mbox series

[0/6] Rework SBOM generation

Message ID 20260720081347.3835974-1-felix.moessbauer@siemens.com
Headers show
Series Rework SBOM generation | expand

Message

Felix Moessbauer July 20, 2026, 8:13 a.m. UTC 
The SBOM generation currently fails to capture the package checksums
in case of partial rebuilds. This is because the apt-state is not
captured before the rootfs cleanup.

We fix this by capturing the apt-state (and copyright data) while it
still is available. Then, we run the SBOM generator against that data
in a dedicated task. By that, the SBOM generation also can be cached,
if the rootfs does not change - speeding up the build on repeated runs.

We further fix a SBOM chroot deploy race on multi-config builds.

Best regards,
Felix Moessbauer

Felix Moessbauer (6):
  rootfs: capture apt-state before rootfs cleanup
  sbom: run generator as task with apt-cache as input
  wic: make dependency to sbom chroot explicit
  sbom: deploy sbom chroot to distro specific file
  sbom: align deploy dir names
  sbom: cache artifact in sstate cache

 meta/classes-recipe/imagetypes_wic.bbclass |  1 +
 meta/classes-recipe/rootfs.bbclass         | 27 +++++++++++++---
 meta/classes/sbom.bbclass                  | 37 ++++++++++++++++------
 3 files changed, 51 insertions(+), 14 deletions(-)