From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 20 Oct 2025 12:16:58 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pl1-f185.google.com (mail-pl1-f185.google.com [209.85.214.185]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 59KAGuFE006908 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 20 Oct 2025 12:16:57 +0200 Received: by mail-pl1-f185.google.com with SMTP id d9443c01a7336-290c2d13a01sf29557745ad.0 for ; Mon, 20 Oct 2025 03:16:57 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1760955411; cv=pass; d=google.com; s=arc-20240605; b=aqNQ0JKdj+53roDw0RFjfZWM8+M9pQ0ZLk/qtPQI5XLB6atED2wt3n8WOPpJMQXGxZ fq9/US0hTCXdzkKq0e8vzcW2/qr9ylQCOg5OxuNlBan1LGjexYhK7LA2oLwTtvOIyh4w Yjsw0528xP1/SGGrMnmCSr8Cz2bdk9blC6ssVdPtnU1Byaf99WGY35xS2lf6F3cQ9XXP HXkiyhgyoyW6tqsJbtwLflVtdZj0MXXG/oUrPyoiw90KYq07RTw88FqhfKxpZUGJgW55 uuc1oBwoK1TcmafGkIFWHbtCD8YvSUGf+8kl4qKBwX3L5eYjmn5b+NEX2Fmf6IOikA8Y cz9Q== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:dkim-signature; bh=zyDGscPJ+huice/tcfYAdj84PeWSNDv04KEtmNUhqvY=; fh=Aba2Blso/gbMe+vrAjhSnTsBo8W08CQT8skjZOZo/tY=; b=PcyEOOurUQxDpmVDF/UygAlLhIL1UvBihrVW/3GaczlVQh9B1w9qmUaNAKbKiPyRoY kIeGf4Xy9e2uRTfLks2rPuMeQL+j2e2AAVDsiLQOzblr5XHluMqoWb2JAmrt6mq+Iqwm RMcT/iZU3uYicjF/eOT71nnHObJJ1+JxZx+zlZyGt2QvXddeoDLaUuU0Pd0zrv1PjKC5 4IXSIj8Xkh8jrC53O+fTmzrn8wnEMre2JKOmtKeb2y+Kl3gfDgM5S5hM7DlU4MK043P8 kLHsOghLkhH/eDJDTx8XwmK/Ml+h8uK1AFl3EqwNKEjlGavd5TLFhNlgBcOWWExB5RR4 QA4g==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Tni1SIpF; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1760955411; x=1761560211; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:from:to:cc:subject:date:message-id :reply-to; bh=zyDGscPJ+huice/tcfYAdj84PeWSNDv04KEtmNUhqvY=; b=NmvL3M6VBT5VTkBwyKsqzPtrlltYREv4LXu6z8yip15xUlLz96lDeY9K1JBoqeJFf1 nR4MEpKfv6OamFE3iKGTaKlYhCYumwySP/jougiyaIDIMv/GpNC3O8ulmVuwTy8eBUfl j+VuycouKYdi566weKpUt7zP+lRk6MDErTCMj//mfUry/A8xcutSeuYi+f+3jeO9+gXG QAvh1MLfAPfjekbSNBmicBpRE7sLxT6PlIYpaknGZaC1d20bW7sF0ERykPkt+Cysln2q DZcWgTPqmYJoPl7JPTNW3FMdjUIFunELg6FMB/4/5WEtDTBTPqWacyjXj3818clGgSMF WT/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1760955411; x=1761560211; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-id:user-agent:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:x-beenthere:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=zyDGscPJ+huice/tcfYAdj84PeWSNDv04KEtmNUhqvY=; b=Adq3s0yx53wutarvX8wDYsCAgSVk0hy7bq7CGd3xXvPfGpeG5ms5c6ntsbz24z6dne 6SKHiqyJ5j3GYPDdqjqHceXe6Txc0UbXDS3a/6NZXEK311KPldsZ+Z0O1m41oWOoAE9t enXtXeNFej+/pC6Ea99MzotU+DGCCK9ZGEz6SjmcjdBXR/VNRsvMgoGzW1XS+Z/xCvBT FSs9JJRvmuNbiX6QgzF2Uk76QmWAYfmo79nCBbz5wToqeXugvsfGW5JxVDA0n+tVKIDO 3Elb46wzb0HPzXxhEArN1D1NNzCQ9xgCz2eg+VSArFg0k/5mzNB07UQKJz3W9D3BRqUM Zlow== X-Forwarded-Encrypted: i=3; AJvYcCV71kW3QG9L85n8XeJGuT/voEQIKGe4zje06c80ZOOWwDWymqg0bVQawShYtWPgBxZiUq2y@ilbers.de X-Gm-Message-State: AOJu0YzrwphXmm/tANmrsqD5GP5BtdyUt/U3jy36jpU/ByP3GSnauBrq