Re: [PATCH v6 00/10] Add SBOM generation with debsbom

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Wed, 2026-01-07 at 15:06 +0000, 'MOESSBAUER, Felix' via isar-users
wrote:
> On Fri, 2025-12-05 at 15:08 +0000, Bouška, Zdeněk (FT D EU CZ PDS1 ICC
> 1) wrote:
> > > This patchset adds proper SBOM generation in the two standard formats
> > > SPDX and CycloneDX during the rootfs generation process.
> > 
> > libre2-11 (provider of virtual package libre2-11-absl20240722) is
> > missing as dependency of libgrpc29t64 in
> > build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.cdx.json
> > See dependencies on Debian Trixie [1].
> 
> Thanks for the reproducer. This is indeed a debsbom bug, but only
> affects the mapping of dependencies. The provider package is still
> added to the flat list of packages in the SBOM (under the actual name,
> not the virtual one).
> 
> I created and upstream issue for tracking:
> https://github.com/siemens/debsbom/issues/164

Hi Zdenek,

Christoph just proposed a debsbom PR to fix this issue. It would be
great if you could give it a try (either via ISAR by changing the
upstream reference in the debsbom recipe) or just locally in a venv.

https://github.com/siemens/debsbom/pull/165

Best regards,
Felix

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/a318fba1fa7daa7fdd311a7c651e5b692d62929c.camel%40siemens.com.