From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 24 Oct 2025 12:03:12 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f61.google.com (mail-pj1-f61.google.com [209.85.216.61]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 59OA3AS6000693 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 24 Oct 2025 12:03:11 +0200 Received: by mail-pj1-f61.google.com with SMTP id 98e67ed59e1d1-33dadf7c5c0sf1968953a91.0 for ; Fri, 24 Oct 2025 03:03:11 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1761300185; cv=pass; d=google.com; s=arc-20240605; b=LV3fb+xTlSv9we2VIx+dUkNEntcnxKos/T7SdLa+8Z2AnUAfRPUKVvMesgXiBuVzTB J5My5lWgDVdCHJ5OzeokwirN7IWgBTqPpdL0U8UPA8o1cOHEBL1juY+CQAR7Sp3crtX6 91R700b2iECybai9Z3SfoCZesDcQyqfQ3UB0SiWHe6Z4ATmRQ28D0jxAYSHznaBoRAu4 sR1TXiw11o6rDdMlaCwHm2AOwWOAZgRtP+U+1LhWlYg6ZHKIqFrmCJO3+Pe3hQtCjuzi cKmfftXFjpm88PEYm1FaPUhr1YlAoJ3LUnbJXS/ldVZeBPZGw3/Gd+5Oh8GB4z4x7rYf HzAg== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:dkim-signature; bh=jysqRRMiHNcmOFPW6tNpafqcohrponD6moreDtgKjsg=; fh=NE2DtMoO+KQAQWo6Fk2VI9L1oY++QZLmAgWxg7pkbms=; b=Ei3XD/KlL3HT4P8VU3FVVM7VT0sH6bfDde0DWUlkwm2QqV+eK1NVePq2U/YvImk+KI j2G7OHLrzJQuoWhl52F1+xgdbI4+5rPrkrRcrS/jB9X/oSMMD/1X5rNC04mCtIIcSEtS zf7bGlqG60n8xbfR+vRtOlOljezuyLGhaMB/YyWDm985Q57Z0ywlUKV7SwgZfKb1Nzls qhxxnFDPwDFYd0HX9kcCtRR2Zham6Icay3Bmd7wKEIjcDtXXEONoR8hGwHHZ2pZj9Nkq TfTR5wObfdORQfsJ1cFpCvgkZJQhRKXt6idC3EkHKQ0oa0rmMF4VpUgTLrS/XKh7VhUZ HKmA==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=PyniCmvg; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1761300185; x=1761904985; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:from:to:cc:subject:date:message-id :reply-to; bh=jysqRRMiHNcmOFPW6tNpafqcohrponD6moreDtgKjsg=; b=r/F3JEzJVOii5Xk7KtDJyVxE1k5oT2672Vp172HepGTI/8gYs03ANYLKmuT0h5ZKBS bow9YQjT7Fr2gOAZFt8B+7D91G0DSkqopIwSbuBIPNzscXYhHGd4qIskqatP32uL2XFt 6oItppoRP7fnRZeZBqsM4SQghclbn5B6pz/YBRPpbP1ukP0kTNZHhO/5oh8GpwTqCU+w h4YgSrvRFjsVReobknNDwXFj4eK4byK1kAcPrKcn39HPug1R2DM3HosahcTOZeLChnkZ auLJWXYgSBm94anaWqaB5l9tmNAYkWwdGfoelm059Cw09R1Y0CxYMDfbtYDr+a/FVP3M UHeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761300185; x=1761904985; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:x-beenthere:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=jysqRRMiHNcmOFPW6tNpafqcohrponD6moreDtgKjsg=; b=QFKA8Bhd6itJXTzdvJI8GngGgatiwM3S8cIrmHkjT/kQtVLJ0yAZA/TXHT1fJV4TIE Rd6ltmPJDuTAkEj6gdCLtv6GjUYDoKxAgaavePmjgVqY/e71/7s7JGHGGQm0aZl736l/ C03H23IG4+isuOzzlwh8Mdl4vvbrAJqN8iupGPNEjIpUkAN43giXhJx5/utl4iQfK2wk