From patchwork Fri Feb 6 11:40:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 4847 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 06 Feb 2026 12:41:22 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-oo1-f61.google.com (mail-oo1-f61.google.com [209.85.161.61]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 616BfKiU023816 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 6 Feb 2026 12:41:21 +0100 Received: by mail-oo1-f61.google.com with SMTP id 006d021491bc7-66b560fcc42sf7967428eaf.0 for ; Fri, 06 Feb 2026 03:41:21 -0800 (PST) ARC-Seal: i=3; a=rsa-sha256; t=1770378074; cv=pass; d=google.com; s=arc-20240605; b=LfaHZNRLGgrv8oZQieyDrt+Z8YkRqG8nMzF5w5OIdLURyonGoMqfCVq3Ecjn5ZA5ZD wCNHns1x2erxhVwlqyH6PerbOerSgLbZF+13Tec+fNwNYvhN2uj6bGaeq5UY8rdUeMoT NKpSzSJUoPrTamiSDz1yEOrdOS0xHlrKuONy4rVnXXxRJrJgOanDimqCDK8V+5F64nDC Ddojexf/HRhuGcdObYtgy09sTHxZZLQzyhi8cH3wwHlKPzxpjLP1LZchLnsdmgYeUiEf TqasRo8wAx1BQKwG396077aXRrQNvDyQBJWZNFCmh9cnYO8m4LU/wIviBeYo16FSCyoU D1tg== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; fh=6H2NbSWGAtWKd44bd2fRcpWB/97EwwP21c3qzbI54Gs=; b=flJiyFB6RnUZaA6qX5q7sHkSGBVRe4xSKH5JvBw/CBbwqPRYoO3y8Ck3yxbIxSMRvC 2InBKKKqdD78R5LYaB2DebERir3kPqfQC7IOwgYzQNzwbxGI74p9E9hP7rwyZ6HKg9Sy USTmzyzKhda82rfUY3RKAn86Ub40Eq4Oibr3DfbYhSSy8sv0dSRTXY9C1oy3H9uPfsRv sxrT9ir/boDjZOaRV4O7K2mgOr/5OBggJ6D43xfDTnToxrsnv+HIhdpGr7flSwIm61vl K2BsNS4AXCs7B00dp+zPKjrINy22w8OZEdqSBxungKnLTjD3QPgCfy3q5w8yVW1oEDPP Z0CQ==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1770378074; x=1770982874; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; b=NzmiTxY7wVnPnlH8jGH/6m+Op+jM9BAZgAmvjHMfCphgNTMx/1QBUz+9ipZ8t4SXeR LRQIw1h+D9gYMgf2g32vsFtU0B5ZqmFJI5grhTWS/nW6/2CgRXjQdVH8ZYDfpY4Eobk/ AaGigUuqV6SMcRClsWKGHI8ch4FZksN/MesyqKSiPDiESJb1Dpa7weCMcP4Ulo7ZQMPW mM3D9DZ2I1/55qEv0uLymRAlYefpbBnAjPeHOkKdBVeRgcxgFSRA7AiatkVyE9honD7R pwl7AdTPIL+rNHA5EFDbqGPqqX+E0R5jyTHL0A3OzXyVvZ8bVgIM7FkV0ZfltGJZCe/T /FgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770378074; x=1770982874; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=OtJrFoF+GTa5BiiARjnub04vx6GdRyTdlLgz4jP6Vfw=; b=A5NM/zdOnMYq7H+Q41J34R6w5dTpXOPIzIFL64H7gqeYsq/itnGnZgMwAroScYA2vo VH8XgOqEfwH1fo/PSXYFkiMLcFVVEzqDAMB809CO5IxVDB9PyF17sWRxqoLE6G7HQh4Z FMLY7q5tK0sr1o3Hk9v5Y8F2Ho+kMzKZj+9dHfmD715xdmyYpLZ43Z5MMs8UgYK2PxzZ 1E53fA7JM5obnVTTp/fx+oNhUvGu8qZv/RnL3/dn5In+yUI/0DicyO9+5Kqx8vis5yO3 PGqj2ejGHaIjWYbk9ULij+ZzPfOld+G+6H0T3SQda9vENYz2t0u9t2sWiYoa+NaZYDQv 6oWw== X-Forwarded-Encrypted: i=3; AJvYcCXELC/rulZ5FIppnly/n3bP2vZg05Hlv3gbyCAWB1r9oxEG2H7Gj5XwFIhQ6R4BpF8bQcMgG0k=@isar-build.org X-Gm-Message-State: