RE: [PATCH v6 00/10] Add SBOM generation with debsbom

["'Bouska, Zdenek' via isar-users" <isar-users@googlegroups.com>]

On Wed, 2026-01-12 at 11:09 , 'MOESSBAUER, Felix' via isar-users wrote:
> On Wed, 2026-01-07 at 15:06 +0000, 'MOESSBAUER, Felix' via isar-users
> wrote:
> > On Fri, 2025-12-05 at 15:08 +0000, Bouška, Zdeněk (FT D EU CZ PDS1 ICC
> > 1) wrote:
> > > > This patchset adds proper SBOM generation in the two standard formats
> > > > SPDX and CycloneDX during the rootfs generation process.
> > >
> > > libre2-11 (provider of virtual package libre2-11-absl20240722) is
> > > missing as dependency of libgrpc29t64 in
> > > build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-
> qemuamd64.wic.cdx.json
> > > See dependencies on Debian Trixie [1].
> >
> > Thanks for the reproducer. This is indeed a debsbom bug, but only
> > affects the mapping of dependencies. The provider package is still
> > added to the flat list of packages in the SBOM (under the actual name,
> > not the virtual one).
> >
> > I created and upstream issue for tracking:
> > https://github.com/siemens/debsbom/issues/164
> 
> Hi Zdenek,
> 
> Christoph just proposed a debsbom PR to fix this issue. It would be
> great if you could give it a try (either via ISAR by changing the
> upstream reference in the debsbom recipe) or just locally in a venv.
> 
> https://github.com/siemens/debsbom/pull/165

Hi Felix,

I have ModuleNotFoundError: No module named 'license_expression' error when I upgrade debsbom in isar next branch:

~/debsbom/isar$ git log | head
commit 16b7b7e37b54be969453466e01ce4aa66e8ccb8e
Author: Srinuvasan A <srinuvasan.a@siemens.com>
Date:   Fri Jan 9 18:06:26 2026 +0530

    kas/kas-container: restore executable file permissions

    The file permissions were accidentally changed from 755 to 644.
    Restore them back to 755.

    Signed-off-by: Srinuvasan A <srinuvasan.a@siemens.com>
~/debsbom/isar$ git diff
diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.4.0.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.4.0.bb
index 410f358a..09746f8c 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.4.0.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.4.0.bb
@@ -37,7 +37,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
            file://rules \
            file://0001-Use-old-license-description-in-pyproject.toml.patch \
            "
-SRCREV = "a600f60966d08803eb17bfb81eb8828921497453"
+SRCREV = "6e197577fb1444bed5608e12517807c23ccf77de"

 do_prepare_build[cleandirs] += "${S}/debian"
 do_prepare_build() {
z0042b9j@EVC00327NB:~/debsbom/isar$ cd ..
z0042b9j@EVC00327NB:~/debsbom$ cat trixie.yml
header:
  version: 14

build_system: isar

machine: qemuamd64
distro: debian-trixie

target: mc:qemuamd64-trixie:isar-image-base

repos:
  isar:
    path: isar
    layers:
      meta:
      meta-isar:

local_conf_header:
  meta-custom: |
    IMAGE_PREINSTALL:append = " libgrpc29t64"
~/debsbom$ isar/kas/kas-container build trixie.yml
2026-01-14 09:33:47 - INFO     - kas 5.1 started on Debian GNU/Linux 12
2026-01-14 09:33:47 - INFO     - /work/build$ /work/isar/bitbake/bin/bitbake -c build mc:qemuamd64-trixie:isar-image-base
Loading cache: 100% |                                                                                                                                                                             | ETA:  --:--:--
Loaded 0 entries from dependency cache.
Parsing recipes: 100% |############################################################################################################################################################################| Time: 0:00:01
Parsing of 162 .bb files complete (0 cached, 162 parsed). 168 targets, 36 skipped, 0 masked, 0 errors.
NOTE: Resolving any missing task queue dependencies
NOTE: Resolving any missing task queue dependencies
NOTE: Resolving any missing task queue dependencies
NOTE: Resolving any missing task queue dependencies
Sstate summary: Wanted 9 Local 0 Mirrors 0 Missed 9 Current 0 (0% match, 0% complete)############################################################################################                  | ETA:  0:00:00
Initialising tasks: 100% |#########################################################################################################################################################################| Time: 0:00:00
NOTE: Executing Tasks
WARNING: mc:qemuamd64-trixie:isar-image-base-1.0-r0 do_rootfs_postprocess: Your image is not configured completely according to systemd-firstboot.
WARNING: mc:qemuamd64-trixie:isar-image-base-1.0-r0 do_rootfs_postprocess: It prompted: "‣ Please enter the new hostname (empty to skip): "
ERROR: mc:qemuamd64-trixie:isar-image-base-1.0-r0 do_rootfs_postprocess: ExecutionError('/work/build/tmp/work/debian-trixie-amd64/isar-image-base-qemuamd64/1.0-r0/temp/run.generate_sbom.19099', 1, None, None)
ERROR: Logfile of failure stored in: /work/build/tmp/work/debian-trixie-amd64/isar-image-base-qemuamd64/1.0-r0/temp/log.do_rootfs_postprocess.19099
Log data follows:
| DEBUG: Executing python function do_rootfs_postprocess
| DEBUG: Executing shell function rootfs_do_mounts
| DEBUG: Shell function rootfs_do_mounts finished
| DEBUG: Executing shell function rootfs_do_qemu
| DEBUG: Shell function rootfs_do_qemu finished
| DEBUG: Executing shell function image_postprocess_disable_systemd_firstboot
| Created symlink '/etc/systemd/system/systemd-firstboot.service' → '/dev/null'.
| WARNING: Your image is not configured completely according to systemd-firstboot.
| WARNING: It prompted: "‣ Please enter the new hostname (empty to skip): "
| DEBUG: Shell function image_postprocess_disable_systemd_firstboot finished
| DEBUG: Executing shell function image_postprocess_sshd_key_regen
| DEBUG: Shell function image_postprocess_sshd_key_regen finished
| DEBUG: Executing shell function image_postprocess_machine_id
| uninitialized
| DEBUG: Shell function image_postprocess_machine_id finished
| DEBUG: Executing shell function image_postprocess_mark
| BUILD_ID="v0.11-265-g16b7b7e3-dirty"
| VARIANT="Isar target filesystem"
| VARIANT_VERSION="1.0"
| DEBUG: Shell function image_postprocess_mark finished
| DEBUG: Executing shell function image_postprocess_configure
| DEBUG: Shell function image_postprocess_configure finished
| DEBUG: Executing python function do_generate_sbom
| DEBUG: Executing shell function generate_sbom
| Traceback (most recent call last):
|   File "/usr/bin/debsbom", line 5, in <module>
|     from debsbom.cli import main
|   File "/usr/lib/python3/dist-packages/debsbom/cli.py", line 13, in <module>
|     from .generate.generate import DistroArchUnknownError
|   File "/usr/lib/python3/dist-packages/debsbom/generate/__init__.py", line 5, in <module>
|     from .generate import Debsbom, SBOMType
|   File "/usr/lib/python3/dist-packages/debsbom/generate/generate.py", line 16, in <module>
|     from ..apt.cache import Repository, ExtendedStates
|   File "/usr/lib/python3/dist-packages/debsbom/apt/cache.py", line 18, in <module>
|     from ..dpkg.package import BinaryPackage, SourcePackage
|   File "/usr/lib/python3/dist-packages/debsbom/dpkg/package.py", line 18, in <module>
|     from ..apt.copyright import Copyright
|   File "/usr/lib/python3/dist-packages/debsbom/apt/copyright.py", line 7, in <module>
|     from license_expression import LicenseExpression, get_spdx_licensing
| ModuleNotFoundError: No module named 'license_expression'
| WARNING: exit code 1 from a shell command.
| DEBUG: Python function do_generate_sbom finished
| DEBUG: Executing shell function rootfs_do_umounts
| DEBUG: Shell function rootfs_do_umounts finished
| DEBUG: Python function do_rootfs_postprocess finished
ERROR: Task (mc:qemuamd64-trixie:/work/build/../isar/meta-isar/recipes-core/images/isar-image-base.bb:do_rootfs_postprocess) failed with exit code '1'
NOTE: Tasks Summary: Attempted 68 tasks of which 0 didn't need to be rerun and 1 failed.

Summary: 1 task failed:
  mc:qemuamd64-trixie:/work/build/../isar/meta-isar/recipes-core/images/isar-image-base.bb:do_rootfs_postprocess
Summary: There were 2 WARNING messages.
Summary: There was 1 ERROR message, returning a non-zero exit code.
2026-01-14 09:39:36 - ERROR    - Command "/work/isar/bitbake/bin/bitbake -c build mc:qemuamd64-trixie:isar-image-base" failed with error 1
~/debsbom$

Zdenek Bouska

-- 
Siemens, s.r.o
Foundational Technologies

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS1PR10MB567546620BE477D84A63DE63EB8FA%40AS1PR10MB5675.EURPRD10.PROD.OUTLOOK.COM.