LcAlcTwULezrmg7dXT6IlpAgCVKlXVhpQ3APHrO+nzkatSDscYX8CS1yjCLNJRFbq+Lw Uu6OsNr9/hdwcL1yjv9fP20qvvEm2RGMSvi+2bSnUreKlDu63Mnmacuqjw/ikERnDAkk xcjQ== X-Forwarded-Encrypted: i=3; AJvYcCVapzgR0ec7B2wp1lsKdjahOZ138YBb3GDUlHDB8JWOyQo01k2jhSRVAsUAZJiJXkr+ng7e@ilbers.de X-Gm-Message-State: AOJu0YxkQuQ84SXshYItdPlI4VYDsSLOMxpv2kzvTIGYRikmAEuIFl9p lyL5EFVk77F/oDaaa1r1M9jMwXAEM+9FrdxWhTGXvI79BXjr70SFVVuF X-Google-Smtp-Source: AGHT+IEseAVCO6jHrpjA3zJBxIGOdwRDA/n0XuB5g0O0JGs6G+fet1nxcswoU+CHqatzKCmTEsXyxg== X-Received: by 2002:a17:90b:1d89:b0:314:2cd2:595d with SMTP id 98e67ed59e1d1-33fd3a9665amr2464286a91.8.1761300184742; Fri, 24 Oct 2025 03:03:04 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Ae8XA+azPmsYi7MeJKCAWdx7zgY6Hprc+iXwRUZ6mGNQnRmqSg==" Received: by 2002:a17:90b:5708:b0:33b:ba54:94cb with SMTP id 98e67ed59e1d1-33faff15107ls937614a91.1.-pod-prod-00-us; Fri, 24 Oct 2025 03:03:03 -0700 (PDT) X-Received: by 2002:a17:90b:5706:b0:32e:23c9:6f41 with SMTP id 98e67ed59e1d1-33fd3a95f40mr2728261a91.5.1761300183075; Fri, 24 Oct 2025 03:03:03 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1761300183; cv=pass; d=google.com; s=arc-20240605; b=cMbUU0W8F/m6hmJVoTsI3JIKFQMfk94dKsUiyX5Id4thZrwhioZ776hSCyB04BfCGq m1pHJhNlQjuFFQEgft9MxHKzfP/UhUpOol0xDuPUNTmr7CnX4KZzGwdKzUSXHVQhZcMt +KskqWeJeQedJTcOlNVY9bGYseIcprwaRTqX/w0h/JXnx3Y1FP/hPwZ0k9cr2LkvLn4p EzkX13ykUVyIk9p48JbmqnlnYGngEXeW9d2O0vEOnYJ6csWdL9OenZfdlQy88vkg7naY eQBOcas0lzgQSBL7EYlusa/4UW3soafIq2DWeMc4z8imR3nt9pqpEH+7t5BpTApLuk/U keGw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:content-id:user-agent :content-language:accept-language:in-reply-to:references:message-id :date:thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=fhqYqR4HXoiB3a/PcXXtvFYUHhSBi/nJieclsSr+HdI=; fh=wGzPg+eVKbk73KO7k2qlaV7Xuqkr7NxPnmnvifUfBTQ=; b=TQDWFatRDk+elIWE2bxB5SroiarR1Zwr/Fmu5D5GASyMbAqvHIKjmwF40UySGPhxea Vzxo+jM2KaBcEwaVGLEUk9u1m5XDWpAQ1zoqgG7557TLr0saXVk5xZaKXpQV2Bhg8uaR /W//BZX7RYLfUp6/AYuPzpheoxpWREE6L/DWeq2bETm6DhcXgYcNNziis1ilfrp940mF rfqyhQ93rjLqTBMFWIzWdB55VkDA2H+2wScS98UArUQ80xR0K4PRuSZMlqPlATn+qZNa 5MJK1buIHC//1m4Wn6r7if2zJ0X3Y4ytJWUh+mdLeCCaeBjgNDoKNPuHkfylH/B4v8eY Henw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=PyniCmvg; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c202::7]) by gmr-mx.google.com with ESMTPS id 41be03b00d2f7-b6cf4bd1807si327550a12.2.2025.10.24.03.03.