xIDLCDZNNn5YwIvGwHvU1gosxNGt63lRlumvEgzV8vijuGsAY2CoqqyP X-Google-Smtp-Source: AGHT+IEmoaKLYlnXoJQ/Obu+ZpSla1he4Yd3DzgfAh/XWt2Ir7/Ksu2yAFjY1kpFxAVsv8PaCg45aQ== X-Received: by 2002:a17:902:d588:b0:290:d4d4:212f with SMTP id d9443c01a7336-290d4d42213mr131016975ad.22.1760955410474; Mon, 20 Oct 2025 03:16:50 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ARHlJd5HTxxJhB9QokwobgnJp4L4fZEbCJBrl92bUqKFkLE+bw==" Received: by 2002:a17:902:ed0a:b0:290:2a14:2eb0 with SMTP id d9443c01a7336-290a91d75b8ls16624735ad.0.-pod-prod-00-us; Mon, 20 Oct 2025 03:16:48 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCUeWfVbaYkYiorxwGLH/nFwH9sXWbRPP/dLavFbZ7RitFwW0xwGU/do07v3YKK8473ukeGdI5oqYoqZ@googlegroups.com X-Received: by 2002:a17:902:da88:b0:26c:4085:e3ef with SMTP id d9443c01a7336-290c740037fmr145818685ad.21.1760955408650; Mon, 20 Oct 2025 03:16:48 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1760955408; cv=pass; d=google.com; s=arc-20240605; b=ES7ZMndbXxFfuKzJ9LlNTQEFAJgWfLtB/efKpYAqp2GvZbFiwyZeXrE0qKjCqdO4sC y1/3OqHknUdXK0YADkA/AXQuJJjmHznZp7WCcDDDZ77TwW4Of2nYN+BT4QEytx/glZhH khqCikerRhtDBJK/qHJJ0Cccuekeznt688gW9XZbfyOs10zHGeXT/BmSb98BBFY5Zt2u SdNOSTau8e9cm+BBKNhe0W1lWNwytZDISZ8GpFlspjgr5k5vLrIe+S39X9koz0Z7pDiJ 3pFHzfh7XBk/2ZfGfrbHRvCTtkHkkwJxWAe6cJSMnK/G888WOt8uDq0PjfRvd0BSKcv/ 2FsQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:content-id:user-agent :content-language:accept-language:in-reply-to:references:message-id :date:thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=PlE8ZZ5mkqsxTRmyRVS/otZVQutSmj6c6rJl2+/4GNQ=; fh=Z2FqTtjMWeyPNk0S3mrZXvkRADVLOjCww+z8XAgXhmw=; b=Q/nB179BdSmf0C5r8V49ZGYe1L0818dtkjhvey3nPKH/wVY03aTKRbaVnBtC8dFY8N +S4bTpZF61D8K4dtLGF4+KubSaeLamHWO1mLqwxJK7n/TvwNDmOUv18LRNsunHZf0+g2 vv5kt5+hu5kwj+nfqwj4s76XDUbaZ83UlOh+8QvrbkcEXEK8pKqwfvw86OvBe+pU6T2M 9HQzhANJh2DHe2ylH+bKTrVdMe/a+GTnQaf02Fi2+1OsymMhoKm08hlORFG6Ln2ytlWD tBmepKVjUEBuMCHoG1LIBpT0iauhbaylhbA18KNhjMCQ8DNPAMMHi+2isgydWOb32Kxo sY/w==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Tni1SIpF; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c207::3]) by gmr-mx.google.com with ESMTPS id d9443c01a7336-292470a6808si4721205ad.3.2025.10.20.03.16.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Oct 2025 03:16:48 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c207::3 as permitted sender) client-ip=2a01:111:f403:c207::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=czERYlOkpwxl/tTlF62x6AT8Lo1c1Z3G4a8sH1tpk4+64iP3ycBgFV+R2rPpmLNmCl3nKJB6BAOs4aoRaUyA4ba5PG6IuV7kB+yhQ8ftVUx3h+6BOdpeMcSmnv2JxhuxB0NwuO6zVgpDDKQ0ZsT3f0O93XffPlGMo07ArqV6aSPzxSCM12ga8GOUJWdv44uiwe3cjdXJjTs7vZICI2um7iTnQPgPCAIBbgM8z4IpNUZMbRMJxQtO0cCN2BcbRHR/cbmFZ5SDvr4KP6uCYflEVu/rustK7clLZWg84jS0ASugn84Ehk7RRuL3Azbz7OQ6oQSgXd7zizo3Mf3nLMWkEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PlE8ZZ5mkqsxTRmyRVS/otZVQutSmj6c6rJl2+/4GNQ=; b=pLd3LHHEDY+QQlxlhuh8CQE3Tt8nxp152mKLh6ldPFTtF6XnHPrDaoUV4pICIPfIxmX9jhbKHRn/ocKqsrPbli8fR7rEyfp4X4d7qVRJbA8x9c/akpuFTYEH1+bG3FtkJl4D9DcSN+V2rLchx27hLXaScQyPF9IUS67mICvMz8E7t//jXL2i4+WgIjRRj3ZMB84U1A4M1Bcfz5WVb/QWM9XgAcnuoDAuysnHAbDNJiIDT3Hwvyh5LxzrZOw5wh40Rloc4PRPMJh4NVPR9ptrqnijxGR9rrFcbvWqJRIZYRpiNbpuOT/mtJvHexq2buGQvmVOYAHTsU9lDgZmp9WJjQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by DU4PR10MB9190.