AOJu0Yx2gnpKPfKeT7RVZgOY6jzUfFyQE9xH2ekg0ZX+XPbTVJaWLF6q fuYbCHh0JNTVk8ZKf5TaULtGK+cAROJi831u95cMsQUknB021Qc20hrm X-Received: by 2002:a05:6820:1527:b0:662:b70c:a414 with SMTP id 006d021491bc7-66d3262b652mr992885eaf.14.1770378074023; Fri, 06 Feb 2026 03:41:14 -0800 (PST) X-BeenThere: isar-users@googlegroups.com; h="AV1CL+GNQP4rdSCvYwHLvaJ8ERvFzyP6IA4neTZMiENZnN4Ztg==" Received: by 2002:a05:6820:80e:b0:662:f8fc:6675 with SMTP id 006d021491bc7-66b99e687afls1337922eaf.1.-pod-prod-01-us; Fri, 06 Feb 2026 03:41:13 -0800 (PST) X-Received: by 2002:a05:6820:4dce:b0:662:f74d:69f5 with SMTP id 006d021491bc7-66d32fdbf3dmr952455eaf.31.1770378073210; Fri, 06 Feb 2026 03:41:13 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1770378073; cv=pass; d=google.com; s=arc-20240605; b=bFfwhzh0dA9REhefelNE0sGKOx2/q2nUQWPl2eNKb6Du6SouCbOENNJzmc+VvCFGLe CeKAGjQI50Ffcdek5zNEPIdsMGrDIhgrU1cz3y+oYfJWGfPPpZ6V0EXAcFRkDhkxn4dL 8lO384ta+8oKPWJwSH6rzr8rjgtBXhez/XSgYKutgwlqi97r6bjUNPf7ycJCfx5OBOr7 88qsU/3gdbTX4gP9wh3A3IkcHo6V/D/pVsHi8Ms8hyR/Oh0rP908PyZtxcUuOXwflrdZ v35GQHYV0IuFZgUbM40sbuwE+VZlItsJAzs6tlbC3RKAvAUJdeFhpCCOBmGKU/FYciiA /6Eg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=zL8s8myVrfLyn7SK2AKrc3W30259/7LN9/Rg9pjiaHw=; fh=3TZ2kfKzTV0uAG2uKD8NJHxpu4kGHzyonq8tLR1Voro=; b=Z0mXtQ53O+SLgxs15lOg1Iv5886uOPhKXM+lAw8VeovdUYMSk2XChBosT+pCGRMMzt 6/U7IaYAj09T/jTz5ZC+soJjwiMHe76zhx+6lceRYBnG2g53k23YP8b9n17wDi8gX/+1 jity8ptvqfnJo6/ms85jXwngZHNoaZKSVVpMu//k0u7kxkceK7s56LhQcqvaynliSbjg ZGMNzM/ldpr6+gGcBvmOh2WGeUGlmxW9CJBD5qfzBvKC1ONt+4nGtSkVodxIjDu2vy4v VxCaeGxCDMO359eNm6yGgYD+6DNY1Ul/7Y1KTGj32aFHwHWK4Cg6rLVuUha7MpEHoD73 63lA==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazlp170120005.outbound.protection.outlook.com. [2a01:111:f403:c200::5]) by gmr-mx.google.com with ESMTPS id 006d021491bc7-66d35f52c55si61432eaf.0.2026.02.06.03.41.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Feb 2026 03:41:13 -0800 (PST) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) client-ip=2a01:111:f403:c200::5; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uaR99kweryqVauIyeeeNGsS2WJPw/7p4IGAXC+lHTAnyRJMX/e2DscIfYGTGz2n4/ca+zatyE/mQ/DXLyNa/6HTXtj2ZG7H1TDqhrNQL3lybUU54LIzPBk94ZHPPboiSnLTerX4e8Zi3Z9VL6LGwASKIE7SmguHfu+KqMTcbT6Huq2+VlxKomu7g1qzT8QSOoOGihW1qM3QuyHvMyhIbsMBh9oETLYb5kdN+QIA6CzQSDLXQ209xrV3qAVIxzbvIOE/ph91j74MMmrBroM5vnmXXXTYWxzixSo3eT/cRv1WbN5W1DqlRly4JAIGQYuGlCJglhkxc70nE/Nt4XbK1sQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zL8s8myVrfLyn7SK2AKrc3W30259/7LN9/Rg9pjiaHw=; b=wGtnPRD5XbAE0qr7hVXhmHiO8WgTccbn8NgGu2qW9Dx60sAWnsU8y3tg+Zmo3nbP2VbJV8slRA7isnSM45MZV+7Ibh2vg/x5Y2KTete8xf2pNeiAoQ5INYTpMsBLQIf9fNKyaLy4LIKZGztsQv0hEkVF0UeT/oxQMFAaRsPnX09+YtZ07XeG5+aT6jTmM/rwTPzWfUgTpB1MY+FDMtXtrO2BJ5OdMPQu4J5o7LRdhjolhrAYUvGRrYNaPYED1srI0ZYAc+fItQ7hHEPetkN066Qdg9Fb7RY2wYgexYZDK8ek54zEayJ7PXwvfbmc51IybG/j/8exY056PZzUmf25dw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) by DB4PR10MB7039.