[PATCH] debianize: add support for DEBIAN_BUILT_USING

[srinuv...@siemens.com]

From: srinuvasan <srinuv...@siemens.com>

Introduce the DEBIAN_BUILT_USING variable to allow setting the Built-Using field in auto-generated Debian control files.

This field declares that a binary package was built using parts of another source package or binaries. With this change,
user can now configure Built-Using directly in debian/control via the DEBIAN_BUILT_USING variable.

Examples:

A package using the source code from the gcc-4.6-source package:
Built-Using: gcc-4.6 (= 4.6.0-11)

A package including binaries from grub2 and loadlin:
Built-Using: grub2 (= 1.99-9), loadlin (= 1.6e-1)

Recipes can now simply define DEBIAN_BUILT_USING to populate this field automatically.

Note: Several upstream packages define this field, for example shim-signed, fwupd, and grub-efi-amd64-bin.

Signed-off-by: srinuvasan <srinuv...@siemens.com>
---
doc/user_manual.md | 2 ++
meta/classes/debianize.bbclass | 3 +++
2 files changed, 5 insertions(+)

diff --git a/doc/user_manual.md b/doc/user_manual.md
index 67f91973..313b9a63 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -1006,6 +1006,8 @@ Other (optional) customization variables include:
- `DEBIAN_PROVIDES` - declare a virtual package to satisfy dependencies
- `DEBIAN_REPLACES` - to replace a package with another
- `DEBIAN_BREAKS` - Packages which break other packages
+ - `DEBIAN_BUILT_USING` - Used when a binary package includes parts of other source packages, f.e: by statically linking their libraries or embedding their
+ code or data during the build.

### Prebuilt .deb packages from somewhere

diff --git a/meta/classes/debianize.bbclass b/meta/classes/debianize.bbclass
index 4989c601..9197bc25 100644
--- a/meta/classes/debianize.bbclass
+++ b/meta/classes/debianize.bbclass
@@ -13,6 +13,7 @@ DEBIAN_PROVIDES ??= ""
DEBIAN_REPLACES ??= ""
DEBIAN_CONFLICTS ??= ""
DEBIAN_BREAKS ??= ""
+DEBIAN_BUILT_USING ??= ""
DEBIAN_MULTI_ARCH ??= "no"
DEBIAN_COMPAT ??= "10"
DEBIAN_CHANGELOG_TIMESTAMP ??= "3600"
@@ -74,6 +75,7 @@ deb_create_control[vardeps] += "DEBIANIZE_BUILD_DEPENDS \
DEBIAN_PROVIDES \
DEBIAN_REPLACES \
DEBIAN_BREAKS \
+ DEBIAN_BUILT_USING \
DEBIAN_CONFLICTS"
deb_create_control() {
cat << EOF > ${S}/debian/control
@@ -90,6 +92,7 @@ Depends: ${@ deb_list_beautify(d, 'DEBIAN_DEPENDS')}
Provides: ${@ deb_list_beautify(d, 'DEBIAN_PROVIDES')}
Replaces: ${@ deb_list_beautify(d, 'DEBIAN_REPLACES')}
Breaks: ${@ deb_list_beautify(d, 'DEBIAN_BREAKS')}
+Built-Using: ${@ deb_list_beautify(d, 'DEBIAN_BUILT_USING')}
Conflicts: ${@ deb_list_beautify(d, 'DEBIAN_CONFLICTS')}
Multi-Arch: ${DEBIAN_MULTI_ARCH}
Description: ${DESCRIPTION}
--
2.39.5

[MOESSBAUER, Felix]

On Fri, 2025-10-10 at 13:57 +0530, srinuv...@siemens.com wrote:
> From: srinuvasan <srinuv...@siemens.com>
>
> Introduce the DEBIAN_BUILT_USING variable to allow setting the Built-Using field in auto-generated Debian control files.