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:55a::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9228.16; Mon, 20 Oct 2025 10:16:45 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::8198:b4e0:8d12:3dfe%4]) with mapi id 15.20.9228.015; Mon, 20 Oct 2025 10:16:45 +0000 From: "'MOESSBAUER, Felix' via isar-users" To: "Steiger, Christoph" , "isar-users@googlegroups.com" , "wzh@ilbers.de" CC: "Kiszka, Jan" , "cedric.hombourger@siemens.com" , "Hillier, Gernot" Subject: Re: [PATCH v2 0/4] Add SBOM generation with debsbom Thread-Topic: [PATCH v2 0/4] Add SBOM generation with debsbom Thread-Index: AQHcJ50GoMmYzqbLi0mOZKIOmF++jLTK7EwAgAAZvAA= Date: Mon, 20 Oct 2025 10:16:45 +0000 Message-ID: References: <20250917063314.44769-1-christoph.steiger@siemens.com> In-Reply-To: Accept-Language: de-DE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Evolution 3.56.2-5 x-ms-publictraffictype: Email x-ms-traffictypediagnostic: DU0PR10MB6828:EE_|DU4PR10MB9190:EE_ x-ms-office365-filtering-correlation-id: 669a5cff-aa15-42f3-9eb9-08de0fc1c5f4 x-ms-exchange-atpmessageproperties: SA x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|38070700021; x-microsoft-antispam-message-info: =?utf-8?B?UG82bGRCRkVoaThwbldhdEU0Zm1Gd2hBZjlma3p4dFdHZVA2QnlHWWU2SUpa?= =?utf-8?B?U1QvbkhpYUZVT1JaR25LazBMNDB2RHNjbjhtSVQwV2VCVDB6NDlMcDlQaXFx?= =?utf-8?B?cUY2cnE0d2xXVzJaczZPWTBKN1kyY2hIS0x3bG41cTQ1SFFhcGFwMWwyOWY3?= =?utf-8?B?aHBOanV2b2kxYTAzZXFJeEE5NUo2MmRWSDN0cktPY2lwVis0L1U5T0JRYkFu?= =?utf-8?B?cC9jZVkzbmVhZDVzOXFqdVltZ1kxdVYvQTVPOXRGYloraTNPTy82UE9va3lq?= =?utf-8?B?UElVUzBkSGJhaU9SZlN6T083blFiWFhGMHBBUlJ4RFV3NE1CUVJWeFF4VVBZ?= =?utf-8?B?ancxZ2c0Vjk3QzFOZjBHaCsvajNuMTJ0NkZ0S1h6Umg0Ny9vdWlqNkpROXA0?= =?utf-8?B?WHdqam5YUVRBVmk0aWUycE12ZnlYQ3M0aG5kNjRhcXFBMGwrSGVjMFZtdENr?= =?utf-8?B?blUrMWJNMXdDYTVkajVkUlFpUVdSK0ZhTmJhV0VodjlXSFdrWWRGc3l3U0lP?= =?utf-8?B?QUd3bGxOMUxEZHVzUThya0RLK1N3ektYNUY2MkpIajhZY1EweW8zRGpMaDNX?= =?utf-8?B?MVcxM0p5ekhWNVYwRFJKQ2Z6c1BzNVhXQmVDN2dUYmhDZnFxQUtLTGNVZmIr?= =?utf-8?B?Zkg4OWg0YTJUVFU0SUVFQ2xSYzF4V2Z1cnBycEhDRW1NN3RhTmJrMU56MFpQ?= =?utf-8?B?WUxCWDFjRjZZdk1KUUROVjFmaGpHSzZsQnU0UTEyQkJkVkN0d21yWVB0TTJw?= =?utf-8?B?dUxkTWFKRzI2cWNwVTFtTFlMT05aRWZFbllCUkpSbTRkMEFqKzlsTkRiTHRs?= =?utf-8?B?eUIyaUVRdmw3dlhnWG5kMTRNd1hHMWg3SW1yYU14U0EvcFJ1VTd0Ty9uZ2tr?= =?utf-8?B?VkM5eUl0NE5UYXJwSzZUZkl4TDh2aGFETkxHWnNpdnNBVm9jdGNZOGErbUVQ?= =?utf-8?B?bW12Vk1jSzY2aXJNZ0FsQXFiQWY0RG0zRld4YVk4T1hzYTZTUXMrcXhqd2Ny?= =?utf-8?B?VFE0RmdueWtrUm9GYURJYlo3VTJVM1UzaEdFODhqTnM3TGZVdEdhWW9mc3lM?= =?utf-8?B?NHNIZHdSMFU2WTlZTVFaWnd3V1lwYVpzRk40RlpUZWoxRmRoK3IyYjlJckFj?= =?utf-8?B?Wno3Qmo5azlpMEN2dHBaejlVQ2FaWVMyTVRmc3VHeE53STVoNkZBRXFlVFk3?