[PATCH 0/1] Add SBOM generation with debsbom

[PATCH 0/1] Add SBOM generation with debsbom

[srinuvasan.a via isar-users]

From: srinuvasan <srinuvasan.a@siemens.com>

Includes additional fixes alongside the following patch series
https://groups.google.com/g/isar-users/c/4JntAI3gL1s

srinuvasan (1):
  meta: derive ROOTFS_DISTRO correctly in sbom-chroot's
    do_prepare_rootfs

 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 5 -----
 1 file changed, 5 deletions(-)

-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250911130408.3836054-1-srinuvasan.a%40siemens.com.

[PATCH 1/1] meta: derive ROOTFS_DISTRO correctly in sbom-chroot's do_prepare_rootfs

[srinuvasan.a via isar-users]

From: srinuvasan <srinuvasan.a@siemens.com>

In downstream layers, the ROOTFS_DISTRO may differ from "debian".
During `rootfs_prepare` of `sbom-chroot`, this causes failures such as:

  | DEBUG: Executing shell function rootfs_prepare
  | tar: .../debian-bookworm-amd64.tar.zst: Cannot open: No such file or directory
  | tar: Error is not recoverable: exiting now
  | WARNING: exit code 2 from a shell command.

The actual bootstrap archive generated was:
  industrial-bookworm-amd64.tar.zst

Fix this by deriving ROOTFS_DISTRO from the current DISTRO, ensuring the
bootstrap tarball is unpacked and configured correctly.

As part of this change, remove `ROOTFS_DISTRO`, `ROOTFS_ARCH`, and
`ROOTFS_BASE_DISTRO` from the `sbom-chroot` recipe.

This modification brings it in line with the sbuild-chroot-target recipe.

Note: The sbom class is already inherited via rootfs, so it can be removed from the sbom-chroot recipe.

Signed-off-by: srinuvasan <srinuvasan.a@siemens.com>
---
 meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
index 6f27f842..7f5ebc5b 100644
--- a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
+++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
@@ -8,11 +8,6 @@ LIC_FILES_CHKSUM = "file://${LAYERDIR_core}/licenses/COPYING.GPLv2;md5=751419260
 PV = "1.0"
 
 inherit rootfs
-inherit sbom
-
-ROOTFS_ARCH = "${HOST_ARCH}"
-ROOTFS_DISTRO = "${HOST_DISTRO}"
-ROOTFS_BASE_DISTRO = "${HOST_BASE_DISTRO}"
 
 ROOTFS_FEATURES = "no-generate-initrd"
 
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20250911130408.3836054-2-srinuvasan.a%40siemens.com.

Re: [PATCH 1/1] meta: derive ROOTFS_DISTRO correctly in sbom-chroot's do_prepare_rootfs

['MOESSBAUER, Felix' via isar-users]

On Thu, 2025-09-11 at 18:34 +0530, srinuvasan.a@siemens.com wrote:
> From: srinuvasan <srinuvasan.a@siemens.com>
> 
> In downstream layers, the ROOTFS_DISTRO may differ from "debian".
> During `rootfs_prepare` of `sbom-chroot`, this causes failures such as:
> 
>   | DEBUG: Executing shell function rootfs_prepare
>   | tar: .../debian-bookworm-amd64.tar.zst: Cannot open: No such file or directory
>   | tar: Error is not recoverable: exiting now
>   | WARNING: exit code 2 from a shell command.
> 
> The actual bootstrap archive generated was:
>   industrial-bookworm-amd64.tar.zst
> 
> Fix this by deriving ROOTFS_DISTRO from the current DISTRO, ensuring the
> bootstrap tarball is unpacked and configured correctly.
> 
> As part of this change, remove `ROOTFS_DISTRO`, `ROOTFS_ARCH`, and
> `ROOTFS_BASE_DISTRO` from the `sbom-chroot` recipe.
> 
> This modification brings it in line with the sbuild-chroot-target recipe.
> 
> Note: The sbom class is already inherited via rootfs, so it can be removed from the sbom-chroot recipe.
> 
> Signed-off-by: srinuvasan <srinuvasan.a@siemens.com>
> ---
>  meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 5 -----
>  1 file changed, 5 deletions(-)
> 
> diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> index 6f27f842..7f5ebc5b 100644
> --- a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> +++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> @@ -8,11 +8,6 @@ LIC_FILES_CHKSUM = "file://${LAYERDIR_core}/licenses/COPYING.GPLv2;md5=751419260
>  PV = "1.0"
>  
>  inherit rootfs
> -inherit sbom

This patch is based on the SBOM patchset which is not merged yet.
Please directly provide your feedback on the SBOM patchset to fix it
there.

Best regards,
Felix

> -
> -ROOTFS_ARCH = "${HOST_ARCH}"
> -ROOTFS_DISTRO = "${HOST_DISTRO}"
> -ROOTFS_BASE_DISTRO = "${HOST_BASE_DISTRO}"
>  
>  ROOTFS_FEATURES = "no-generate-initrd"
>  
> -- 
> 2.39.5

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/926597cebe2ceb36c562208b85c98ef397ef14c6.camel%40siemens.com.

Re: [PATCH 0/1] Add SBOM generation with debsbom

[Srinuvasan Arjunan]

[-- Attachment #1.1: Type: text/plain, Size: 1097 bytes --]

Hi Steiger,

In this patch series, the first patch (*meta: package Python dependencies 
for SBOM generation*) does not work on foreign architectures. I have fixed 
those cross-build issues — shall I send a v2 of this patch in the series?  

Many thanks,
Srinu

On Thursday, September 11, 2025 at 6:31:54 PM UTC+5:30 
srinuv...@siemens.com wrote:

From: srinuvasan <srinuv...@siemens.com> 

Includes additional fixes alongside the following patch series 
https://groups.google.com/g/isar-users/c/4JntAI3gL1s 

srinuvasan (1): 
meta: derive ROOTFS_DISTRO correctly in sbom-chroot's 
do_prepare_rootfs 

meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 5 ----- 
1 file changed, 5 deletions(-) 

-- 
2.39.5 

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/96a80423-234b-4dcc-9620-5209f2744e4dn%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 1884 bytes --]

Re: [PATCH 0/1] Add SBOM generation with debsbom

[Srinuvasan Arjunan]

[-- Attachment #1.1: Type: text/plain, Size: 2698 bytes --]

Hi,

        When generating SBOM for foreign architectures (e.g., arm64), some 
Python packages fail to build. One such example is 
python3-cyclonedx-python-lib. During arm64 builds it throws the below error:

| The following packages have unmet dependencies:
|  sbuild-build-depends-main-dummy:arm64 : Depends: dh-python:arm64
|                                          Depends: python3-all:arm64 but 
it is not going to be installed
|                                          Depends: python3-setuptools:arm64
|                                          Depends: 
pybuild-plugin-pyproject:arm64
|                                          Depends: python3-hatchling:arm64 
but it is not installable


The fix is to add the :native suffix for Python build dependencies. For 
example:

DEBIAN_BUILD_DEPENDS = "debhelper (>= 11~), \
    dh-python, \
    python3-all:native, \
    python3-setuptools, \
    pybuild-plugin-pyproject, \
    python3-poetry:native, \
    python3-py-serializable:native, \
    python3-packageurl-python:native, \
    python3-sortedcontainers, \
    python3-ddt:native, \
    python3-defusedxml:native, \
    python3-license-expression:native, \
    python3-jsonschema:native, \
    python3-lxml:native, \
"

In short, Python recipes required for the build must explicitly use the 
:native suffix to avoid cross-architecture dependency resolution issues.

Similar fixes are needed for all the python recipes in this patch.

Many thanks,
Srinu

On Friday, September 12, 2025 at 1:47:13 PM UTC+5:30 Srinuvasan Arjunan 
wrote:

Hi Steiger,

In this patch series, the first patch (*meta: package Python dependencies 
for SBOM generation*) does not work on foreign architectures. I have fixed 
those cross-build issues — shall I send a v2 of this patch in the series?  

Many thanks,
Srinu


On Thursday, September 11, 2025 at 6:31:54 PM UTC+5:30 srinuv...@siemens.com 
wrote:

From: srinuvasan <srinuv...@siemens.com> 

Includes additional fixes alongside the following patch series 
https://groups.google.com/g/isar-users/c/4JntAI3gL1s 

srinuvasan (1): 
meta: derive ROOTFS_DISTRO correctly in sbom-chroot's 
do_prepare_rootfs 

meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 5 ----- 
1 file changed, 5 deletions(-) 

-- 
2.39.5 

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/cce16b7c-3500-494e-b8ae-3f4365909124n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 5080 bytes --]

Re: [PATCH 0/1] Add SBOM generation with debsbom

['MOESSBAUER, Felix' via isar-users]

On Fri, 2025-09-12 at 02:34 -0700, Srinuvasan Arjunan wrote:
> Hi,
> 
>         When generating SBOM for foreign architectures (e.g., arm64), some Python packages fail to build. One such example is python3-cyclonedx-python-lib. During arm64 builds it throws the below error:
> 
> | The following packages have unmet dependencies:
> |  sbuild-build-depends-main-dummy:arm64 : Depends: dh-python:arm64
> |                                          Depends: python3-all:arm64 but it is not going to be installed
> |                                          Depends: python3-setuptools:arm64
> |                                          Depends: pybuild-plugin-pyproject:arm64
> |                                          Depends: python3-hatchling:arm64 but it is not installable
> 
> 

Hi, this happens because we cross-compile the arch:all package (which
we shoudn't) and also bitbake dependencies are not propagated
correctly. Fixing all that has been taken care of in the following
patches:

- handle DPKG_ARCH=all case for transitive deps
- dpkg-raw: add files to source package

These are not yet applied (but hopefully they will be soon).

Felix


-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/d5e03b8a704b286ad440a7e0ac360e89f12196e0.camel%40siemens.com.