Re: [PATCH 02/15] scripts/sbom: integrate script in make process

[Nathan Chancellor <nathan@kernel.org>]

Hi Luis,

On Tue, Feb 10, 2026 at 09:54:11PM +0100, Luis Augenstein wrote:
> integrate SBOM script into the kernel build process.
> 
> Assisted-by: Claude Sonnet 4.5
> Assisted-by: GLM-4.7
> Co-developed-by: Maximilian Huber <maximilian.huber@tngtech.com>
> Signed-off-by: Maximilian Huber <maximilian.huber@tngtech.com>
> Signed-off-by: Luis Augenstein <luis.augenstein@tngtech.com>
...
> diff --git a/Makefile b/Makefile
> index 9d38125263fb..46d4be490d7f 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -772,7 +772,7 @@ endif
>  # in addition to whatever we do anyway.
>  # Just "make" or "make all" shall build modules as well
>  
> -ifneq ($(filter all modules nsdeps compile_commands.json clang-%,$(MAKECMDGOALS)),)
> +ifneq ($(filter all modules nsdeps compile_commands.json clang-% sbom,$(MAKECMDGOALS)),)
>    KBUILD_MODULES := y
>  endif
>  
> @@ -1612,7 +1612,7 @@ CLEAN_FILES += vmlinux.symvers modules-only.symvers \
>  	       modules.builtin.ranges vmlinux.o.map vmlinux.unstripped \
>  	       compile_commands.json rust/test \
>  	       rust-project.json .vmlinux.objs .vmlinux.export.c \
> -               .builtin-dtbs-list .builtin-dtb.S
> +	       .builtin-dtbs-list .builtin-dtb.S sbom-*.spdx.json

Does sbom-roots.txt need to be cleaned up as well?

A note for Greg: this will conflict with commit a76e30c2479c ("kbuild:
Delete .builtin-dtbs.S when running make clean").

>  # Directories & files removed with 'make mrproper'
>  MRPROPER_FILES += include/config include/generated          \
> @@ -1728,6 +1728,7 @@ help:
>  	@echo  ''
>  	@echo  'Tools:'
>  	@echo  '  nsdeps          - Generate missing symbol namespace dependencies'
> +	@echo  '  sbom            - Generate Software Bill of Materials'
>  	@echo  ''
>  	@echo  'Kernel selftest:'
>  	@echo  '  kselftest         - Build and run kernel selftest'
> @@ -2108,6 +2109,12 @@ nsdeps: export KBUILD_NSDEPS=1
>  nsdeps: modules
>  	$(Q)$(CONFIG_SHELL) $(srctree)/scripts/nsdeps
>  
> +# Script to generate .spdx.json SBOM documents describing the build
> +# ---------------------------------------------------------------------------
> +PHONY += sbom
> +sbom: all
> +	$(Q)$(MAKE) $(build)=scripts/sbom
> +
>  # Clang Tooling
>  # ---------------------------------------------------------------------------
>  
> diff --git a/scripts/sbom/Makefile b/scripts/sbom/Makefile
> new file mode 100644
> index 000000000000..6c8ec7356293
> --- /dev/null
> +++ b/scripts/sbom/Makefile
> @@ -0,0 +1,33 @@
> +# SPDX-License-Identifier: GPL-2.0-only OR MIT
> +# Copyright (C) 2025 TNG Technology Consulting GmbH
> +
> +SBOM_SOURCE_FILE := $(objtree)/sbom-source.spdx.json
> +SBOM_BUILD_FILE := $(objtree)/sbom-build.spdx.json
> +SBOM_OUTPUT_FILE := $(objtree)/sbom-output.spdx.json
> +SBOM_ROOTS_FILE := $(objtree)/sbom-roots.txt
> +
> +
> +ifeq ($(srctree),$(objtree))
> +    SBOM_TARGETS := $(SBOM_BUILD_FILE) $(SBOM_OUTPUT_FILE)
> +else
> +    SBOM_TARGETS := $(SBOM_SOURCE_FILE) $(SBOM_BUILD_FILE) $(SBOM_OUTPUT_FILE)
> +endif

This might be easier to read if it were

ifeq ($(srctree),$(objtree))
SBOM_TARGETS := $(SBOM_SOURCE_FILE)
endif
SBOM_TARGETS += $(SBOM_BUILD_FILE) $(SBOM_OUTPUT_FILE)

> +SBOM_DEPS := $(objtree)/$(KBUILD_IMAGE) $(objtree)/include/generated/autoconf.h
> +ifdef CONFIG_MODULES
> +    SBOM_DEPS += $(objtree)/modules.order
> +endif

Is $(objtree)/ necessary on these? You might be able to turn this into

  SBOM_DEPS := $(KBUILD_IMAGE) include/generated/autoconf.h $(if $(CONFIG_MODULES),modules.order)