= =?utf-8?B?Nk84SU1UTjZaTlNxdnE5aTNmRTlBNTN2MVlFWFlBYkZUdEhmQS9UVm5PTkVh?= =?utf-8?B?K2V6NGxiY1BwMDFIbVpCb054L21Nb2FPdnRzSFJoQWVLa0hUaXNoaytoMm5W?= =?utf-8?B?N0VxN1E2dXJIMDBvcTIzUkw2b1NmR1p4dmplYkVTeEE3QXR3U0JEZjBpQmc4?= =?utf-8?B?MnlBOXYyWlBJa21YcG1rT2FTdGxrTTVLNkIrVFRxRUNlZzZaNkxEUWtPbUsy?= =?utf-8?B?Mi8zNW5JZmNDT3Q3MFhOY0VaSWJBWU5HQ09tYUpvdE1ISisxK08wT3VZSUhT?= =?utf-8?B?VG02U21yNFVWMlFhUUJJQysyNzBMRHQraWN0K3dGaTFHdm5XRkMwTlQ3ZVNG?= =?utf-8?B?TVI3YnR2UExFMnYzeWtoa2prQzhBWUFuS25HWUxEYmxzcVB6dHY3SjBkQU83?= =?utf-8?B?N2NLd3p3b3RPZS96VWhoMmJaYVV0YVpJVGFobFROY2FsVE1ocDV5RXY3enJR?= =?utf-8?B?WkVDNU9iU2pJdUdQQTFoWlpZSU1GYUpiejEwd3lTYmoxUmhSRUNMY1VmY3pU?= =?utf-8?B?bmprV2d0VU1WODczZTB3a2dobUR0MWdLWjRhYnI4aVRsMi9CaTlPRk1HYUlw?= =?utf-8?B?WnVxcXBOa1hjbFhXWGRHSjRIU2Y0Z0QvalRRQUZmQU84TUZCTjExQmQ0UkQ0?= =?utf-8?B?MUZ6RE4yVkdneGI0OWhydkxLbGUrbU5TamRBQ1dOdEl6RjdkNzQxVy9Lb0NF?= =?utf-8?B?bzZCcE1keGJMQ05YWjRsd3BBMEI3Rkg0cHNMTC9TbVh6ajNuMEpuQVhoMGxp?= =?utf-8?B?ekRaSmVDdEFRPT0=?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(38070700021);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?YWtrM2wwbTRaa3BwU0xIakZ6Y1hkemgyR1M1YUpBRjJsV1REaGgrOGZsd1VF?= =?utf-8?B?VHR5S2MrMlgvU0RSZDBzRHg3cGt3aTBtc2NKeWpjY21MT01YUW4yL2xnMS81?= =?utf-8?B?VEhGMUZOS2pYbGpRVFFEQnF4N2J4SWVwZDFtb0pZTlZnSnM5amFUQnp3Sm92?= =?utf-8?B?VTAvS1JUVGFvWm83K3NHNTBCNFRRQ2FlUHNyVXd3ekhnYUpST0VhbGJnSzFn?= =?utf-8?B?ZGhvd2ZFUVp3cHN0elcyMUpMdlBrWDRrUmdMdnVxYmdtNDRuSDdYQnp2M1NW?= =?utf-8?B?dlhDV1lGOENaek4xOE9QWmllTG80eGZSQWVhb0ZTQlFhYXlrWmpDSXY4MkJR?= =?utf-8?B?K2tqMTMrQmdPdzJwYUxvZ0twQkFhZGh1a3RJTXVWSG5DeXhIa0hqTzI3OUNK?= =?utf-8?B?cjl6NnpLc3doY0lXWnpSUm5RbGYxYTBtdnRGR2ZSZGRrRVVzY0xVR01WQjcx?= =?utf-8?B?NUJLb2diQVJRK0ZXSGpXZTZqVEtBWHVmaW5rYUV2RENNa3plUEdFNUQzMklS?= =?utf-8?B?YS9IQytRNXgrSytzcHVGTmd4aWh1czh5Tk5GTVRyNTB2Wnhkc0dITS9iY0ZY?= =?utf-8?B?SS9JYVNSZy9CRzg3Z0hoVGczRmpocmxMcGNTQXM5WHBiK2xNMzhsYXlKN1FW?= =?utf-8?B?MFNaWldQT1hwNE1uVVY4cStGbHR0cjU2VlFFWTJjV251UTdqWTh4UlIzYm1W?= =?utf-8?B?ZDMveWNaTVpZK2NQV0wyZlRKY09QdC9pMHJzTUloaUN5UXpnTXlhNjZyKzkw?= =?utf-8?B?elhyRlNxZE9iQkFxY0FGUURVMm0xRm9PbGRPb3RZekRTZVczeWVlZS9WZk1j?= =?utf-8?B?V0diSFdiK2I3M2kvNUpkUlcveHJCdzJqYkpWeFdMQ2NTUXFKSmRpdVBWUlEx?= =?utf-8?B?MXlISGVqV2NpclJTTkhjcjNoV2R2eTBvZkwyb3RMQnlnU3FKTEVjSE5jQngz?= =?utf-8?B?NWZzOTRGSWRpUXdWdDc0Zng5UGl6UUpDQXFNQUg5Tnp1cExLbnRoSmZ1cjl6?= =?utf-8?B?TkpTcHdnbHRSNWJqMzBmb21oakZHS3FHb09Ia1RGdFRvR2hZeTMzZVZTTUJl?= =?utf-8?B?c2Z6M1g0YVg3eDRXMWdSQjdJN0VFVHNBeHljZ0FwZU9ZS3Y5RXIvRDFMUFhl?= =?utf-8?B?R0lJUWUraTZtL3RUNklrSGpzQURIOFYrcDE2YzV0SXJqTnB3LzU3KzNIUlpV?= =?utf-8?B?NitLdW91bTdaNllDdEtVK25vWXNvZ001ZWRKSGpTMHRCcERkUTFVUkVFQS9J?= =?utf-8?B?SnQ4WUNDNjdJT0dBZEZkQ3FGUnVrSldCWVV2ZnJjUEhRbldpbCs2SzZYY21C?= =?utf-8?B?bEs1b1pqdVlwMGZxRmY3M09sVmJzYmd3K3JRNnFiMUtuOWdWNnR5SHNFVWs3?= =?utf-8?B?c2JsOXhZUFBlRDlyditGckJIZTdtb1ByUGwvd2xZbE50UTFFVkxuYmZ1azdN?= =?utf-8?B?eVFsak5CenlEUGcrQUpsVVZEV2V6RVU2Q2FMck9wOVFWbXFmeWN0dGNuMStp?