Re: [PATCH v2 2/3] debsbom: update to v0.10.2

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Tue, 2026-09-08 at 10:10 +0200, Christoph Steiger wrote:
> On 9/8/26 8:13 AM, Florian Bezdeka wrote:
> > On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
> > wrote:
> > > This brings a couple of bugfixes, as well as support to read the package
> > > data from a tar file.
> > > 
> > > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > > ---
> > >   ...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} |  2 +-
> > >   .../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
> > >   2 files changed, 44 insertions(+), 1 deletion(-)
> > >   rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
> > >   create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > 
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > similarity index 95%
> > > rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > index 7fc9a8eb..fa0b9b38 100644
> > > --- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
> > > @@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > >              file://rules \
> > >              file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > >              "
> > > -SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
> > > +SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"
> > >   
> > >   do_prepare_build[cleandirs] += "${S}/debian"
> > >   do_prepare_build() {
> > > diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > new file mode 100644
> > > index 00000000..1aec1369
> > > --- /dev/null
> > > +++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
> > > @@ -0,0 +1,43 @@
> > > +# This software is a part of Isar.
> > > +# Copyright (c) Siemens, 2025
> > > +#
> > > +# SPDX-License-Identifier: MIT
> > > +
> > > +inherit dpkg
> > > +
> > > +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +DEPENDS:append:bookworm = " python3-packageurl"
> > > +DEPENDS:append:noble = " python3-packageurl"
> > > +
> > > +S = "${WORKDIR}/git"
> > > +
> > > +MAINTAINER = "Christoph Steiger <christoph.steiger@siemens.com>"
> > > +DPKG_ARCH = "all"
> > > +DEBIAN_BUILD_DEPENDS = "dh-python, \
> > > +                        python3-all, \
> > > +                        python3-setuptools, \
> > > +                        pybuild-plugin-pyproject, \
> > > +                        python3-packageurl, \
> > > +                        python3-debian, \
> > > +                        python3-requests, \
> > > +                        python3-zstandard, \
> > > +                        python3-license-expression, \
> > > +                        "
> > > +
> > > +DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
> > > +
> > > +DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
> > 
> > Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
> > the tool is part of forky that means someone must have done a the same
> > work already...
> > 
> 
> There is an upstream packaging [1] which is also maintained by us. 
> Unfortunately debsbom is only available in trixie backports and not at 
> all in bookworm. 
> 

While debsbom itself is available in trixie-backports, the python3-
spdx-tools is not. By that, we can only generate CycloneDX SBOMs in a
pure Debian environment. For older targets like bookworm, we anyways
need a custom built in isar.

As the debsbom tool runs outside of the target chroot, it could also be
provided as host tool (e.g. in kas-container), or in a dedicated
(forky) chroot. The latter requires multiconfig for all targets that
want to have an SBOM generated, though.

> When we introduced the SBOM support we needed to 
> package it in isar since it wasnt yet packaged upstream and it has 
> stayed like this since then. We will at some point probably just use the 
> upstream version.

While we could use the upstream packaging, it would significantly
increase the build time due to additional built-time dependencies
(which are optional if only supporting debsbom generate). We could
introduce build profiles in upstream to reduce the impact, but I'm not
sure if it is really worth it.

A third option would be to use Yocto's buildtools feature [2], but that
is currently not used in isar at all.

For now, I recommend to just keep the packaging as is and just update
it from time to time (only needed on generate related patches).

[2]
https://docs.yoctoproject.org/dev/ref-manual/system-requirements.html#downloading-a-pre-built-buildtools-tarball

Felix

> 
> [1] https://salsa.debian.org/python-team/packages/debsbom
> 
> > > +
> > > +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> > > +           file://rules \
> > > +           file://0001-Use-old-license-description-in-pyproject.toml.patch \
> > > +           "
> > > +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> > > +
> > > +do_prepare_build[cleandirs] += "${S}/debian"
> > > +do_prepare_build() {
> > > +    deb_debianize
> > > +}
> > > -- 
> > > 2.55.0
> > > 
> > > -- 
> > > You received this message because you are subscribed to the Google Groups "isar-users" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
> > > To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/9b5e7cb996bb7a5dc0511bb0954ed46faf965621.camel%40siemens.com.