Hi, thanks for adding this.
This field is especially important when building a derived version of
an upstream package. Then, the SBOM tooling (like the proposed debsbom)
can pick this up and add the dependency to the original package.

>
> This field declares that a binary package was built using parts of another source package or binaries. With this change,
> user can now configure Built-Using directly in debian/control via the DEBIAN_BUILT_USING variable.
>
> Examples:
>
> A package using the source code from the gcc-4.6-source package:
> Built-Using: gcc-4.6 (= 4.6.0-11)

This example should also go into the documentation.

>
> A package including binaries from grub2 and loadlin:
> Built-Using: grub2 (= 1.99-9), loadlin (= 1.6e-1)
>
> Recipes can now simply define DEBIAN_BUILT_USING to populate this field automatically.
>
> Note: Several upstream packages define this field, for example shim-signed, fwupd, and grub-efi-amd64-bin.
>
> Signed-off-by: srinuvasan <srinuv...@siemens.com>
> ---
> doc/user_manual.md | 2 ++
> meta/classes/debianize.bbclass | 3 +++
> 2 files changed, 5 insertions(+)
>
> diff --git a/doc/user_manual.md b/doc/user_manual.md
> index 67f91973..313b9a63 100644
> --- a/doc/user_manual.md
> +++ b/doc/user_manual.md
> @@ -1006,6 +1006,8 @@ Other (optional) customization variables include:
> - `DEBIAN_PROVIDES` - declare a virtual package to satisfy dependencies
> - `DEBIAN_REPLACES` - to replace a package with another
> - `DEBIAN_BREAKS` - Packages which break other packages
> + - `DEBIAN_BUILT_USING` - Used when a binary package includes parts of other source packages, f.e: by statically linking their libraries or embedding their
> + code or data during the build.

Please also add the example (as above) and state the format
"<name> (= <version>)".

We probably want to validate the values, as I'm certainly sure people
will fill in incorrect data. By validating, we ensure (syntactical)
correctness, as well as help people with meaningful error messages.

Felix

> Conflicts: ${@ deb_list_beautify(d, 'DEBIAN_CONFLICTS')}
> Multi-Arch: ${DEBIAN_MULTI_ARCH}
> Description: ${DESCRIPTION}
> --
> 2.39.5

--
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

[srinuv...@siemens.com]

From: srinuvasan <srinuv...@siemens.com>

This field is particularly important when creating a derivative of an upstream package (f.e: bmap-tools),
as SBOM tools (such as the proposed debsbom) can detect it and record the original package as a dependency

Typically, this field declares that a binary package incorporates parts from another source package or binary
With this update, Built-Using can be set directly in debian/control using the DEBIAN_BUILT_USING variable

Examples:

A package using the source code from the gcc-4.6-source package:
Built-Using: gcc-4.6 (= 4.6.0-11)

A package including binaries from grub2 and loadlin:
Built-Using: grub2 (= 1.99-9), loadlin (= 1.6e-1)

Recipes can now simply define DEBIAN_BUILT_USING to populate this field automatically

Note: Several upstream packages define this field, for example shim-signed, fwupd, and grub-efi-amd64-bin.

Signed-off-by: srinuvasan <srinuv...@siemens.com>
---

doc/user_manual.md | 3 +++
meta/classes/debianize.bbclass | 3 +++
2 files changed, 6 insertions(+)

diff --git a/doc/user_manual.md b/doc/user_manual.md
index 67f91973..4b5e0843 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -1006,6 +1006,9 @@ Other (optional) customization variables include:

- `DEBIAN_PROVIDES` - declare a virtual package to satisfy dependencies
- `DEBIAN_REPLACES` - to replace a package with another
- `DEBIAN_BREAKS` - Packages which break other packages
+ - `DEBIAN_BUILT_USING` - Used when a binary package includes parts of other source packages, f.e: by statically linking their libraries or embedding their
+ code or data during the build.

+ E.x: Built-Using: <name> (= <version>)