Re: [Buildroot] [RFC PATCH 0/5] Support SBOM in CycloneDX format

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Thomas,

On Thu,  4 Apr 2024 14:43:24 +0200
Thomas Perale <thomas.perale@essensium.com> wrote:

> This RFC patch series propose to add support for the CycloneDX
> SBOM format.
> 
> There is a growing need to generate SBOM from buildroot
> configurations. Right now, there are different solutions available
> for buildroot users `show-info`, `legal-info` and `pkg-stats`.
> They all generate similar information (`show-info` showing more) but
> in a format that is specific to buildroot.

Thanks a lot for your work on this, this is really useful.

My initial reaction is whether it is really the right solution to have
"make" spit out the CycloneDX format, or whether we should use "make
show-info", and then process the JSON output using some Python script
to generate the CycloneDX SBoM. Some of the mangling needed to generate
the CycloneDX stuff is a bit tricky to write in make, and having a
utility Python script doing that work based on a JSON input would I
believe be simpler and easier to extend. Have you explored this idea?

Of course, if "make show-info" doesn't provide enough information in
the generated JSON blurb, we can always extend that with more
information.

> This is a first sketch and I hope to gather comments on functionality
> the community want me to include. I already have a todo list of feature
> I plan to work on:
> 
> - [ ] Find a solution to handle versioning. The "version" property
>       should be incremented every SBOM generation.

Perhaps easier to handle this with the Python script approach proposed
above.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot