSource: VI1PR10MB7856.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Nov 2025 15:54:21.6140 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: K4so5UiRoD9meFNvNXgwmdvevkO9Qb3v/PW12qSt2Pw+NApUEHASWBDfFpykhCnxuDfZPcmWsvqjuzT9pOq6ImCs9EVeAOWhd1OSgTiVmKw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1PR10MB8501 X-Original-Sender: quirin.gylstorff@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=KExz7YUc; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of quirin.gylstorff@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=quirin.gylstorff@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Quirin Gylstorff Reply-To: Quirin Gylstorff Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: heQ/W+qZ8re/ On 11/17/25 14:24, 'Felix Moessbauer' via isar-users wrote: > From: Christoph Steiger > > Generate SBOMs for every rootfs that is created. These SBOMs are placed > in the image deploy directory. > > For the generation a small chroot with debsbom installed is created and > from that the rootfs of the image is scanned. > > The sbom generation is bound to the rootfs feature `generate-sbom` > which is activated per default now. > > Signed-off-by: Christoph Steiger > Signed-off-by: Felix Moessbauer > --- > meta/classes/image.bbclass | 1 + > meta/classes/initramfs.bbclass | 3 +- > meta/classes/rootfs.bbclass | 14 +++- > meta/classes/sbom.bbclass | 64 +++++++++++++++++++ > meta/classes/sdk.bbclass | 2 +- > .../sbom-chroot/sbom-chroot.bb | 30 +++++++++ > 6 files changed, 111 insertions(+), 3 deletions(-) > create mode 100644 meta/classes/sbom.bbclass > create mode 100644 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb > > diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass > index 1fa71c17..29324920 100644 > --- a/meta/classes/image.bbclass > +++ b/meta/classes/image.bbclass > @@ -99,6 +99,7 @@ ROOTFS_FEATURES += "\ > clean-log-files \ > clean-debconf-cache \ > populate-systemd-preset \ > + generate-sbom \ > " > ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${@isar_multiarch_packages('IMAGE_INSTALL', d)}" > ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" > diff --git a/meta/classes/initramfs.bbclass b/meta/classes/initramfs.bbclass > index 862bd873..570780e1 100644 > --- a/meta/classes/initramfs.bbclass > +++ b/meta/classes/initramfs.bbclass > @@ -22,11 +22,12 @@ INITRAMFS_FULLNAME = "${PN}-${DISTRO}-${MACHINE}" > # Bill-of-material > ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_IMAGE}" > ROOTFS_PACKAGE_SUFFIX = "${INITRAMFS_FULLNAME}" > +SBOM_DISTRO_NAME:append = "-initramfs" > > DEPENDS += "${INITRAMFS_INSTALL}" > > ROOTFSDIR = "${INITRAMFS_ROOTFS}" > -ROOTFS_FEATURES = "generate-manifest" > +ROOTFS_FEATURES = "generate-manifest generate-sbom" > ROOTFS_PACKAGES = "${INITRAMFS_GENERATOR_PKG} ${INITRAMFS_PREINSTALL} ${INITRAMFS_INSTALL}" > > # validate if have incompatible packages in the installation list > diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass > index c045bfc0..b3ca9e16 100644 > --- a/meta/classes/rootfs.bbclass > +++ b/meta/classes/rootfs.bbclass > @@ -3,6 +3,8 @@ > > inherit deb-dl-dir > > +inherit sbom > + > ROOTFS_ARCH ?= "${DISTRO_ARCH}" > ROOTFS_DISTRO ?= "${DISTRO}" > > @@ -28,11 +30,18 @@ INITRD_IMAGE ?