[PATCH v2 0/3] Update debsbom tool

[Felix Moessbauer]

Changes since v1:

- bump debsbom version to 0.10.2 (which fixes the issues
found on 0.10.1)

Felix Moessbauer (3):
imager sbom: simplify invocation of debsbom tool
debsbom: update to v0.10.2
rootfs sbom: directly use captured apt state without extraction

.../image-tools-extension.bbclass | 6 +--
meta/classes/sbom.bbclass | 10 +----
...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
.../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++
4 files changed, 47 insertions(+), 14 deletions(-)
rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

--
2.55.0

[Felix Moessbauer]

We don't need to create the output directory upfront, as bwrap
internally does this on bind-mounting. Further, we avoid being extra
verbose to align the debsbom CLI with the other invocations.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index 8f666444..754db7a6 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -102,10 +102,6 @@ EOAPT
}

generate_imager_sbom_in_chroot() {
- run_privileged mkdir -p \
- ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}"
bwrap \
@@ -114,7 +110,7 @@ generate_imager_sbom_in_chroot() {
--bind ${SBOM_CHROOT_LOCAL} / \
--bind $1 /mnt/rootfs \
--bind ${WORKDIR} /mnt/deploy-dir \
- -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} \
--from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \
--distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \
--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
--
2.55.0

[Felix Moessbauer]

Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

meta/classes/sbom.bbclass | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..43b8a71e 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,14 @@ EOF
}

generate_sbom() {
- run_privileged_heredoc <<'EOF'
- mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
- tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
- -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF

-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})

+ unzstd < ${WORKDIR}/${ROOTFS_APT_STATE} | \
bwrap \
--unshare-user \
--unshare-pid \
--bind ${SBOM_CHROOT_LOCAL} / \
--bind ${SBOM_LOCAL_DEPLOYDIR} /mnt/deploy-dir \
- -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r - -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
--distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \

--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \

--base-distro-vendor '${SBOM_BASE_DISTRO_VENDOR}' \
--
2.55.0

[Felix Moessbauer]

This brings a couple of bugfixes, as well as support to read the package
data from a tar file.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

...bom_0.8.1.bb => python3-debsbom_0.10.1.bb} | 2 +-
.../python3-debsbom/python3-debsbom_0.10.2.bb | 43 +++++++++++++++++++

2 files changed, 44 insertions(+), 1 deletion(-)

rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.1.bb} (95%)
create mode 100644 meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
index 7fc9a8eb..fa0b9b38 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.1.bb
@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
file://rules \
file://0001-Use-old-license-description-in-pyproject.toml.patch \
"
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"
+SRCREV = "00c7cc8b8984251e17a716b14602d20397724b59"

do_prepare_build[cleandirs] += "${S}/debian"
do_prepare_build() {
diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
new file mode 100644
index 00000000..1aec1369
--- /dev/null
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
@@ -0,0 +1,43 @@
+# This software is a part of Isar.
+# Copyright (c) Siemens, 2025
+#
+# SPDX-License-Identifier: MIT
+
+inherit dpkg
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+S = "${WORKDIR}/git"
+
+DEPENDS:append:bookworm = " python3-packageurl"
+DEPENDS:append:noble = " python3-packageurl"
+
+S = "${WORKDIR}/git"
+
+MAINTAINER = "Christoph Steiger <christop...@siemens.com>"
+DPKG_ARCH = "all"
+DEBIAN_BUILD_DEPENDS = "dh-python, \
+ python3-all, \
+ python3-setuptools, \
+ pybuild-plugin-pyproject, \
+ python3-packageurl, \
+ python3-debian, \
+ python3-requests, \
+ python3-zstandard, \
+ python3-license-expression, \
+ "
+
+DEBIAN_DEPENDS = "python3-apt, \${python3:Depends}, \${misc:Depends}"
+
+DESCRIPTION = "debsbom generates SBOMs for Debian based distributions."
+
+SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
+ file://rules \
+ file://0001-Use-old-license-description-in-pyproject.toml.patch \
+ "
+SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+ deb_debianize
+}
--
2.55.0

[Felix Moessbauer]

Changes since v2:

- delete leftover recipe for 0.10.1

Changes since v1:

- bump debsbom version to 0.10.2 (which fixes the issues
found on 0.10.1)

