Re: [PATCH v6 00/10] Add SBOM generation with debsbom

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Mon, 2025-12-01 at 10:15 +0100, Jan Kiszka wrote:
> On 01.12.25 09:58, Felix Moessbauer wrote:
> > This patchset adds proper SBOM generation in the two standard formats
> > SPDX and CycloneDX during the rootfs generation process.
> > 
> > The generation is itself is handled by a SBOM generator  `debsbom` [1]
> > which is developed as an open source project at Siemens. It is still
> > early in development, but it has enough features for what we require
> > in isar. The required dependencies which are not yet available as
> > Debian packages were minimally packaged directly in isar too.
> > 
> > This is a followup of the previous RFC [2]. Since then the series has
> > changed a lot. The SBOM generation was moved from a simple OE lib to
> > `debsbom`. This also meant the introduction of a separate chroot was
> > necessary. The SBOM generation process was also moved from the image
> > step to the rootfs step, along with a lot of minor changes and
> > improvements.
> > 
> > [1] https://github.com/siemens/debsbom
> > [2] https://groups.google.com/g/isar-users/c/8L-CF4BJY0I/m/p0N3o_zfAAAJ
> > 
> > Changes since v5:
> > 
> > - fix isar-image-ci on qemuamd64-bullseye (set IMAGER_BOM according to
> >   machine changes made in image file)
> > - rebased onto next
> > 
> > Changes since v4:
> > 
> > - rebased onto next
> > - fix race condition on creation of ${DEPLOY_DIR_SBOM} (aka ${DEPLOY_DIR_IMAGE})
> > 
> > Changes since v3:
> > 
> > - fix issue on external bullseye initramfs (we now disable sbom generation
> >   on all unsupported distros rootfs instances)
> > - update debsbom to v0.4.0
> > - rebased onto next
> > 
> > Changes since v2:
> > 
> > - fix issues when HOST_ARCH != DISTRO_ARCH on derived distributions
> > - update debsbom to v0.3.0, which fixes the Origin: bug reported in v2
> > - generate SBOM for imager as well and create merged sbom of .wic image
> > - resend imager manifest + wic manifest patches to reduce conflicts
> > 
> > Note, that the patches p1-p5 are most important as they add basic SBOM
> > support. The remaining patches address the imager + .wic bom part,
> > which also can be merged later on.
> > 
> > Changes since v1:
> > 
> > - remove tarball
> > - refactor packaging (auto-derive python dependencies)
> > - only build missing packages (varies on bookworm, trixie, noble)
> > - add ubuntu support
> > - only generate sboms for supported distributions (bookworm/jammy and
> >   onwards)
> > - update debsbom (includes bug fixes and more information for source
> >   packages)
> > 
> > 
> > Christoph Steiger (3):
> >   meta: package python libraries for SBOM generation
> >   meta: package python3-debsbom
> >   meta: add SBOM generation with debsbom
> > 
> > Felix Moessbauer (7):
> >   refactor: move get_rootfs_distro from sdk into rootfs
> >   override distro vendor in SBOM on Ubuntu
> >   add support to add imager dependencies to BOM
> >   wic: create uniform manifest describing all image components
> >   qemuamd64: add IMAGER_BOM entries
> >   imager: create SBOM of IMAGER_BOM packages
> >   wic: create uniform SBOM describing all image components
> > 
> >  doc/user_manual.md                            |  1 +
> >  meta-isar/conf/distro/ubuntu-common.inc       |  2 +
> >  meta-isar/conf/machine/qemuamd64.conf         |  1 +
> >  .../recipes-core/images/isar-image-ci.bb      |  1 +
> >  meta/classes/image-tools-extension.bbclass    | 29 +++++++++
> >  meta/classes/image.bbclass                    |  7 ++
> >  meta/classes/imagetypes_wic.bbclass           | 30 +++++++++
> >  meta/classes/initramfs.bbclass                |  3 +-
> >  meta/classes/rootfs.bbclass                   | 23 ++++++-
> >  meta/classes/sbom.bbclass                     | 65 +++++++++++++++++++
> 
> New classes should go into the right category already, then rebasing is
> easier for whoever has to do it in the light of
> https://patchwork.isar-build.org/project/isar/list/?series=1780. Look at
> the dracut series.

Hi, according to my interpretation of the use-more-classes series and
the dracut series, the sbom class is already correct. The sbom series
also cleanly applies and works on top of the use-more-classes series.

Felix

> 
> Jan
> 
> -- 
> Siemens AG, Foundational Technologies
> Linux Expert Center

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/c52a6c4481da1f6f3ca2a01b8e7948ef33b0bcc0.camel%40siemens.com.