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:3f1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.14; Fri, 6 Feb 2026 11:41:10 +0000 Received: from DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::9412:cd7f:3f72:92ab]) by DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM ([fe80::9412:cd7f:3f72:92ab%3]) with mapi id 15.20.9587.010; Fri, 6 Feb 2026 11:41:10 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: christoph.steiger@siemens.com, cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, stefan-koch@siemens.com, Felix Moessbauer Subject: [PATCH v8 7/7] wic: create uniform SBOM describing all image components Date: Fri, 6 Feb 2026 12:40:54 +0100 Message-ID: <20260206114054.3010883-8-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260206114054.3010883-1-felix.moessbauer@siemens.com> References: <20260206114054.3010883-1-felix.moessbauer@siemens.com> X-ClientProxiedBy: FR0P281CA0252.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:af::14) To DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:47f::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR10MB6828:EE_|DB4PR10MB7039:EE_ X-MS-Office365-Filtering-Correlation-Id: c0f15fec-e1ec-45f8-22be-08de65749fbd X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|10070799003|376014; X-Microsoft-Antispam-Message-Info: 9hJlxl9JLni3M2ST1CY8rdZzvUWiq6swpGPQuD1yfX9dZprZ3CrjK7aYNMy58irWsmRuYqeCbpGzG8/C1so8Yw+rIT5K15vAA4gRkeba18dvZRd3koxHsIlYpWIUfhJ0kOYRj/HfzOYPdbpMMj6kIqINJCvi1R/GXTYcDmi0j/N7w6Pc2hr4T2WxG5lvOafO8FyrVG3CcMeW1UG7KPhF9anXgye65gyajfFgL5FQE2IBeyezw0z8a8IrpDkhi22TUOa2K6zla8xn+DFzSmjmFW2LYajXnCFArCz10xqEH9BdefKNz0vJ1oP5kAE7jALWE6J8sECBaj+S0wqgfXiSXDBYRDtvGJn/c6xFARTCxxxAWKbwmxiUAU76KM4L7Q2m2ENTPVV+DpPpkscn60yg4jTFmHgdTyLgODX4JeYK99DTGD46SaRMxOJJMF7UxD8g19zEzjm61uJqiJYjhvVIclL2+bUXZ9MBMuQbO88HnSr/RfKYeiUsqHmNCH/Gyw29pawsst+D2XohfIJTUx85VqL5yxGsqcHjfCP52puZiSe9+O3PGlubK8vz9N1j3mmHfo5qnyukNEkCu5hkl/4wAgZHoGAowdEGTr/H0Q9A6YJk8rwxsyZHH+oqFRieBFacRW5LOCsV5Y/FslVQ2qSll6srsOeRmu7Q7ImyKt49RypRnjvRwyNfzMVWbWCv+22NnEJyGiXfSFEUt/YpnsChJJdmsOeYBImDXoQUYlrpaZWj5eSyh5ROr204m4deCCuOT2rafHjNJLWWz7T3ZuNwGTtX2jQCu6WqaZGD5PYemlCNUV6oaVB5DZ7Oiywt7xwDjDyuA/qgLJ7rWooUpxZAK6+6d0fk6fOCLCwba/tv9fY5EM1+W8w4Y1xL27LnBv4LFtK0b90HwpSlYH0yaYOPZfFgbdH0pwnkHZKFVOD6iVrjKggHc8pBh3LF1Lw557m