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Oct 2025 03:03:03 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) client-ip=2a01:111:f403:c202::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qs0VeywhPpNbWW85XjI/w1N2Iv2QE+69I1PNaG+5r/EaOvh0PlwkCLqBBqidDCzajBRRAQj+MckZeV/YsfoVEZwIxBPLrQe4RDaytk21AgMIOS+d1drpyVnI8gJingxBSYSg64G+ZF3jBVPfV8id4dVmb7KRTIHOAaPIXq/RuZL/f9aILPPyaxHnvxQQP7uVkwubhokfP1PEW7Wfn4Y17zBJfIKzyqns2g+tz0Oad00VWzXQ3JFR5fV8gJkTbDjw3pByug7jA/8d2pTwrQpOP5pOqQOrt3RuoHrPxaW66oipx6lgZphO8kiVpk8QsyGwOV0itwHnSMBfpafA11yr3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fhqYqR4HXoiB3a/PcXXtvFYUHhSBi/nJieclsSr+HdI=; b=H12vvoYn5t4LPgFdLxZuMgk1tfXvMZD9bRxrlQuN60FnZDbdKcnTS4cRjO98QPikvP9RezQmmj4tbTcv6fZYx715rF6EEc5jZuM/VBh+buI6ri6hQNtbJAKrx9L0i3taLdCUBl8Gr3G/GX9T4ESpUZQiGBXlTTMcZIme0RVGF6N6WwXq5qrBMGTUDYT6fgmluEHfwTS9EE0NSI0wZW0Wbix9H0z7oXOlchCvD/CGx+706hS19HRsVH1+NbWVyD+ZCxAV23uRGjP/hJequLEDtkeHNQENizK3VVIgSYDoM1aiq+RBg0BiLPdRNlt3Emma5SsChNdLQopaJAy7hSScPA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by AS4PR10MB5498.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:4fc::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9253.13; Fri, 24 Oct 2025 10:02:58 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe%4]) with mapi id 15.20.9253.011; Fri, 24 Oct 2025 10:02:58 +0000 From: "'MOESSBAUER, Felix' via isar-users" To: "isar-users@googlegroups.com" , "Bouska, Zdenek" CC: "Steiger, Christoph" , "cedric.hombourger@siemens.com" , "Kiszka, Jan" Subject: Re: [PATCH v3 00/10] Add SBOM generation with debsbom Thread-Topic: [PATCH v3 00/10] Add SBOM generation with debsbom Thread-Index: AQHcQ2oQNyvOicM6EUGZpxerjoGlHLTRDLYAgAAHNIA= Date: Fri, 24 Oct 2025 10:02:58 +0000 Message-ID: <94f9f4ed78522343bcc4d999d84d3894f3086e31.camel@siemens.com> References: <20251022153921.2494749-1-felix.moessbauer@siemens.com> In-Reply-To: Accept-Language: de-DE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Evolution 3.56.2-5 x-ms-publictraffictype: Email x-ms-traffictypediagnostic: DU0PR10MB6828:EE_|AS4PR10MB5498:EE_ x-ms-office365-filtering-correlation-id: f2d1d66b-730d-421c-5aee-08de12e482b2 x-ms-exchange-atpmessageproperties: SA x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|10070799003|38070700021; x-microsoft-antispam-message-info: =?utf-8?B?eGFUTVdiZEVRbkQzOXJTTHBadWQ0V2lLdlNVTDNTZ3VjRi8rM21DS3dwSVR3?= =?utf-8?B?YWdVbVVIa3NVOG1pSzJiT1VPa0swOStHbVIwZ1JFSUFYSkt2bkFzUVFrS3Bq?= =?utf-8?B?eWZrNUkvQTQvL2ZERUNZbEo0V2tsSTZVZzNNL3lEN3FsSFc3bTNCNTgxUm01?= =?utf-8?B?V21PbTJwTE85WVQyamFIOWw1RTRqcitnSEhhRU0zdU14TytIU0Q2aTNGWEQy?