Felix Moessbauer (3):
imager sbom: simplify invocation of debsbom tool
debsbom: update to v0.10.2
rootfs sbom: directly use captured apt state without extraction

meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
meta/classes/sbom.bbclass | 10 ++--------
...hon3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} | 2 +-
3 files changed, 4 insertions(+), 14 deletions(-)
rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} (95%)

--
2.55.0

[Felix Moessbauer]

This brings a couple of bugfixes, as well as support to read the package
data from a tar file.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

.../{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} (95%)

diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb

rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
index 7fc9a8eb..1aec1369 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
file://rules \
file://0001-Use-old-license-description-in-pyproject.toml.patch \
"
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"

+SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"

do_prepare_build[cleandirs] += "${S}/debian"
do_prepare_build() {

--
2.55.0

[Felix Moessbauer]

We don't need to create the output directory upfront, as bwrap
internally does this on bind-mounting. Further, we avoid being extra
verbose to align the debsbom CLI with the other invocations.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

meta/classes-recipe/image-tools-extension.bbclass | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index 8f666444..754db7a6 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -102,10 +102,6 @@ EOAPT
}

generate_imager_sbom_in_chroot() {
- run_privileged mkdir -p \

- ${SBOM_CHROOT_LOCAL}/mnt/rootfs \

- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
-

TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})

sbom_document_uuid="${@d.getVar('SBOM_DOCUMENT_UUID') or generate_document_uuid(d, False)}"
bwrap \
@@ -114,7 +110,7 @@ generate_imager_sbom_in_chroot() {

--bind ${SBOM_CHROOT_LOCAL} / \

--bind $1 /mnt/rootfs \
--bind ${WORKDIR} /mnt/deploy-dir \
- -- debsbom -vv generate ${SBOM_DEBSBOM_TYPE_ARGS} \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} \
--from-pkglist -r /mnt/rootfs -o /mnt/deploy-dir/imager \

--distro-name '${SBOM_DISTRO_NAME}-Imager' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \

--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \
--

2.55.0

[Felix Moessbauer]

Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

meta/classes/sbom.bbclass | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..43b8a71e 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,14 @@ EOF
}

generate_sbom() {
- run_privileged_heredoc <<'EOF'

- mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir

- tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
- -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF

-
TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})

+ unzstd < ${WORKDIR}/${ROOTFS_APT_STATE} | \
bwrap \
--unshare-user \
--unshare-pid \

--bind ${SBOM_CHROOT_LOCAL} / \

--bind ${SBOM_LOCAL_DEPLOYDIR} /mnt/deploy-dir \
- -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
+ -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r - -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \

--distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \

--distro-version '${SBOM_DISTRO_VERSION}' --distro-arch '${DISTRO_ARCH}' \

[Florian Bezdeka]

On Mon, 2026-09-07 at 14:37 +0200, 'Felix Moessbauer' via isar-users
wrote:

Hm, debsbom (=debian sbom, right?) has no upstream debian/ directory? As
the tool is part of forky that means someone must have done a the same
work already...

> +
> +SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
> + file://rules \
> + file://0001-Use-old-license-description-in-pyproject.toml.patch \
> + "
> +SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"
> +
> +do_prepare_build[cleandirs] += "${S}/debian"
> +do_prepare_build() {
> + deb_debianize
> +}
> --
> 2.55.0
>

> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907123728.335093-3-felix.moessbauer%40siemens.com.

[Christoph Steiger]

There is an upstream packaging [1] which is also maintained by us.
Unfortunately debsbom is only available in trixie backports and not at
all in bookworm. When we introduced the SBOM support we needed to
package it in isar since it wasnt yet packaged upstream and it has
stayed like this since then. We will at some point probably just use the
upstream version.

[1] https://salsa.debian.org/python-team/packages/debsbom

[Zhihang Wei]

Hi Felix,

The test_sbom_rootfs_generate test failed on CI. It can pass in rootless
mode but failed in root mode.