+saEZjGslxeHJ+Uu02F3BQXJ2qUnY+PAXhLjX50StzshccYpvq1I9/HLH146bOSW4QlyiPPuCWXxY99akh1AglnObbCQgVj4tDZmc4MUfLn8yQ2fs2EJw8Zrmr61iF1NMrsqpBkx4PAuR98gSgtuNIL8berhB/HoepOHhzdEUuq9W1QUfO2EDbzLmjm94ipTdLiRyFUzi2s+HjBM6cPfVkQQ3HVc1xAulIKtGQzbIvhP8bZUgrKFwda4vmOl5SaeaA5uWgJ3UOXbmcU8BsREUHjliGqmvQzmC9Ir0psY/zjsdhZYCnUNRriI+desyKhlz6OIPszEF6dzCEUtRo62+5/Ki0mCr8JdFZyQKVrgSaKOQ2QpP97p1XGXSSb41gNJ+9WkZ24lMSUPQ0mpL//KjBR+XTulDmG53gc8rhx/6Ot0CSfjAUkPLMtEJrs4527B6kmPHLw2ZvC8SZdQtBg6MYKuKSbj0JIlRe3Bd+6D8WK5VuE0dYFhxc+oWLa6NB5eD8ofgSr313FhMoSYrWbyQdOBmlPyPrZZc5HAXmkwrJHETnSXur7L9L8XDb48CyvodtLhPJh8IOti+zxcqBVLnN0jieVULQA88Fgaijs/y+Pk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(10070799003)(376014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: 6iT1gpxTgv03lXwHWe9AWGojR7R2Gl4212J3PIdvn80AlhMkBitKtMcPEA/J9reIXve337YcyD1cyHk4n1H8b2mF33vfiEq2vbYNPvgjh4fVSj4YTrTvPCDso2e8twmDgwqocNJnohfbLOT5JtllT+6I0ZkrSAmC8omoZPk3yU1yYgO0YWVOQFkX7CgN0tYLf1H9T4qUAs7rav9tpxKQFu5Yhie7PBB6N6/mdpKr75FzntECoW4769cy/4tbQ1qK8Ro8nPCPlagLUeVFCLPfvg7YezcaHmiSSvLFbKkKtaFAS8RtMXycJqSt9fjo5LvArFxLSXQnnrGIDprM2XIe7ToJwT0AJzPnga9JHiDzLa54zlaZ8JNIOksqb3F3Yx6LoU7+JMp+kClXEyhPYr15WRgWyEgrlZI3c6Lo8+wnpnXvJqBrl+17j9ZtDy8Wz3cq04lCWSCc6Bvd+q6Sp/pTCHoJDiqBMcG7lD5sgqJkqAnHt6goG9+KRO3/EMd9SnfPMd8GVzKSTWKcCIUZR2WkASQ1Q5KKAYtALyd3ZDsOJL8mQCY1XD3Cdqf+bQlsVNntlXnvk2WHEDXmIxzGowiVUVcO25L4DFdTYfUqU/CEB6DVoI1dt9gJT+4298QcBvsMFR8r5MKs+4/Ga5hqO5ZYciAJZ64nHa5u22AqLmNWyQyu4QJOATg4464hkc7nNEuBa444BBm9dh7rI8I8lZvDRfmziolJSrEH3biJybU8BHEJrgf6ILc0Mgf0XEUKOt2rqvQlE3ntQM9ytBpgBYRrecOl3y+dpaypAHhbPZwApRNSehPj2H+Z4nGKaSgw8rriZzvmVqf5O4QFo1g9AqeBGo0niedzsqoGKUlLh4lGcB/qkzvBwPJyQ4LLO2/7Y1RLN7J/QPP61dzJB7a6S/HCeVoKOwKFdAZq4/L/Ug330+8M1fhFHkn+6gp2k2Lm8URzdzK306pu3xnAdPXxkfciBw5m0hQtNOfmEhMBdAM5+SvZjCRmy8Z9ebWqmCbGJGUvThQJ4+aHcGyKJef5BuXn0RXSe+XSNmt8SWLdIcwWZLbxI7bybK3RRg9bV9xDCNNZFE29wMAYmM34HtHX8scUPiv5jwTwtsxoPRgqqH98c1rfI/1vpPmnTZxmQdjeu+eAzd2AHEAlCGmTDd6ocun/9BDuCqB9ppz9RYx3/L9hPSNPwbTrEYXgmAJ2rFS1RBzbkX5qKUIiUffUdsrPhHZW1bdPvRLsfZS2pqxi2S1PY2SJl2BjZ7OiXJidEyfsCKZUBzHssdwFcRVH1pkYsFNW82Irl0PIXeLiksLOEO4ze69VW7oNxelX65H/PpBHzmXv7gu+rFmN1yEopKw/HF26QLkuj2iFSnXmJ2aZRMPFWD33lw0MuSvFzo6PmlPMMvFeN2PapNTyfm0HWz9lDl7TQMVo5dYSU/tI7FkEBtT8N7M1jcIay1LW9yfF4Are4LCSNxbvwgf1lFXVff8C8LZR2S8ax7c5od44l0PfBL4l5MSHUD7HCtONGLV6OiQhUT2p3yJX5y8jribiTV03hO6ZZei9chOt0s9dY8bAillwKDr7MAQnL72YppHNZW8uu+4qG1aGHnkxDWrqL59AAu6GU702wXbs0rZ/fdXo3tMvsMfwB+iakbU8vBOJjibfpN77ZnV/JJkWpRHmK7dZSU6OS9ZWuvboEo9mmEFbvbT+z39rxUMKB87Vq9In2bInnm4bYivSEw8ZVCYnMwTFoVWT1d9BCnAJdPgGgjcV3lnRTH4SYai4LibILIFKLSiYJWChR8H4CEza X-MS-Exchange-AntiSpam-MessageData-1: 8KgnhxuRg14LYPZux3gU2rQq5YggWvqs3Ps= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0f15fec-e1ec-45f8-22be-08de65749fbd X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB6828.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Feb 2026 11:41:10.5643 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: yvBhXy6XSwAozCZ6MOE3m1oZbaw3QsNJbBEzJcQ7OkAKsxfPd15dG23cgQo/FYmSKzpVlCDA1NQsXm4KZXTn0dCs3LVnSpk3Rs9d25r4p38= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR10MB7039 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="h7QtU6/4"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::5 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= A wic image consists of potentially many different components. All these should be covered by a single SBOM. After creating the wic image, we collect the individual sbom files (rootfs, initrd, imaging) and semantically merge it with the debsbom tool. The merge SBOM is then deployed as .wic.(spdx|cdx).json next to the wic image. Signed-off-by: Felix Moessbauer --- meta/classes-recipe/imagetypes_wic.bbclass | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/meta/classes-recipe/imagetypes_wic.bbclass b/meta/classes-recipe/imagetypes_wic.bbclass index c75d481d..6b82add3 100644 --- a/meta/classes-recipe/imagetypes_wic.bbclass +++ b/meta/classes-recipe/imagetypes_wic.bbclass @@ -201,4 +201,31 @@ EOIMAGER ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.manifest \ ${WORKDIR}/imager.manifest 2>/dev/null \ | sort | uniq > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.manifest" + + if ${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'true', 'false', d)} ; then + for bomtype in ${SBOM_TYPES}; do + merge_wic_sbom $bomtype + done + fi +} + +merge_wic_sbom() { + BOMTYPE="$1" + TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH}) + sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}" + + cat ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.${bomtype}.json \ + ${DEPLOY_DIR_IMAGE}/${INITRD_DEPLOY_FILE}.${bomtype}.json \ + ${WORKDIR}/imager.${bomtype}.json 2>/dev/null | \ + bwrap \ + --unshare-user \ + --unshare-pid \ + --bind ${SBOM_CHROOT} / \ + -- debsbom -v merge -t $BOMTYPE \ + --distro-name '${SBOM_DISTRO_NAME}-Image' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \ + --distro-version '${SBOM_DISTRO_VERSION}' --base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \ + --cdx-serialnumber $sbom_document_uuid \ + --spdx-namespace '${SBOM_SPDX_NAMESPACE_PREFIX}'-$sbom_document_uuid \ + --timestamp $TIMESTAMP - -o - \ + > ${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.wic.$bomtype.json }