= =?utf-8?B?Vm9WRXB6T0Q1ZFlQZVdIbG1TWHJEVmJ5RkJkQkw2aG1ENkFLZlh5VFhCK2lB?= =?utf-8?B?RTFDWGIxR0FVRWlwUlYrd0ZkVkIwOGw2dmpsNkwyWDZOb3IwMytZajFtb3pO?= =?utf-8?B?YXVIeWZJRVNtb1ZwaW9YK21TWTVYUEEycWc1MytnQy8wUUVJQ3ZTNFRtZ01K?= =?utf-8?B?YTUwMFRNNStiMnVtMXZzVkkxclJEOW82RWpJMHhqa3IvOXJGbjBBSXhyeVoz?= =?utf-8?B?Vy8xRUNtY0dUN3AycURxOGxjODM3Z3NwMmdoMHJFRUo2M1ZLRzhubTFlblhG?= =?utf-8?B?K2VEM043Z1p5MlNLRjB6ci8rdVJZaUZNWHdlVUxxREZHOXlrRFZBZ0xwcmQ1?= =?utf-8?B?ZnVCeHkxNFdHVkRoV0FYNm1zVE1qQXJ6RmxRR0NSWG5aVlBPN0RYTlVKK2lw?= =?utf-8?B?dXhab2NBbzlOYTk0Z0dGbXV0YjBlbmIvOGorbG1BQlZnbndDUDBQcGRVQnl4?= =?utf-8?B?NEFJMTVib21IT042VzhpSk9kVEJ6cUVNNTdxZmJIY2pHaEQ1SXJ6WG9BWWts?= =?utf-8?B?OHFPTEV5azdpdGVhN3QyVHp4Y0tnZEVPclZ0WEwwN0lMV2tmTHlNVGJwTG5P?= =?utf-8?B?QnFsMTJ4Y3dRRE5rdWJMSm1HS1BFSTVDbDBZdkoyREc0NmxZd3VPbkFoczdz?= =?utf-8?Q?lV3Q2ppupqgb9KMS9JrQI9Q=3D?= Content-Type: text/plain; charset="UTF-8" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 669a5cff-aa15-42f3-9eb9-08de0fc1c5f4 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Oct 2025 10:16:45.7343 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dHr6nVJXhrS5to04QzhZwYl65xWupoECUrZDFQd2XQJsDhubDF5pknH2hV8HrJleInVSx6VjQWpgVvwb3JkEwzUKZdKa8KWH8GzhUSG+pz8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR10MB9190 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=Tni1SIpF; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: "MOESSBAUER, Felix" Reply-To: "MOESSBAUER, Felix" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: CiBjxUoLHd0a On Mon, 2025-10-20 at 10:44 +0200, Zhihang Wei wrote: > Hello, >=20 > When testing this patch set on full CI, the following test failed: > - citest.py:ReproTest.test_repro_signed >=20 > Error log follows: > [stdlog] 2025-10-07 12:02:43,784 avocado.app cibuilder L0322 ERROR|=20 > ERROR: mc:qemuarm64-bookworm:isar-image-base-1.0-r0=20 > do_rootfs_postprocess:=20 > ExecutionError('/build/isar_wzh_devel_2/8/build/tmp/work/debian-bookworm-= arm64/isar-image-base-qemuarm64/1.0-r0/temp/run.generate_sbom.2562126',=20 > 255, None, None) > [stdlog] 2025-10-07 12:02:43,788 avocado.app cibuilder L0322 ERROR|=20 > ERROR: Logfile of failure stored in:=20 > /build/isar_wzh_devel_2/8/build/tmp/work/debian-bookworm-arm64/isar-image= -base-qemuarm64/1.0-r0/temp/log.do_rootfs_postprocess.2562126=20 >=20 > [stdlog] 2025-10-07 12:02:43,788 avocado.test cibuilder L0320 INFO | Log= =20 > data follows: > [stdlog] 2025-10-07 12:02:43,789 avocado.app cibuilder L0322 ERROR|=20 > ERROR: Task=20 > (mc:qemuarm64-bookworm:/build/isar_wzh_devel_2/8/meta-isar/recipes-core/i= mages/isar-image-base.bb:do_rootfs_postprocess)=20 > failed with exit code '1' > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing python function do_rootfs_postprocess > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function rootfs_do_mounts > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function rootfs_do_mounts finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function