= =?utf-8?B?VXdPZFVUdFFXQnF4L0NLemdaNW1KVXdnL1NYSWNxZE02RGZTMERNdEQ4eUlV?= =?utf-8?B?VU1zZ0lVZzFrZVdsQUNNdHN2MkloUnVuam1tVWpTMUxPZGltN2Q0aFMwdUMw?= =?utf-8?B?R2xmQlBsaWlMY0s4Q05UeUVVQWg4emN4a2xMeXhUakQzSEJSZXlpdVJsbUM4?= =?utf-8?B?RDVtQWI1T3pQbUFDcWlpaDNGcXFkVkNRbXh5VkRON0RLSmdnMHU5Qm0wL3ND?= =?utf-8?B?ZXJPQTZCanNOOUhpVXFzZ3ZYQ3ZiQmozSE1UR2xhbkhHdk45em5TUTV4VFNr?= =?utf-8?B?Y0NSQUtvQ3h0R2daU2hJUVR3cEdtdmxUZnptYThsdGJxdzdDVGhjYnh2U2dD?= =?utf-8?B?S203SHJmc3VnQTZzckM0dXNHVFVpVWJNK3h2Q3dqQmY2aWJZd3NSVU5ac25o?= =?utf-8?B?eDhESVhVTFNvOW5OTXNKLzcwYUtTN2YxQVBHY0lYdysrU3dZbVFXRmhZUmQw?= =?utf-8?B?Tm5lYVVQZDZOOGI1bXpZSzQ1ajFwVGQ2UTJmTHpSeHpFdlVSSkVIVGNHZG5B?= =?utf-8?B?aE45V3ZVN0doLzIycGFWekJLVjFqRUNaUHVCT2dCZllhZEsxUjNOSDdCdHZt?= =?utf-8?B?bDNxaGFxUk5IbURVUkZTcnl0MXVBSnpMWmdNQkZCSEo4bktCdCswN2d3Z09r?= =?utf-8?B?VEQ3NFBWRHdWYVJaU3pvNDhwbk9uV3dqVjVIdTlHMHBvRlBPbVI3L2lLaUhi?= =?utf-8?B?Y1RYNjJlZFV5U2dXZGZEMmhhaGxDanZtVGh0eXdubGUyN3JxS3o1UVhsaWlR?= =?utf-8?B?ZSs0Wi9mRmNLNDdISWFwTytSNEdUMDNENVpiY3U3aFpOZDhIZmRuM2NyTUZU?= =?utf-8?B?QzZrSnhKYllpd09icUNXTFRSOEpzQlkySmtTcmlkWWpCU3RoZXkxdnIxT1RR?= =?utf-8?B?QWMwaHNCOS9vS2FZYTZXTlFLMFB3bDhxQUl5ZldnMVR0V0QxZHlFUzNLTGFX?= =?utf-8?B?V3RQSzFxbXZ5SThLaHlXdE44MXhOTjcwRklZTW5Bd2lCdHF6VWpuMUZZNlNj?= =?utf-8?B?NVB0SVBzdk1adS9pcjI4bHY4UkJzOFZ3VnRkVVBVQlROSWptemIzY3NOWUlC?= =?utf-8?B?R2Q3V3A4QnVvd2x2NmsrZXlOS1hTQkZUWDdNMnFhSjEzRVRoZzQ1V2ZNSjUv?= =?utf-8?B?WG4yWmtnSHBQNkhPYUhyYTFEMnBtVnZMbFpMbjlKR2p4TS9NaFFibEYwVWZh?= =?utf-8?B?MHloUjRZeEl4dzVnT09YVTRQZWVoWGUrVzBZNDFBa3FFN0t6Ukx6NGNTZnZM?= =?utf-8?B?NkxneDdibmVNSXhkcndJQU1VU01idzlNUlZlOUtJUEMxYnhBbEhFbHM1aTVt?= =?utf-8?B?TGtvTkg2WDA3R1BYYyswaXAwMWM1dDVUY1RFSDl1K0ZuTWxEUi9UWE4wOWNp?= =?utf-8?B?QS9QVFFDY1V3dG81WmhWZmtYUEpVdmR3eExXOVVBSUszdlZSQnJ3OGJwL1FH?= =?utf-8?B?UnZOZHphREJFeWN6UTFlcE15QThVdnNlT2hoamM1cDVENTk3MEs3QndrcHJN?= =?utf-8?B?SVUyOXFsT1ZWVFh2NS9UNitoY0ZLYy9TRHUvazdhN0xFclhGK29UN013czJC?= =?utf-8?B?UzVBM3M4dU1TdURDUnJZZmNIWmNReDUyVWxSQ2gvM0tDOTUvd1NGbWV6cHJj?= =?utf-8?B?aE9RejY5UzZOczVFeUc3RlN6LzFKU0wwZlZiSjYxdUpzWkRSQVJDSVZlcHRY?= =?utf-8?B?SWdMcmxMVXBCOWtib1hremFGSUpZODhtbXU2OGt0Yjd2dzNBN0lxUVhOZEpO?= =?utf-8?B?Smk1dEluQXRneWxzMkozQVZucUhjcVVJVFN0c0pDTjVwTjhSSHhZQTZDa2ww?= =?utf-8?Q?8NpfwM?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(10070799003)(38070700021);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?Mm1LcjR5OFZRdmN0aWVrOHdZN2hCNzNXMUt0Vm1IR3IyM0Fqb3ozTzRvY2xN?= =?utf-8?B?THB6R3BBNGpJaXZuWUpaS0ozVnpBckRYbFZreVRkMkt4NDJPc0Z3SVdkZ09E?