Re: [ptxdist] [PATCH] RFC: sbom_report: Add support

[Simon Falsig <sfalsig@verity.net>]

> -----Original Message-----
> From: Bruno Thomsen <bruno.thomsen@gmail.com>
> Sent: Saturday, October 21, 2023 15:52
> Subject: Re: [ptxdist] [PATCH] RFC: sbom_report: Add support
> 
> Den man. 18. sep. 2023 kl. 16.34 skrev Simon Falsig <sfalsig@verity.net>:
> >
> > From: Simon Falsig <sfalsig@verity.ch>
> >
> > This provides support for building SBOMs in CycloneDX format.
> >
> > A target is added alongside the other reports, that (based on the
> > fast-bsp-report) extracts name, version, cpe and license of each
> > target package, and puts these into a final sbom-report in
> > CycloneDX/JSON format.
> >
> > This requires a working Python3 setup with the cyclonedx-bom package
> > installed.
> 
> Hi Simon,
> 
> I have tested this together with GitLab Dependency Scanning in Ultimate
> SaaS, and it seems to be working well.
> 
> Tested-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> 
> .gitlab-ci.yml example snippet:
> 
> -------------8<-------------
> 
> ptxdist sbom:
>   stage: build
>   script:
>     - cd ptxdist
>     - ./p sbom-report
>   artifacts:
>     reports:
>       dependency_scanning: <platform-dir>/release/sbom-report.json
> 
> -------------8<-------------
> 
> Thanks for working on this.
> 
> /Bruno
> 

Thanks, Bruno!

I've sadly not had time to work more on this lately, but am hoping to pick it up again later in November.

A bit stuck on how to properly provide / ensure that the needed Python cyclonedx libraries are available on the system. If anyone has any suggestions, I'd be happy to hear them :)

Best regards,
Simon