rootfs_do_qemu > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function rootfs_do_qemu finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function image_posprocess_disable_systemd_firstboo= t > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > Created symlink /etc/systemd/system/systemd-firstboot.service -> /dev/nul= l. > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function image_posprocess_disable_systemd_firstboot finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function image_postprocess_sshd_key_regen > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > find:=20 > '/build/isar_wzh_devel_2/8/build/tmp/work/debian-bookworm-arm64/isar-imag= e-base-qemuarm64/1.0-r0/rootfs/etc/ssh/':=20 > No such file or directory > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function image_postprocess_sshd_key_regen finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function image_postprocess_machine_id > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > uninitialized > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function image_postprocess_machine_id finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function image_postprocess_mark > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > WARNING: You are using external layers that will not be considered in=20 > the build_id. Consider changing ISAR_RELEASE_CMD. > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > BUILD_ID=3D"v0.11-79-g7dcbb204" > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > VARIANT=3D"Isar target filesystem" > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > VARIANT_VERSION=3D"1.0" > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function image_postprocess_mark finished > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function image_postprocess_configure > [stdlog] 2025-10-07 12:02:43,811 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function image_postprocess_configure finished > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing python function do_generate_sbom > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function generate_sbom > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > ERROR:debsbom.cli:'Origin' > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > debsbom: error: 'Origin' > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > WARNING: exit code 255 from a shell command. > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Python function do_generate_sbom finished > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Executing shell function rootfs_do_umounts > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Shell function rootfs_do_umounts finished > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO | |=20 > DEBUG: Python function do_rootfs_postprocess finished > [stdlog] 2025-10-07 12:02:43,812 avocado.test cibuilder L0320 INFO |=20 > NOTE: recipe isar-image-base-1.0-r0: task do_rootfs_postprocess: Failed >=20 > I think it is complaining about some packages does not have the optional > "Origin" field. This has been fixed in debsbom repo with > 034fc6af775a796cd67f5e4bfca013e99f7b8a5f, but your python-sbom receipe > pulls a earlier version which does not contain this patch. Hi, thanks for testing this. I noticed another bug on HOST_ARCH !