= =?utf-8?B?bnFkdytSRHpyU0ZoZ005UTBHbmtCSWgxUmVzc2VVVG5mMXltelRiMWJ6a1N4?= =?utf-8?B?QkxJMEFQdWNqRVFNRmdINlQ0VWpLZHM1U3huSEEzY3hXZXNMMFFJdEp5cmRy?= =?utf-8?B?V2hULzZtYzV1c3plMm56NC9hV0RqanZOb3NYc3NtQjJiSlVPd2RwblRCS0RU?= =?utf-8?B?WndTb25kd0RWSHg4U1dzSjlhdnhzbE9BNTRaWDNscUc3SGJ4dnJlM1A3Njdt?= =?utf-8?B?ajJjczNLWEVNWVF4VHMyRmFucE9Hc3hZUXU2dGRRdk9nbHA5SjZaYjF0aUdj?= =?utf-8?B?amY1TFJjOTFYeHFHQ2Z5bFp6Q29jcWVUWUt3TGZ4ejkxcFowY0NtNXFaRktG?= =?utf-8?B?WnJFWXN1VWdYSXJoaFAycHorUVJuSTRjbVFrbnJHSVphWVJTUHR6OTdQNmgr?= =?utf-8?B?QUlCUTNIcklFYmtCWFc4VVhya1ZtRGE1ODhSaFkrZUpXd2l4NWowQ0dvNU91?= =?utf-8?B?SnE1eXZXMFJHSHlSamtwYnpxSVZhUG5Jc3ZmQ2c2ZExET3h4dkFQWWRMVjhx?= =?utf-8?B?SEFleFJva2VwdW0zc2hPWnpIS085VWNTdndDdGIvakxFNjhoeDVNTHpTMkxZ?= =?utf-8?B?bEdtRXlyVjhFSU1XNmt3S2Q5ZTVXeWdZb2gzV0llUFlrWHZjVGpCVDBwU0hE?= =?utf-8?B?eFptM010cUdVRkZCdDFBbStDYWtxb1BQYXNaZW1uREo5bXhYS000akJvTEJs?= =?utf-8?B?aFpQUUo0UE5ZODd6RlptcVR0d1ZEVkpUbU5FVXF4dHdKVnRJNnB2ZDJQR3RY?= =?utf-8?B?M3R4OHpvZExLcWk2b2o5TVZQTUpETm5RTUVrYWxJVVAzNXRPVVRKQWFMSGsv?= =?utf-8?B?T3VUSDdyOGtOUTRrMGIyRnpQaVRZYW93TE9GeXZiSk9DaG5wRllVRlkrM1h1?= =?utf-8?B?bXdVOGJKVjcvb3BwVkxpWkhXZEk1K01mMVM5TUI4TWdGaWhTUUEwcU9VUE1O?= =?utf-8?B?eGYwakU4bG9qd2JwMVpaeTc1azJOcGxxSHhxbW5MbmxvNUNDRndiSlQzcDVH?= =?utf-8?B?WHQvS0M1RkhXeWVCSjNzUHMvNTdxSGdSL0xTdUFPNFpFc28vamRRQTBiYmZT?= =?utf-8?B?NEZSditBOVRJTWprTDdDVmxoN2gvRElmVkRLYXVKT1pGUXN0cVk3cVg0SXZu?= =?utf-8?B?R0ROZm5NcTlJYmo4VWxmS0NiMHVQMVRiL2N5dGZNTCtETkphcHMxb1ZITndq?= =?utf-8?B?RWlrN3NhSzFQdzhaRktUNERxZTJLT015UFp1TzNWMTlrWmN5eUhSa0hqZm4r?= =?utf-8?B?NHJkTmw2cjh4dEdaMnQvWURJYWVFYWpjemFhL1VGRXhhbXNTdGU1dFNuaWpN?= =?utf-8?B?MENRb3ZqeXRzbHRqd1JEcmdxUEZ5NWZKOGl2aXFOQjNxdWNqcEZYMnZmbXVQ?= =?utf-8?B?RmxTbXlmV3I5RUp1dnZYeWxPRnFMZkU5K0l2OGloUWJNWnp0dDR1andyWjdx?= =?utf-8?B?dXBNakMrQ1JwWnhzNU5hOVJ0ZUlZMHRtdUZaUVRNUFdDY1daVHhPV00vckUx?= =?utf-8?B?OFcwM1FxY01zajlpc3k1anQvTjM0YVRyOVpmUEpKNm1IQXYzc1VOT2Nxc0po?= =?utf-8?B?b0lpdjJFYUxITkxIcjFvTGxUZ0crVFp4d2hsbW9odUtmTmd2NEdscXcvOTF5?= =?utf-8?B?dEJpTTdxS0Rld0xYMW1rbjZ4UmlGZUpJMFY1V1BJTUpqN3I3Vm5mZEUyMytt?= =?utf-8?B?dUZ3ZUNTcElqMzRCa09tTjRCRG5FOW5aRzR3cGZEOHVSb3BKdzJxR01rUU9B?= =?utf-8?B?K3hwWml4Smx5OGNWMnRvNzlTNS9waldtcWd4UUV3SWxxYzZ6MFhHR3BKTFVL?= =?utf-8?B?WHBNTlhkVHdEaWM0R0MzTUJIdE5BdjdKTDI1WklwY0l5V050bVdNVklqR3JY?= =?utf-8?B?MjFwSDIyWnR1ZUxCU2FhTkh2dWJLWUNYWnp4L3R6V2w3anNHMXluWVBJbTB1?= =?utf-8?B?L2ZRWm9ETy9ubVduMzVEQTBLbzA3RDJMVEZvWCtucDJCL3RkNlJlNnhZYUNR?= =?utf-8?B?ZFdLRVRhcVB2b3N1WmU0TzhOQ3FhUzFSc3doemJXcUJ5aGhQUWliVHpmdTlJ?