Re: [ptxdist] SBOM support

[Simon Falsig <sfalsig@verity.net>]

> From: Michael Olbrich <m.olbrich@pengutronix.de>
> Sent: Monday, March 4, 2024 17:09
> Hi,
> 
> On Mon, Feb 19, 2024 at 04:54:16PM +0000, Simon Falsig wrote:
> > > I'd be happy to get a bit of initial feedback on the approach. I'll
> > > have a look at putting up some initial patches in the coming days too.
> > >
> > > Thanks in advance and best regards,
> >
> > Sorry for the silence around this, but I've been busy with other
> > things in the last months.
> 
> No problem. That's just the way it works. I've been looking into SBOMs as
> well but my current focus is spdx.
> 
> > Finally managed to get something working, that integrates with the
> > existing
> > host-system-python3 handling. I'll be sending some patches right after
> this.
> >
> > Main open questions would be:
> > - Currently HOST_SYSTEM_PYTHON3 and (the new)
> HOST_SYSTEM_PYTHON3_CYCLONEDX
> >   packages need to be enabled manually through the "enable sbom report
> >   generation" option in PTXdist options. Not sure if that is the right
> place
> >   for it, or if there is a nicer way of handling it? (for instance, if
> it's
> >   not enabled, 'ptxdist sbom-report' will just fail with a not-so-
> helpful
> >   error message...)
> 
> Hmm, maybe we can do something with a lazy package. That would require a
> real package, that actually builds the stuff, but I prefer that anyways.
> Otherwise we'll just add an option next to PROJECT_GENERATE_REPORTS that
> selects this.
> I'm not sure yet, let me worry about that part.
> 
> > - It looks a bit like a local venv is being set up (in sysroot-host),
> but
> >   I can't really figure out how to use it. A nice change could be to
> install
> >   whatever host-system packages are needed in that venv automatically?
> Right
> >   now the functionality requires users to manually install the required
> >   python library with pip.
> 
> So this stuff is not packaged anywhere and as far as I can tell it's not
> on pypi either, so I really prefer to package this locally.
> 
> And yes, PTXdist now installs this stuff into a venv. Use host-meson as an
> example. It is installed into the venv. You may not need all the
> dependencies, it depends a bit on the package. The installation into the
> venv should happen automatically.
> 
> I'll reply to the patches for more stuff.
> 
> Michael
> 

Thanks for the detailed reply and review, Michael!

I've had a look at your comments, and agree that it overall makes good sense
to wait for your work, and then base the CycloneDX SBOM generation off of
that. While I feel rather comfortable *using* ptxdist (at least for my
previous and current usecases), I have very little insight into the internal
workings and structure of the project...

Maybe I'll find a bit of time to dive deeper into things before though, let's
see.

Thanks again, and have a good weekend!
Simon