=3D DISTRO_ARCH when creating a derived distro (e.g. in isar-cip-core). All these will be fixed in a v3. We plan to cut a v0.3 release this week and then send out a patch series with the fixes. By then, we also will have a "merging" support in the sbom tooling to merge the SBOMs of the initrd, imaging and rootfs into a uniform document. This should finally solve the issue of missing dependencies in the BOM. >=20 > You can redo the test on your machine using avocado: > 1. Have a clean clone of isar, checkout to branch next and apply your=20 > patches: > $ git clone -b next https://github.com/ilbers/isar.git > $ cd isar > $ git am /path-to/0001-my-contribution-to-isar.patch > 2.Run kas shell, setup CI prerequisites (avocado, qemu) and cleanup: >=20 > $ ./kas/kas-container shell kas/isar.yaml --command \ > =C2=A0 =C2=A0 "rm -rf /work/build/conf && /work/scripts/ci_setup.sh" > 3.Run the failed test: > $ cd /work/testsuite > $ avocado run citest.py:ReproTest.test_repro_signed Many thanks, that helps a lot. Maybe this could also be added to the contributing guide (if not already) as some of these steps were not obvious for me. Best regards, Felix >=20 > Best regards, > Zhihang >=20 > On 9/17/25 08:33, 'Christoph Steiger' via isar-users wrote: > > This patchset adds proper SBOM generation in the two standard formats > > SPDX and CycloneDX during the rootfs generation process. > >=20 > > The generation is itself is handled by a SBOM generator `debsbom` [1] > > which is developed as an open source project at Siemens. It is still > > early in development, but it has enough features for what we require > > in isar. The required dependencies which are not yet available as > > Debian packages were minimally packaged directly in isar too. > >=20 > > This is a followup of the previous RFC [2]. Since then the series has > > changed a lot. The SBOM generation was moved from a simple OE lib to > > `debsbom`. This also meant the introduction of a separate chroot was > > necessary. The SBOM generation process was also moved from the image > > step to the rootfs step, along with a lot of minor changes and > > improvements. > >=20 > > [1] https://github.com/siemens/debsbom > > [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ > >=20 > > Changes since v1: > >=20 > > - remove tarball > > - refactor packaging (auto-derive python dependencies) > > - only build missing packages (varies on bookworm, trixie, noble) > > - add ubuntu support > > - only generate sboms for supported distributions (bookworm/jammy and > > onwards) > > - update debsbom (includes