= =?utf-8?B?dHhRWnFXYURhUytuSVZLVkpHRUFDa0pqUWNReXBiSnBJUml5TFNnZUdUOGN1?= =?utf-8?B?UHJKNWJJZGtlRkIxVjUrSTFDYTVBPT0=?= Content-Type: text/plain; charset="UTF-8" Content-ID: <03B14BB46E23874789F32EE52C904B61@EURPRD10.PROD.OUTLOOK.COM> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: f2d1d66b-730d-421c-5aee-08de12e482b2 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2025 10:02:58.7292 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: e/FkBSFEcBKLFDQzRz8NBEJAs6IjhLazam71sk5wOXxYjWNSqMBGn84xl0uMAn/CpnWIoEXaY+vXHwqwUGzsbLHnrfJdG3hcptq5Eg4fi7c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR10MB5498 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=PyniCmvg; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: "MOESSBAUER, Felix" Reply-To: "MOESSBAUER, Felix" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: /2DE0dt6HCmN On Fri, 2025-10-24 at 09:37 +0000, Bou=C5=A1ka, Zden=C4=9Bk (FT D EU CZ PDS= 1 ICC 1) wrote: > > This patchset adds proper SBOM generation in the two standard formats > > SPDX and CycloneDX during the rootfs generation process. >=20 > I compared wic.manifest and wic.cdx and here are the differences: >=20 > $ grep arch=3Dsource isar-image-base-debian-trixie-qemuamd64.wic.cdx.json= \ > | tr -d ' ' | sed 's/"[a-z]*":'// | sort -u | cut -d '/' -f 3 | cut -d '= ?' -f 1 | tr '@' '|' \ > | sed 's/%2B/+/' | sort -u > list_from_cdx.txt > $ cat isar-image-base-debian-trixie-qemuamd64.wic.manifest | cut -d '|' -= f 1,2 | sort -u > list_from_manifest.txt > $ diff list_from_manifest.txt list_from_cdx.txt > 34d33 > < grub2|2.12-9 > 71a71,76 > > rust-buffered-reader|1.3.1-2 > > rustc|1.85.0+dfsg3-1 > > rust-nettle|7.3.0-1 > > rust-nettle-sys|2.3.1-1 > > rust-sequoia-openpgp|2.0.0-2 > > rust-sequoia-policy-config|0.8.0-1 > 80a86 > > unicode-data|15.1.0-1 >=20 > At least grub should be in wic.cdx. Yes, definitely. At least in my SPDX SBOM this is listed (need to create a CDX one). Are you sure your bash magic is right? The purl is likely: pkg:deb/debian/grub2@2.12-9?arch=3Dsource >=20 > I am not sure about components which are not in manifest but are in wic.c= dx.=20 These are components created from the built-using relation. They are not tracked in the manifest. Felix >=20 > Zdenek Bouska >=20 > --=20 > Siemens, s.r.o > Foundational Technologies --=20 Siemens AG Linux Expert Center Friedrich-Ludwig-Bauer-Str. 3 85748 Garching, Germany --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= 94f9f4ed78522343bcc4d999d84d3894f3086e31.camel%40siemens.com.