Re: [PATCH v3 00/10] Add SBOM generation with debsbom

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Mon, 2025-10-27 at 07:54 +0000, Bouška, Zdeněk (FT D EU CZ PDS1 ICC
1) wrote:
> > Yes, definitely. At least in my SPDX SBOM this is listed (need to
> > create a CDX one). Are you sure your bash magic is right?
> 
> Grub is not in SBOMs even if I look for it by text search.
> 
> Reproduce:
> 
> $ cat trixie_amd64.yml
> header:
>   version: 14
> 
> build_system: isar
> 
> machine: qemuamd64
> distro: debian-trixie
> 
> target: mc:qemuamd64-trixie:isar-image-base
> 
> repos:
>   isar:
>     path: isar
>     layers:
>       meta:
>       meta-isar:
> 
> 

Thanks for insisting on this. I found the bug. It was a simple glitch
in the naming of the imager SBOM which apparently slipped in while
refactoring. The following patch fixes it (will be fixed in the v4 as
well):

diff --git a/meta/classes/image-tools-extension.bbclass
b/meta/classes/image-tools-extension.bbclass
index bfdb8a35..95f003d0 100644
--- a/meta/classes/image-tools-extension.bbclass
+++ b/meta/classes/image-tools-extension.bbclass
@@ -93,7 +93,7 @@ generate_imager_sbom() {
         --bind $schroot_dir /mnt/rootfs \
         --bind ${WORKDIR} /mnt/deploy-dir \
         -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
-            --from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/'${PN}-
${DISTRO}-${MACHINE}-imager' \
+            --from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \
             --distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-
supplier '${SBOM_DISTRO_SUPPLIER}' \
             --distro-version '${SBOM_DISTRO_VERSION}' --distro-arch
'${DISTRO_ARCH}' \
             --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \


> 
> 
> I still got these SHA256 warnings, same as with custom kernel:
> 
> $ debsbom download --outdir downloads --sources tmp/trixie_amd64_wic/build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.cdx.json
> WARNING:debsbom.download.resolver:no sha256 digest for linux@6.12.48-1. Lookup will be imprecise
> WARNING:debsbom.download.resolver:no sha256 digest for linux-signed-amd64@6.12.48+1. Lookup will be imprecise
> WARNING:debsbom.download.resolver:no sha256 digest for openssl@3.5.1-1+deb13u1. Lookup will be imprecise
> downloading 232 files, 545 MiB (cached: 0, 0 KiB)
> 
> > Hi, this means that the package was not found in the apt-cache. Did you
> > try this series with a fresh build-dir (sstate cache is ok)?
> > 
> Warnings with custom patched kernel are these. Now I made sure, that I deleted build dir:
> WARNING:debsbom.download.resolver:no sha256 digest for linux-mainline@6.17.2+r0. Lookup will be imprecise
> WARNING:debsbom.commands.download:not found upstream: linux-mainline@6.17.2+r0  <- this is expected 
> WARNING:debsbom.download.resolver:no sha256 digest for openssl@3.5.1-1+deb13u1. Lookup will be imprecise

All these warnings are from built-using (except maybe for
linux-mainline@6.17.2+r0). We discussed the topic upstream with the
reproducible builds people [1] and finally came to the conclusion, that
a name+version tuple is sufficient to identify a package (at least for
the content of the package, the signature still needs clarification).
By that, we will downgrade that warning to a info message (and add some
explantaion to the documentation) [2].

[1] https://github.com/siemens/debsbom/pull/112
[2] https://lists.debian.org/debian-devel/2025/10/msg00236.html

Best regards,
Felix

> 
> Zdenek Bouska
> 
> -- 
> Siemens, s.r.o
> Foundational Technologies

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/bc0005f268b05309fb135f037c010d316f1ad08d.camel%40siemens.com.