bug fixes and more information for source > > packages) > >=20 > > Christoph Steiger (3): > > meta: package python libraries for SBOM generation > > meta: package python3-debsbom > > meta: add SBOM generation with debsbom > >=20 > > Felix Moessbauer (1): > > override distro vendor in SBOM on Ubuntu > >=20 > > meta-isar/conf/distro/ubuntu-common.inc | 2 + > > meta/classes/image.bbclass | 8 ++- > > meta/classes/rootfs.bbclass | 7 ++- > > meta/classes/sbom.bbclass | 62 ++++++++++++++++++= + > > meta/classes/sdk.bbclass | 2 +- > > .../sbom-chroot/sbom-chroot.bb | 30 +++++++++ > > .../python3-beartype/files/rules | 8 +++ > > .../python3-beartype_0.19.0.bb | 29 +++++++++ > > .../files/pybuild.testfiles | 1 + > > .../python3-cyclonedx-lib/files/rules | 8 +++ > > .../python3-cyclonedx-lib_9.1.0.bb | 48 ++++++++++++++ > > ...icense-description-in-pyproject.toml.patch | 28 +++++++++ > > .../python3-debsbom/files/rules | 8 +++ > > .../python3-debsbom/python3-debsbom_0.0.1.bb | 44 +++++++++++++ > > .../python3-packageurl/files/rules | 8 +++ > > .../python3-packageurl_0.16.0.bb | 33 ++++++++++ > > .../python3-py-serializable/files/rules | 8 +++ > > .../python3-py-serializable_2.0.0.bb | 38 ++++++++++++ > > .../python3-spdx-tools/files/rules | 25 ++++++++ > > .../python3-spdx-tools_0.8.3.bb | 46 ++++++++++++++ > > 20 files changed, 440 insertions(+), 3 deletions(-) > > create mode 100644 meta/classes/sbom.bbclass > > create mode 100644 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb > > create mode 100644 meta/recipes-support/python3-beartype/files/rules > > create mode 100644 meta/recipes-support/python3-beartype/python3-bear= type_0.19.0.bb > > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/p= ybuild.testfiles > > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/files/r= ules > > create mode 100644 meta/recipes-support/python3-cyclonedx-lib/python3= -cyclonedx-lib_9.1.0.bb > > create mode 100644 meta/recipes-support/python3-debsbom/files/0001-Us= e-old-license-description-in-pyproject.toml.patch > > create mode 100644 meta/recipes-support/python3-debsbom/files/rules > > create mode 100644 meta/recipes-support/python3-debsbom/python3-debsb= om_0.0.1.bb > > create mode 100644 meta/recipes-support/python3-packageurl/files/rule= s > > create mode 100644 meta/recipes-support/python3-packageurl/python3-pa= ckageurl_0.16.0.bb > > create mode 100644 meta/recipes-support/python3-py-serializable/files= /rules > > create mode 100644 meta/recipes-support/python3-py-serializable/pytho= n3-py-serializable_2.0.0.bb > > create mode 100644 meta/recipes-support/python3-spdx-tools/files/rule= s > > create mode 100644 meta/recipes-support/python3-spdx-tools/python3-sp= dx-tools_0.8.3.bb > >=20 --=20 Siemens AG Linux Expert Center Friedrich-Ludwig-Bauer-Str. 3 85748 Garching, Germany --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= ad7c6e06fc9b6524768a23c2e3d4c4c1df1615eb.camel%40siemens.com.