> +$(SBOM_TARGETS) &: $(SBOM_DEPS)

&: is a feature from make 4.3 but the kernel supports make 4.0 and
newer, so you should probably make this

  # Use
  #     $(SBOM_TARGETS) &: $(SBOM_DEPS)
  # when make 4.3 is the minimum.
  $(SBOM_BUILD_FILE): $(SBOM_DEPS)

  $(obj)/: $(SBOM_BUILD_FILE)

> +	$(Q)echo "  GEN     $(notdir $(SBOM_TARGETS))"

> +	$(Q)if [ "$(CONFIG_MODULES)" = "y" ]; then \
> +		sed 's/\.o$$/.ko/' $(objtree)/modules.order >> $(SBOM_ROOTS_FILE); \
> +	fi
> +
> +	$(Q)$(PYTHON3) $(srctree)/scripts/sbom/sbom.py
> +
> +	$(Q)rm $(SBOM_ROOTS_FILE)

I think this would look better if it used the standard quiet_cmd_ and
cmd_ syntax:

quiet_cmd_sbom = GEN     $(notdir $(SBOM_TARGETS))
      cmd_sbom = printf "%s\n" "$(KBUILD_IMAGE)" >$(SBOM_ROOTS_FILE); \
                 $(if $(CONFIG_MODULES),sed 's/\.o$$/.ko/' $(objtree)/modules.order >> $(SBOM_ROOTS_FILE);) \
                 $(PYTHON3) $(srctree)/scripts/sbom/sbom.py \
                     --src-tree $(abspath $(srctree)) \
                     --obj-tree $(abspath $(objtree)) \
                     --roots-file $(SBOM_ROOTS_FILE) \
                     --output-directory $(abspath $(objtree)) \
                     --generate-spdx \
                     --package-license "GPL-2.0 WITH Linux-syscall-note" \
                     --package-version "$(KERNELVERSION)"; \
                 rm $(SBOM_ROOTS_FILE)

$(SBOM_BUILD_FILE): $(SBOM_DEPS)
	$(call cmd,sbom)

> +$(obj)/: $(SBOM_TARGETS)

It seems like this could use the standard always-y Kbuild syntax but I
am not sure. Honestly, looking at the bigger picture, it feels like most
of this Makefile could be moved into the main Makefile under the sbom
target? scripts/sbom is not actually used as an output directory and the
generated files do not really need to be listed as targets since their
names are hardcoded in scripts/sbom/sbom/config.py?

# Script to generate .spdx.json SBOM documents describing the build
# ---------------------------------------------------------------------------

ifdef building_out_of_srctree
sbom_targets := sbom-source.spdx.json
endif
sbom_targets += sbom-build.spdx.json sbom-output.spdx.json
sbom_roots_file := $(objtree)/sbom-roots.txt

quiet_cmd_sbom = GEN     $(notdir $(sbom_targets))
      cmd_sbom = printf "%s\n" "$(KBUILD_IMAGE)" >$(sbom_roots_file); \
                 $(if $(CONFIG_MODULES),sed 's/\.o$$/.ko/' $(objtree)/modules.order >> $(sbom_roots_file);) \
                 $(PYTHON3) $(srctree)/scripts/sbom/sbom.py \
                     --src-tree $(abspath $(srctree)) \
                     --obj-tree $(abspath $(objtree)) \
                     --roots-file $(sbom_roots_file) \
                     --output-directory $(abspath $(objtree)) \
                     --generate-spdx \
                     --package-license "GPL-2.0 WITH Linux-syscall-note" \
                     --package-version "$(KERNELVERSION)"; \
                 rm $(sbom_roots_file)
PHONY += sbom
sbom: $(notdir $(KBUILD_IMAGE)) include/generated/autoconf.h $(if $(CONFIG_MODULES),modules modules.order)
	$(call cmd,sbom)

appears to do the right thing for me?

FWIW, I get errors like

  $ make -kj"$(nproc)" ARCH=arm64 CROSS_COMPILE=aarch64-linux- O=build mrproper defconfig sbom
  ...
    GEN     sbom-source.spdx.json sbom-build.spdx.json sbom-output.spdx.json
  [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser.py", line 630, in log_error_or_warning
  Skipped parsing command ccache aarch64-linux-gcc ... -o init/main.o /src/init/main.c because no matching parser was found
  [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser.py", line 630, in log_error_or_warning
  Skipped parsing command ccache aarch64-linux-gcc ... -o arch/arm64/kernel/asm-offsets.s /src/arch/arm64/kernel/asm-offsets.c because no matching parser was found
  [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser.py", line 630, in log_error_or_warning
  Skipped parsing command ccache aarch64-linux-gcc ... -o kernel/bounds.s /src/kernel/bounds.c because no matching parser was found
  ... (Found 10435 more instances of this error)

when testing the whole series without any modifications, am I doing
something wrong?

Cheers,
Nathan