Re: [PATCH v8 0/7] Add SBOM generation with debsbom

[Zhihang Wei <wzh@ilbers.de>]

On 2/6/26 12:40, 'Felix Moessbauer' via isar-users wrote:
> This patchset adds proper SBOM generation in the two standard formats
> SPDX and CycloneDX during the rootfs generation process.
>
> The generation is itself is handled by a SBOM generator  `debsbom` [1]
> which is developed as an open source project at Siemens. It is still
> early in development, but it has enough features for what we require
> in isar. The required dependencies which are not yet available as
> Debian packages were minimally packaged directly in isar too.
>
> This is a followup of the previous RFC [2]. Since then the series has
> changed a lot. The SBOM generation was moved from a simple OE lib to
> `debsbom`. This also meant the introduction of a separate chroot was
> necessary. The SBOM generation process was also moved from the image
> step to the rootfs step, along with a lot of minor changes and
> improvements.
>
> [1] https://github.com/siemens/debsbom
> [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ
>
> Changes since v7:
>
> - update debsbom to 0.6.1
> - fix various errors on merging rootfs + initrd + imager sboms
>    (as I'm now able to execute the testsuite, I was able to test this on
>    DevTest and CrossTest)
That's good news!

Zhihang
> - move testsuite adoption to p3 to make change atomic
> - only merge sboms if sbom generation is enabled for image rootfs
>
> Changes since v6:
>
> - fixed imager bom failure on transitive image types (detected in isar-cip,
>    wic -> squashfs).
> - updated debsbom to 0.6.0+git
> - add support for license information
> - rebased onto next
>
> Note: I'm still not able to run the full testsuite. The related patches
> to cleanup the testsuite are pending on the list for quite some time. I
> did some extensive local testing with isar-cip core and product layers,
> but any additional testing is highly welcome.
>
> Changes since v5:
>
> - fix isar-image-ci on qemuamd64-bullseye (set IMAGER_BOM according to
>    machine changes made in image file)
> - rebased onto next
>
> Changes since v4:
>
> - rebased onto next
> - fix race condition on creation of ${DEPLOY_DIR_SBOM} (aka ${DEPLOY_DIR_IMAGE})
>
> Changes since v3:
>
> - fix issue on external bullseye initramfs (we now disable sbom generation
>    on all unsupported distros rootfs instances)
> - update debsbom to v0.4.0
> - rebased onto next
>
> Changes since v2:
>
> - fix issues when HOST_ARCH != DISTRO_ARCH on derived distributions
> - update debsbom to v0.3.0, which fixes the Origin: bug reported in v2
> - generate SBOM for imager as well and create merged sbom of .wic image
> - resend imager manifest + wic manifest patches to reduce conflicts
>
> Note, that the patches p1-p5 are most important as they add basic SBOM
> support. The remaining patches address the imager + .wic bom part,
> which also can be merged later on.
>
> Changes since v1:
>
> - remove tarball
> - refactor packaging (auto-derive python dependencies)
> - only build missing packages (varies on bookworm, trixie, noble)
> - add ubuntu support
> - only generate sboms for supported distributions (bookworm/jammy and
>    onwards)
> - update debsbom (includes bug fixes and more information for source
>    packages)
>
> Felix Moessbauer (7):
>    debsbom: update to version 0.6.1
>    feat: add license information to SBOM as well
>    add support to add imager dependencies to BOM
>    wic: create uniform manifest describing all image components
>    qemuamd64: add IMAGER_BOM entries
>    imager: create SBOM of IMAGER_BOM packages
>    wic: create uniform SBOM describing all image components
>
>   doc/user_manual.md                            |  1 +
>   meta-isar/conf/machine/qemuamd64.conf         |  1 +
>   .../recipes-core/images/isar-image-ci.bb      |  1 +
>   .../image-tools-extension.bbclass             | 29 +++++++++++++++++
>   meta/classes-recipe/image.bbclass             |  9 ++++++
>   meta/classes-recipe/imagetypes_wic.bbclass    | 32 +++++++++++++++++++
>   meta/classes/sbom.bbclass                     |  3 +-
>   ...sbom_0.5.1.bb => python3-debsbom_0.6.1.bb} |  3 +-
>   8 files changed, 77 insertions(+), 2 deletions(-)
>   rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.5.1.bb => python3-debsbom_0.6.1.bb} (91%)
>

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/440684fa-3306-42f6-9307-b6f70cf5666b%40ilbers.de.