[PATCH 1/3] imager sbom: simplify invocation of debsbom tool

[Felix Moessbauer]

We don't need to create the output directory upfront, as bwrap
internally does this on bind-mounting. Further, we avoid being extra
verbose to align the debsbom CLI with the other invocations.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index 8f666444..754db7a6 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -102,10 +102,6 @@ EOAPT
}

generate_imager_sbom_in_chroot() {
- run_privileged mkdir -p \
- ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}"
bwrap \
@@ -114,7 +110,7 @@ generate_imager_sbom_in_chroot() {
--bind ${SBOM_CHROOT_LOCAL} / \
--bind $1 /mnt/rootfs \
--bind ${WORKDIR} /mnt/deploy-dir \
- -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} \
--from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \
--distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
--
2.55.0

[Felix Moessbauer]

Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

meta/classes/sbom.bbclass | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..43b8a71e 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,14 @@ EOF
}

generate_sbom() {
- run_privileged_heredoc <<'EOF'
- mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
- tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
- -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF

-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})

+ unzstd < ${WORKDIR}/${ROOTFS_APT_STATE} | \
bwrap \
--unshare-user \
--unshare-pid \
--bind ${SBOM_CHROOT_LOCAL} / \
--bind ${SBOM_LOCAL_DEPLOYDIR} /mnt/deploy-dir \
- -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r - -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
--distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \

--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \

--base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \
--
2.55.0

[Felix Moessbauer]

This brings a couple of bugfixes, as well as support to read the package
data from a tar file.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

.../{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)

diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
index 7fc9a8eb..fa0b9b38 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
file://rules \
file://0001-Use-old-license-description-in-pyproject.toml.patch \
"
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
+SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"

do_prepare_build[cleandirs] += "${S}/debian"
do_prepare_build() {
--
2.55.0

[MOESSBAUER, Felix]

On Thu, 2026-09-03 at 15:10 +0200, Felix Moessbauer wrote:
> We don't need to create the output directory upfront, as bwrap
> internally does this on bind-mounting. Further, we avoid being extra
> verbose to align the debsbom CLI with the other invocations.

Hi, please don't merge yet. Debsbom 0.10.1 has two bugs calling for a
0.10.2 release. Once released, I'll send a v2 which directly updates to
0.10.2.

Felix