= "" > # available features are: > # 'clean-package-cache' - delete package cache from rootfs > # 'generate-manifest' - generate a package manifest of the rootfs into ${ROOTFS_MANIFEST_DEPLOY_DIR} > +# 'generate-sbom' - generate a SBOM of the rootfs into ${DEPLOY_DIR_SBOM} > # 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR} > # 'clean-log-files' - delete log files that are not owned by packages > # 'populate-systemd-preset' - enable systemd units according to systemd presets > + > # 'generate-initrd' - generate debian default initrd > ROOTFS_FEATURES += "${@ 'generate-initrd' if d.getVar('INITRD_IMAGE') == '' else ''}" > +# only supported from bookworm / jammy on > +ROOTFS_FEATURES:remove:buster = "generate-sbom" > +ROOTFS_FEATURES:remove:bullseye = "generate-sbom" > +ROOTFS_FEATURES:remove:jammy = "generate-sbom" > +ROOTFS_FEATURES:remove:focal = "generate-sbom" > > ROOTFS_APT_ARGS="install --yes -o Debug::pkgProblemResolver=yes" > > @@ -478,6 +487,9 @@ cache_dbg_pkgs() { > fi > } > > +# The sbom generator needs the apt-cache, hence run before cleaning it > +ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'do_generate_sbom', '', d)}" > + > ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-package-cache', 'rootfs_postprocess_clean_package_cache', '', d)}" > rootfs_postprocess_clean_package_cache() { > sudo -E chroot '${ROOTFSDIR}' \ > @@ -647,7 +659,7 @@ python do_rootfs() { > } > addtask rootfs before do_build > > -do_rootfs_postprocess[depends] = "base-apt:do_cache isar-apt:do_cache_config" > +do_rootfs_postprocess[depends] = "base-apt:do_cache isar-apt:do_cache_config ${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'sbom-chroot:do_sbomchroot_deploy', '', d)}" > > SSTATETASKS += "do_rootfs_install" > SSTATECREATEFUNCS += "rootfs_install_sstate_prepare" > diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass > new file mode 100644 > index 00000000..fd41296c > --- /dev/null > +++ b/meta/classes/sbom.bbclass > @@ -0,0 +1,64 @@ > +# This software is a part of ISAR. > +# Copyright (C) 2025 Siemens > +# > +# SPDX-License-Identifier: MIT > + > +# sbom type to generate, accepted are "cdx" or "spdx" > +SBOM_TYPES ?= "spdx cdx" > + > +SBOM_DEBSBOM_TYPE_ARGS = "${@"-t " + " -t ".join(d.getVar("SBOM_TYPES").split())}" > + > +# general user variables > +SBOM_DISTRO_SUPPLIER ?= "ISAR" > +SBOM_DISTRO_NAME ?= "ISAR-Debian-GNU-Linux" > +SBOM_DISTRO_VERSION ?= "1" > +SBOM_DISTRO_SUMMARY ?= "Linux distribution built with ISAR" > +SBOM_BASE_DISTRO_VENDOR ??= "debian" > +SBOM_DOCUMENT_UUID ?= "" > + > +# SPDX specific user variables > +SBOM_SPDX_NAMESPACE_PREFIX ?= "https://spdx.org/spdxdocs" > + > +DEPLOY_DIR_SBOM = "${DEPLOY_DIR_IMAGE}" > + > +SBOM_DIR = "${DEPLOY_DIR}/sbom" > +SBOM_CHROOT = "${SBOM_DIR}/sbom-chroot" > + > +# adapted from the isar-cip-core image_uuid.bbclass > +def generate_document_uuid(d, warn_not_repr=True): > + import uuid > + > + base_hash = d.getVar("BB_TASKHASH") > + if base_hash is None: > + if warn_not_repr: > + bb.warn("no BB_TASKHASH available, SBOM UUID is not reproducible") > + return uuid.uuid4() > + return str(uuid.UUID(base_hash[:32], version=4)) > + > +def sbom_doc_uuid(d): > + if not d.getVar("SBOM_DOCUMENT_UUID"): > + d.setVar("SBOM_DOCUMENT_UUID", generate_document_uuid(d)) > + > +generate_sbom() { > + sudo mkdir -p ${SBOM_CHROOT}/mnt/rootfs ${SBOM_CHROOT}/mnt/deploy-dir > + > + TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH}) > + bwrap \ > + --unshare-user \ > + --unshare-pid \ > + --bind ${SBOM_CHROOT} / \ > + --bind ${ROOTFSDIR} /mnt/rootfs \ > + --bind ${DEPLOY_DIR_SBOM} /mnt/deploy-dir \ > + -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${PN}-${DISTRO}-${MACHINE}' \ > + --distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \ > + --distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \ > + --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \ > + --cdx-serialnumber '${SBOM_DOCUMENT_UUID}' \ > + --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-'${SBOM_DOCUMENT_UUID}' \ > + --timestamp $TIMESTAMP > +} This breaks the build of custom initrds on next 3f55e8574865de46bb795b60c3c3569567494aa7. For cip-core I got: ERROR: cip-core-initramfs-1.0-r0 do_rootfs_postprocess: ExecutionError('/work/build/tmp/work/cip-core-trixie-amd64/cip-core-initramfs-qemu-amd64/1.0-r0/temp/run.generate_sbom.161385', 1, None, None) ERROR: Logfile of failure stored in: /work/build/tmp/work/cip-core-trixie-amd64/cip-core-initramfs-qemu-amd64/1.0-r0/temp/log.do_rootfs_postprocess.161385 Log data follows: | DEBUG: Executing python function do_rootfs_postprocess | DEBUG: Executing shell function rootfs_do_mounts | DEBUG: Shell function rootfs_do_mounts finished | DEBUG: Executing shell function rootfs_do_qemu | DEBUG: Shell function rootfs_do_qemu finished | DEBUG: Executing python function do_generate_sbom | DEBUG: Executing shell function generate_sbom | bwrap: Can't find source path /work/build/tmp/deploy/images/qemu-amd64: No such file or directory | WARNING: exit code 1 from a shell command. | DEBUG: Python function do_generate_sbom finished | DEBUG: Executing shell function rootfs_do_umounts | DEBUG: Shell function rootfs_do_umounts finished | DEBUG: Python function do_rootfs_postprocess finished ERROR: Task (/work/build/../../repo/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb:do_rootfs_postprocess) failed with exit code '1' The integration is at https://gitlab.com/cip-project/cip-core/isar-cip-core/-/tree/qg/add-debsbom?ref_type=heads Quirin > + > +python do_generate_sbom() { > + sbom_doc_uuid(d) > + bb.build.exec_func("generate_sbom", d) > +} > diff --git a/meta/classes/sdk.bbclass b/meta/classes/sdk.bbclass > index 00cae0da..d57269e5 100644 > --- a/meta/classes/sdk.bbclass > +++ b/meta/classes/sdk.bbclass > @@ -47,7 +47,7 @@ SDK_PREINSTALL += " \ > ROOTFS_ARCH:class-sdk = "${HOST_ARCH}" > ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}" > ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}" > -ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status" > +ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom" > ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}" > ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}" > > diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb > new file mode 100644 > index 00000000..58200382 > --- /dev/null > +++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb > @@ -0,0 +1,30 @@ > +# This software is a part of ISAR. > +# > +# Copyright (C) 2025 Siemens > + > +LICENSE = "gpl-2.0" > +LIC_FILES_CHKSUM = "file://${LAYERDIR_core}/licenses/COPYING.GPLv2;md5=751419260aa954499f7abaabaa882bbe" > + > +PV = "1.0" > + > +inherit rootfs > + > +ROOTFS_ARCH = "${HOST_ARCH}" > +ROOTFS_DISTRO = "${@get_rootfs_distro(d)}" > +ROOTFS_BASE_DISTRO = "${HOST_BASE_DISTRO}" > + > +ROOTFS_FEATURES = "no-generate-initrd" > +ROOTFS_INSTALL_COMMAND:remove = "rootfs_restore_initrd_tooling" > + > +# additional packages for the SBOM chroot > +SBOM_IMAGE_INSTALL = "python3-debsbom" > +DEPENDS += "python3-debsbom" > + > +ROOTFSDIR = "${WORKDIR}/rootfs" > +ROOTFS_PACKAGES = "${SBOM_IMAGE_INSTALL}" > + > +do_sbomchroot_deploy[dirs] = "${SBOM_DIR}" > +do_sbomchroot_deploy() { > + ln -Tfsr "${ROOTFSDIR}" "${SBOM_CHROOT}" > +} > +addtask do_sbomchroot_deploy before do_build after do_rootfs -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/3e82b347-3151-414f-9eb8-dd63108294f7%40siemens.com.