From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6781A257423; Sun, 29 Mar 2026 06:29:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774765756; cv=none; b=gm//YGBs6WVHWpMqlk+NTClUqFhWjMJEH8JG6grkXy20iLeB/27AvuJ6ifBJ0us+ciFGW8mKi1RSSHCnv+4FcrE9+YipiG5PIFqUvqgzvSEN9ZRz8iuBbkT6vwvUwu8/cArb3xZvQwXUrnBd9pRiloxQZ4g9GyTXnjOiTSdm3Ug= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774765756; c=relaxed/simple; bh=3uwxF1/ATXC7GSf7z4iiSVaRcMkkIs4uDfwSgvs0mv4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Z8KXZtqq7e2s6Al17008cwOQ5o90UFDx0CQHO7U0Ps2Qzg7E0Jf7ncKVd0qUaiqLGbpyVAdgOJYbXeghYaAB87CeapkacHw96syWOtIk3hD3DlSoCKWAdXHjzj0M/Y7k755jYEXMUwOHxsndGDqBxJElSWRmSc2ySGSnrRH2t+c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HZ3LbAw0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="HZ3LbAw0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58222C116C6; Sun, 29 Mar 2026 06:29:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774765756; bh=3uwxF1/ATXC7GSf7z4iiSVaRcMkkIs4uDfwSgvs0mv4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=HZ3LbAw0GtMRhLI9BCBeYtSr6Dr034GiVRrTLh+til/omMY2XMdMhMTbZaG6K5fgV pLEkfJFTFxF9utHSVQJizXrWT7S3tWJ7OfzIX11UEc09lxiuiOH0YueLpzOZgSttD4 T3HF9NLJVQdxE2GGKdgxRqxiWnYnYJVcGz9mlyOY= Date: Sun, 29 Mar 2026 08:29:12 +0200 From: Greg KH To: Luis Augenstein Cc: nathan@kernel.org, nsc@kernel.org, linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, akpm@linux-foundation.org, kstewart@linuxfoundation.org, maximilian.huber@tngtech.com Subject: Re: [PATCH v4 00/15] add SPDX SBOM generation script Message-ID: <2026032913-unable-marbling-473f@gregkh> References: <20260210205424.11195-1-luis.augenstein@tngtech.com> Precedence: bulk X-Mailing-List: linux-kbuild@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260210205424.11195-1-luis.augenstein@tngtech.com> On Tue, Feb 10, 2026 at 09:54:09PM +0100, Luis Augenstein wrote: > This patch series introduces a Python-based script for generating SBOM > documents in the SPDX 3.0.1 format for kernel builds. > > A Software Bill of Materials (SBOM) describes the individual components > of a software product. For the kernel, the goal is to describe the > distributable build outputs (typically the kernel image and modules), > the source files involved in producing these outputs, and the build > process that connects the source and output files. > > To achieve this, the sbom script generates three SPDX documents: > > - sbom-output.spdx.json > Describes the final build outputs together with high-level > build metadata. > > - sbom-source.spdx.json > Describes all source files involved in the build, including > licensing information and additional file metadata. > > - sbom-build.spdx.json > Describes the entire build process, linking source files > from the source SBOM to output files in the output SBOM. > > The sbom script is optional. It can be invoked via the `make sbom` target. > This target depends on `all` and triggers a standard kernel build. Once all > output artifacts have been generated, starting from the kernel image and > modules as root nodes, the script reconstructs the dependency graph up > to the original source files. Build dependencies are primarily derived from > the `.cmd` files generated by Kbuild, which record the full command used > to build each output file. > > Currently, the script only supports x86 and arm64 architectures. > > This series was developed with assistance from AI tools, namely Cursor > with Claude Sonnet 4.5 and OpenCode with GLM-4.7. The AI was used for > documentation, exploring the repository, and iterating on design > questions and implementation details such as regex patterns. > > Assisted-by: Claude Sonnet 4.5 > Assisted-by: GLM-4.7 > Co-developed-by: Maximilian Huber > Signed-off-by: Maximilian Huber > Signed-off-by: Luis Augenstein > --- > Changes in v4: > - move sbom script from tools/ to scripts/ and simplify Makefile > - use $(Q), $(PYTHON3) in scripts/sbom/Makefile > - replace README with Documentation/tools/sbom/sbom.rst > - add Assisted-by tags to document usage of AI tools > --- > Luis Augenstein (15): > scripts/sbom: add documentation > scripts/sbom: integrate script in make process > scripts/sbom: setup sbom logging > scripts/sbom: add command parsers > scripts/sbom: add cmd graph generation > scripts/sbom: add additional dependency sources for cmd graph > scripts/sbom: add SPDX classes > scripts/sbom: add JSON-LD serialization > scripts/sbom: add shared SPDX elements > scripts/sbom: collect file metadata > scripts/sbom: add SPDX output graph > scripts/sbom: add SPDX source graph > scripts/sbom: add SPDX build graph > scripts/sbom: add unit tests for command parsers > scripts/sbom: add unit tests for SPDX-License-Identifier parsing Nathan and Nicolas, any objection from me taking this through my char/misc tree, or is there something remaining to be done here that would require another respin, or do you want to take it through the kbuild tree? thanks, greg k-h