@@ -42,6 +42,8 @@ ROOTFS_FEATURES:remove:bullseye = "generate-sbom"
ROOTFS_FEATURES:remove:jammy = "generate-sbom"
ROOTFS_FEATURES:remove:focal = "generate-sbom"
+# Capture all information needed for sbom generation
+ROOTFS_APT_STATE = "apt-state.tar.zst"
ROOTFS_APT_ARGS="install --yes -o Debug::pkgProblemResolver=yes"
ROOTFS_CLEAN_FILES="/etc/hostname /etc/resolv.conf"
@@ -414,6 +416,19 @@ rootfs_clear_initrd_symlinks() {
run_privileged rm -f ${ROOTFSDIR}/initrd.img.old
}
+ROOTFS_INSTALL_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)}"
+rootfs_capture_apt_state() {
+ ( cd ${ROOTFSDIR} && find usr/share/doc -name copyright -print0 ) | \
+ tar -cf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd -C ${ROOTFSDIR} \
+ --exclude=var/lib/apt/lists/partial \
+ --exclude=var/lib/apt/lists/lock \
+ --exclude=var/lib/apt/lists/auxfiles \
+ --null -T - \
+ var/lib/apt/lists \
+ var/lib/apt/extended_states \
+ var/lib/dpkg/status
+}
+
do_rootfs_install[root_cleandirs] = "${ROOTFSDIR}"
do_rootfs_install[cleandirs] += "${DEPLOYDIR}"
do_rootfs_install[sstate-inputdirs] = "${DEPLOYDIR}"
@@ -674,6 +689,9 @@ rootfs_install_sstate_prepare() {
tar -C ${WORKDIR}/mnt/rootfs -cpSf rootfs.tar $lopts ${SSTATE_TAR_ATTR_FLAGS} .
umount -q ${WORKDIR}/mnt/rootfs
EOF
+ if [ -f ${WORKDIR}/${ROOTFS_APT_STATE} ]; then
+ cp ${WORKDIR}/${ROOTFS_APT_STATE} .
+ fi
${@ 'sudo chown $(id -u):$(id -g) rootfs.tar' if d.getVar('ISAR_CHROOT_MODE') == 'schroot' else '' }
}
rootfs_install_sstate_prepare[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"
@@ -691,6 +709,9 @@ rootfs_install_sstate_finalize() {
EOF
rm rootfs.tar
fi
+ if [ -f ${ROOTFS_APT_STATE} ]; then
+ mv ${ROOTFS_APT_STATE} ${WORKDIR}/${ROOTFS_APT_STATE}
+ fi
}
python do_rootfs_install_setscene() {
@@ -50,16 +50,18 @@ EOF
}
generate_sbom() {
- run_privileged mkdir -p \
- ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
+ run_privileged_heredoc <<'EOF'
+ mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
+ ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
+ tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
+ -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
+EOF
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
bwrap \
--unshare-user \
--unshare-pid \
--bind ${SBOM_CHROOT_LOCAL} / \
- --bind ${ROOTFSDIR} /mnt/rootfs \
--bind ${DEPLOY_DIR_SBOM} /mnt/deploy-dir \
-- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
--distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
The do_rootfs_postprocess command removes parts of the apt cache which we need for SBOM generation. On normal builds this is not a problem, as the SBOM generator runs prior to the rootfs cleanup. However, on partial rebuilds this can result in incomplete SBOMs which cannot be easily detected. This further allows to add more parallelism to the build, as the SBOM generator can run anytime after do_rootfs_install (not part of this patch). Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> --- meta/classes-recipe/rootfs.bbclass | 21 +++++++++++++++++++++ meta/classes/sbom.bbclass | 10 ++++++---- 2 files changed, 27 insertions(+), 4 deletions(-)