Re: [ptxdist] SBOM / manifest

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Tue, Oct 05, 2021 at 03:58:15PM +0200, Alexander Dahl wrote:
> Hei hei,
> 
> On Tue, Oct 05, 2021 at 09:38:55AM -0400, Akshay Bhat wrote:
> > Is there a way of generating a SBOM (Software Bill of Materials) i.e.
> > list all the software packages installed on the target with the
> > associated version and license info for a ptx-dist? Something similar
> > 'make legal-info' in buildroot.
> 
> You can generate a license report like this:
> 
>   ptxdist make license-report
> 
> You'll find the report in platform-foo/report as .pdf afterwards.

Or:

ptxdist make license-compliance-data

This generates platform-foo/release/license-compliance.yaml

This yaml file contains all the available informations about all packages.

> > The closest I could find was:
> > ptxdist list-packages | xargs ptxdist package-info | grep -e package:
> > -e version: -e license:
> > 
> > Also are there any plans in the roadmap for supporting a SPDX SBOM?

It's somewhere on my mental todo list. It is probably possible to generated
it from the yaml mentioned above.

Michael

> Not sure. But the documentation has some hints: 
> 
> https://www.ptxdist.org/doc/dev_licenses.html

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de