Failed task:
mc:qemuamd64-trixie:/isar/build/../meta-test/recipes-core/images/isar-rootfs-ci.bb:do_generate_sbom
Relevant task log:
DEBUG: Executing python function sstate_task_prefunc
DEBUG: Python function sstate_task_prefunc finished
DEBUG: Executing python function do_generate_sbom
DEBUG: Executing shell function prepare_sbom_chroot
DEBUG: Shell function prepare_sbom_chroot finished
DEBUG: Executing shell function generate_sbom
bwrap: Can't mkdir /mnt/deploy-dir: Permission denied
WARNING: exit code 1 from a shell command.
DEBUG: Executing shell function cleanup_sbom_chroot
DEBUG: Shell function cleanup_sbom_chroot finished
DEBUG: Python function do_generate_sbom finished

To recreate the issue, run:
scripts/run-tests.sh testsuite/citest.py:test_sbom_rootfs_generate

Zhihang

[MOESSBAUER, Felix]

While debsbom itself is available in trixie-backports, the python3-
spdx-tools is not. By that, we can only generate CycloneDX SBOMs in a
pure Debian environment. For older targets like bookworm, we anyways
need a custom built in isar.

As the debsbom tool runs outside of the target chroot, it could also be
provided as host tool (e.g. in kas-container), or in a dedicated
(forky) chroot. The latter requires multiconfig for all targets that
want to have an SBOM generated, though.

> When we introduced the SBOM support we needed to
> package it in isar since it wasnt yet packaged upstream and it has
> stayed like this since then. We will at some point probably just use the
> upstream version.

While we could use the upstream packaging, it would significantly
increase the build time due to additional built-time dependencies
(which are optional if only supporting debsbom generate). We could
introduce build profiles in upstream to reduce the impact, but I'm not
sure if it is really worth it.

A third option would be to use Yocto's buildtools feature [2], but that
is currently not used in isar at all.

For now, I recommend to just keep the packaging as is and just update
it from time to time (only needed on generate related patches).

[2]
https://docs.yoctoproject.org/dev/ref-manual/system-requirements.html#downloading-a-pre-built-buildtools-tarball

Felix

[Felix Moessbauer]

Changes since v3:

- drop "imager sbom: simplify invocation of debsbom tool" patch:
to get correct directory permissions under schroot, we must
explicitly create the directory we deploy to
- p2: explicitly create the directory we deploy to

Changes since v2:

- delete leftover recipe for 0.10.1

Changes since v1:

- bump debsbom version to 0.10.2 (which fixes the issues
found on 0.10.1)

Felix Moessbauer (2):

debsbom: update to v0.10.2
rootfs sbom: directly use captured apt state without extraction

meta/classes/sbom.bbclass | 11 ++++-------
...on3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} | 2 +-
2 files changed, 5 insertions(+), 8 deletions(-)

rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} (95%)

--
2.55.0

[Felix Moessbauer]

Since version 0.10 debsbom is capable of reading the apt state from a
tarball instead of an extracted rootfs. By that, we can remove the
manual extraction of the apt state and instead directly pass the tarball
to debsbom.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

meta/classes/sbom.bbclass | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index b2e8aff6..dad8e8f6 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -51,20 +51,17 @@ EOF

}

generate_sbom() {
- run_privileged_heredoc <<'EOF'
- mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
- ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
- tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
- -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
-EOF

+ run_privileged \
+ mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir

[Felix Moessbauer]

This brings a couple of bugfixes, as well as support to read the package
data from a tar file.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---

.../{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

rename meta/recipes-support/python3-debsbom/{python3-debsbom_0.8.1.bb => python3-debsbom_0.10.2.bb} (95%)

diff --git a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

similarity index 95%
rename from meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb

rename to meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb
index 7fc9a8eb..1aec1369 100644
--- a/meta/recipes-support/python3-debsbom/python3-debsbom_0.8.1.bb
+++ b/meta/recipes-support/python3-debsbom/python3-debsbom_0.10.2.bb

@@ -35,7 +35,7 @@ SRC_URI = "git://github.com/siemens/debsbom.git;protocol=https;branch=main; \
file://rules \
file://0001-Use-old-license-description-in-pyproject.toml.patch \
"
-SRCREV = "a76d4e784f84e73b98d2bbeadd28c602a8c13708"

+SRCREV = "9b5a5d6be05f1207356223f88b3080bd72722b9f"

do_prepare_build[cleandirs] += "${S}/debian"
do_prepare_build() {

--
2.55.0