Re: [PATCH v2] meta/classes: generate bill of material from image

[Gernot Hillier <gernot.hillier@siemens.com>]

Am 07.08.19 um 10:21 schrieb Claudius Heine:
> On 07/08/2019 10.08, Gernot Hillier wrote:
>>
>>
>> Am 07.08.19 um 10:01 schrieb Claudius Heine:
>>> Hi Gernot,
>>>
>>> On 07/08/2019 09.56, [ext] Gernot Hillier wrote:
>>>> Hi!
>>>>
>>>> Am 07.08.19 um 09:52 schrieb Quirin Gylstorff:
>>>>>
>>>>>
>>>>> On 8/6/19 3:55 PM, Q. Gylstorff wrote:
>>>>>> From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
>>>>>>
>>>>>> To create products it is necessary to have a list
>>>>>> of used packages for clearance and to security monitoring.
>>>>>> To get a simple list of packages use dpkg-query and generate
>>>>>> a list with the following pattern:
>>>>>>
>>>> [...]
>>>>> I am thinking about adding json as alternative output format. The 
>>>>> yocto 
>>>>
>>>> Why? Is this some established standard somewhere else?
>>>
>>> I don't know any standard format for manifest files? Do you? I 
>>> suggested JSON because its very easy machine readable and expandable 
>>> without breaking other tools.
>>
>> Well, if there's no established standard, I'd prefer to go with 
>> something which is easy to consume in shell scripts.
>>
>> If we don't have clear advantages for JSON, I prefer
> 
> Well IMO, we do have a clear advantage being JSON is sort of a standard 
> format and this is not. But we could go with CSV perhaps?

Well, this is CSV with "|" as separator. ;)

For sure, I'm fine with whatever separator you like.

> 
>>
>> cut -d "|" -f 1
>>
>> over
>>
>> python3 -c "import sys, json; print(json.load(sys.stdin)['name'])"
>>
>> - or adding another dependency to "jq".
> 
> We don't need an additional dependency in isar. But if you like to use 
> json in a shell script, jq might be the way to go.

The main use case for such manifests is decoupled from the build 
process, i.e. far away from Isar and probably even using such strange 
platforms like Windows. Think about clearing personnel who wants to 
postprocess such lists in their MS Office world

> Otherwise we could also use the debian format and print out the 
> installed packages in deb822 [1] format.

So please don't let us use something which can only be consumed on a 
Debian host.

--
Gernot