RE: [PATCH v3 00/10] Add SBOM generation with debsbom

["'Bouska, Zdenek' via isar-users" <isar-users@googlegroups.com>]

> This patchset adds proper SBOM generation in the two standard formats
> SPDX and CycloneDX during the rootfs generation process.

I compared wic.manifest and wic.cdx and here are the differences:

$ grep arch=source isar-image-base-debian-trixie-qemuamd64.wic.cdx.json \
| tr -d ' ' |  sed 's/"[a-z]*":'// | sort -u | cut -d '/' -f 3 | cut -d '?' -f 1 | tr '@' '|' \
| sed 's/%2B/+/' | sort -u > list_from_cdx.txt
$ cat isar-image-base-debian-trixie-qemuamd64.wic.manifest | cut -d '|' -f 1,2 | sort -u > list_from_manifest.txt
$ diff list_from_manifest.txt list_from_cdx.txt
34d33
< grub2|2.12-9
71a71,76
> rust-buffered-reader|1.3.1-2
> rustc|1.85.0+dfsg3-1
> rust-nettle|7.3.0-1
> rust-nettle-sys|2.3.1-1
> rust-sequoia-openpgp|2.0.0-2
> rust-sequoia-policy-config|0.8.0-1
80a86
> unicode-data|15.1.0-1

At least grub should be in wic.cdx.

I am not sure about components which are not in manifest but are in wic.cdx. 

Zdenek Bouska

-- 
Siemens, s.r.o
Foundational Technologies

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS1PR10MB5675AB0DA90554B46AC129C2EBF1A%40AS1PR10MB5675.EURPRD10.PROD.OUTLOOK.COM.