Re: [PATCH v3 00/10] Add SBOM generation with debsbom

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Fri, 2025-10-24 at 08:33 +0000, Bouška, Zdeněk (FT D EU CZ PDS1 ICC
1) wrote:
> Felix Moessbauer wrote on Sent: Wednesday, October 22, 2025 5:39 PM
> > This patchset adds proper SBOM generation in the two standard formats
> > SPDX and CycloneDX during the rootfs generation process.
> 
> I have two warnings when downloading based on generated sbom by
> debsbom --progress download --outdir downloads --sources isar-image-base-debian-trixie-qemuamd64.wic.cdx.json
> 
> "WARNING:debsbom.download.resolver:no sha256 digest for linux-mainline@6.17.2+r0. Lookup will be imprecise"
> I guess mainline kernel and other packages built from source are not yet fully supported. 

Hi, this means that the package was not found in the apt-cache. Did you
try this series with a fresh build-dir (sstate cache is ok)?

Unfortunately our rootfs_postprocess_commands are not idempotent and by
that a partial rebuild of only the sbom infrastructure runs the debsbom
tool in an rootfs where the apt cache was already dropped.

Anyways, the debsbom tool also supports the custom / rebuilt packages,
but these will simply not be found on the snapshot mirror. The error
above indicates, that precise information in the SBOM is missing -
indicating that the apt cache was missing at time of creating the sbom.

> But SHA256 for sources with my patches could be computed in the future if I am not missing something. Right?
> I understand, that I can't then look them up in Debian, but at least the SBOM
> would represent the sources with the patches in the SHA256 and it would be possible to verify if I have correct sources.
> 
> "WARNING:debsbom.download.resolver:no sha256 digest for openssl@3.5.1-1+deb13u1. Lookup will be imprecise"
> Not sure why SHA256 is missing in sbom for openssl. I use it without any change from trixie.

This time, the warning comes from a package created from a built_using
relation which is not in the apt-cache. I observed the same in a
bookworm container (where I ran an apt-update before). Unfortunately,
the built-using relation does not encode any checksums, but we also
have no easy way to annotate that a package was created from a
built_using relation.

This topic is currently also discussed in [1]. Citing:

 Source packages referenced in built_using only have name and version
 information, but no checksum (and they often cannot be found in  the 
 apt cache)

 Yeah, that feels bad in the abstract. A lot of .buildinfo and
 built-using information (and the signature!) is only valid at the
 point in time of building/ingestion. 

[1] https://lists.debian.org/debian-snapshot/2025/10/msg00004.html

Best regards,
Felix

> 
> Thank you, I like it!
> Zdenek Bouska
> 
> -- 
> Siemens, s.r.o
> Foundational Technologies

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/5762df73039c652fd3a0d82b012361d76e1b104c.camel%40siemens.com.