From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DACC33CBE97; Fri, 22 May 2026 11:18:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779448738; cv=none; b=k0dEh+dySd4226odvNx9rr4K3Ky33B90ghpQwCFfALRTZJF9T8rNrmTt1UHAm9nMcT7U86B5xX/H+66N91S4t7qF3sJ+CZI13Dc/3CQ3RiyKel+j1naxp3ri4hlu/GOvB0hfC0eyt5KCByuVIZK//5xFjQbfTnYM470no5JTES4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779448738; c=relaxed/simple; bh=fc9B488bJSTiQB4YXTNKZgtXLNncKFxalF+l+Oo8k6U=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eIYA40L57y9ByaRdATwi+6go/GHk8WJESxFT9TXF98KCjXNRsKgik7a/dTCk/s6UG3Lw0/fNU0y//YhOiB9itsAzfTu2lwNz/z0V2iMTyLwgBI7pbXhkHtB2VRvgjxv/A2kclky05436WjeOia/7/3nZlT1CwssODlNgrL5ip1Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FVxzVeqX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FVxzVeqX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 175A41F000E9; Fri, 22 May 2026 11:18:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779448737; bh=CV00F1/3qlZOFBlTSTYdLTbuIlGOwKtgVdtS2H4+WQE=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=FVxzVeqXJMsx6ApIrIQPGWHAUsXm1YMJOKhq/jOF6BislQ47ZcQdIcwA/SYGb+gYO e2Q7rqaYNtsuizLpEPMAnCVGydWniWQbdu0ppoW0YpaPuMLADfkwbnqH276Jwf0etq +IkC1s1dBinFyttVJBsfho0vMAB9lau1v7gHfUxI= Date: Fri, 22 May 2026 13:18:48 +0200 From: Greg KH To: Luis Cc: nathan@kernel.org, nsc@kernel.org, linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, akpm@linux-foundation.org, kstewart@linuxfoundation.org, maximilian.huber@tngtech.com Subject: Re: [PATCH v7 00/15] add SPDX SBOM generation script Message-ID: <2026052233-task-shifter-4570@gregkh> References: <20260518062102.2051814-1-luis.augenstein@tngtech.com> Precedence: bulk X-Mailing-List: linux-kbuild@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260518062102.2051814-1-luis.augenstein@tngtech.com> On Mon, May 18, 2026 at 08:20:47AM +0200, Luis wrote: > This patch series introduces a Python-based script for generating SBOM > documents in the SPDX 3.0.1 format for kernel builds. > > A Software Bill of Materials (SBOM) describes the individual components > of a software product. For the kernel, the goal is to describe the > distributable build outputs (typically the kernel image and modules), > the source files involved in producing these outputs, and the build > process that connects the source and output files. > > To achieve this, the sbom script generates three SPDX documents: > > - sbom-output.spdx.json > Describes the final build outputs together with high-level > build metadata. > > - sbom-source.spdx.json > Describes all source files involved in the build, including > licensing information and additional file metadata. > > - sbom-build.spdx.json > Describes the entire build process, linking source files > from the source SBOM to output files in the output SBOM. > > The sbom script is optional. It can be invoked via the `make sbom` target. > This target depends on `all` and triggers a standard kernel build. Once all > output artifacts have been generated, starting from the kernel image and > modules as root nodes, the script reconstructs the dependency graph up > to the original source files. Build dependencies are primarily derived from > the `.cmd` files generated by Kbuild, which record the full command used > to build each output file. > > Currently, the script only supports x86 and arm64 architectures. > > This series was developed with assistance from AI tools, namely Cursor > with Claude Sonnet 4.5 and OpenCode with GLM-4.7. The AI was used for > documentation, exploring the repository, and iterating on design > questions and implementation details such as regex patterns. > > Assisted-by: Cursor:claude-sonnet-4-5 > Assisted-by: OpenCode:GLM-4-7 > Co-developed-by: Maximilian Huber > Signed-off-by: Maximilian Huber > Signed-off-by: Luis Augenstein Now applied to the spdx-linus branch, thanks! greg k-h