From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Mon, 19 Feb 2024 17:54:43 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1rc6uh-00EvjI-1T for lore@lore.pengutronix.de; Mon, 19 Feb 2024 17:54:43 +0100 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1rc6uh-0003Rs-5i; Mon, 19 Feb 2024 17:54:43 +0100 Received: from mail-zr0che01on2118.outbound.protection.outlook.com ([40.107.24.118] helo=CHE01-ZR0-obe.outbound.protection.outlook.com) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1rc6uJ-0003OZ-0f for ptxdist@pengutronix.de; Mon, 19 Feb 2024 17:54:19 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KJt1HCeZRCmxZSV0P2cPdRPoVk2BsGbsq5O3B0IL3IBCiMR2Jhrkplww1bbR5z1t8pLpQgV+LxYYSu8Y1JCS7eW4k+USl+tyg0Thh6NKMzNwa3/451SK0pAjoPmMvb+GoF8A5MoBZ8L/GFCB7siAFoio9gZeyaXGSZN2cmo4yViE2qhxGNvn7PNioGU1WYjaQZ9y4KTrV18Mrv2bGug3kQI5UzN13KgaC12ctqFwUtX7x+kABlctXpn6xR1lAoj9WF885PbFSsrQFq4BX5FIbu9UISCD8N+a0S3RQXQPT+hZeT/uaVW+KvhRZTJWCuxlT84b7PuDUdMjiJEchpgUpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ox9EB7+Mzu8PainKXZyKV0cfbXrUixzgE+XWM8hSVqE=; b=F2Rnz/QJIgWqNh9+KtdFRfs+KlWc6WHfw5GGiJvQ22w+b5P2qfBmFuDWImpIFArh+rYu6CkWeoDO2MvcVcTsS3t/OuoKaAktnuNjPcNV9V6Yl/ug8lziIRQNrVaeEnroTB+yzoQgvwOZPL1ZhC8I2jLacZi/Cml7UksepIHsozlOTbLVL4FOpAnrHLZp+ZDtzhCl5zhdXasd0IhThlUQPlXnaN5yt0xBk2i9UBDjoNEKP/VIk11TdHK2deERidI6t2QwXh8BtzI2pMCc2hW4lzisD4omjYFa9bs1MEmc7BougPwqOAPQP1w91P9G3M9nEh5SDvYnpy1z/fviXwgSaQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=verity.net; dmarc=pass action=none header.from=verity.net; dkim=pass header.d=verity.net; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verity.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ox9EB7+Mzu8PainKXZyKV0cfbXrUixzgE+XWM8hSVqE=; b=PTA5hsd7GB3Spazvyg4w01njbIncxRMG5TycAjcorHjxS0xlhieLSXaYkqwEsZGQQ3u0JM/6ai96vQX2odOIFUeOLJlfxFVpAvFL6RCx/d/ynsdIRVttxzmrrDPtz3bBukxozdgzU1pdMT0cH0seCOxPEnadSPKq0HFH0iZM2dMJKQqWDScyaEZbx61FjmSX7f+DqfXV8OphYvJolDGmGKTJQyqKv6wzBr/tsPLI4GV2a5uNh7kKb0ys5WcI4w/4vA0wdKWRoTSm0mgEgndk25WdZr7egb4p4HMUgPoHzhA84h1YtM9Bdkx1gflQadYoCQuq+vFY1yA7rpy4qsu/dQ== Received: from ZR0P278MB0991.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:54::8) by GVAP278MB0764.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:46::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.38; Mon, 19 Feb 2024 16:54:16 +0000 Received: from ZR0P278MB0991.CHEP278.PROD.OUTLOOK.COM ([fe80::11ae:207:fffc:fdd1]) by ZR0P278MB0991.CHEP278.PROD.OUTLOOK.COM ([fe80::11ae:207:fffc:fdd1%7]) with mapi id 15.20.7292.036; Mon, 19 Feb 2024 16:54:16 +0000 From: Simon Falsig To: "ptxdist@pengutronix.de" Thread-Topic: SBOM support Thread-Index: AdnhnHsNiqon0zJeSR+/uNVF6SJp1CBto6Hg Date: Mon, 19 Feb 2024 16:54:16 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=verity.net; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: ZR0P278MB0991:EE_|GVAP278MB0764:EE_ x-ms-office365-filtering-correlation-id: a5e5ba24-d903-4d3a-bb90-08dc316b6867 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: QvH7clAHDLZ1gWXhKkzU2CBFO/tftpqCmDVKDwxVubynFhNgoBBVIUTHatoS2eN5qv2icivctbhSLqcwRuKXpCcZ2Q/oXHn5GA8vPGcDsa99osha/A1ImygW2BDanU2MX+g4uhBnaIRtqqdJ1cinZWuzr4yHlliSP6lpSar7inCK3EsTuP9jrCPpf8B0KWJFwKk2F6EAEEbYYM9VtmP5e04k7qk7Jp9JC3b8VLlC/qBvKsx0TySC7tv++78xS8NbWO3BGnKKNkJuBQCt/eJTp9V36Orna/6yONPOfhMCOMjkHMqB6T2DBfEJTK7+6tH3K+rVSCzDT95LvM2XlJh30wW5HGq/FXunUalZlGJnxVimOqQH6c3H5+pLaTmCUZ+9Xtey/nrHaHpUwu+Pk3TF4RA9TTPV0fGEdx81F3MPqSLVVJgeYeD+rWiL5gY+0VWi3Ny6Ly/B8zsoC2rAbKznucCgYFEBH6FPkzHA8p1PRqSF706f3BYIvMzQ2PUP2jnoRm3lndREtick8IDhSHJR9+mh1XEIRyKt/RTqCUtv9r4Z/nalN1UxyOdk17XMAZXDwMocKVozVghvqSLTfCVnRkRPyyWy4Ggx+ikZNlq9CrQm7EhTC+hQLyOO8En5PCh3 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:ZR0P278MB0991.CHEP278.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(38070700009); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?K86vZaFcHmAYV7QHjUS0eD7U6CdxPWVn/P3Re9l6eIgnmT/qel4xYpR+7ukF?= =?us-ascii?Q?M4E8hvn0QH2CDPIYGSsHTXiFu94hgW3JLQOxaDWzTPN7sTV73v/9lnwjDW8h?= =?us-ascii?Q?3ZPOXGKJ/ZoazuS9+ZQgKa8MzUi5YjfNTgVrWP7Ai5TVGxZtIsojFepdC3KG?= =?us-ascii?Q?tPpeTgZiw/q8Jz4CawkO5uKOA+i8iCh1VC/B1eBAdDVTI2jkE0R8WUr53SvN?= =?us-ascii?Q?UzXflCjRGtJjzDu0lgXluhmhQMAozlkvkgkqmff3UXpvf1UL+yKJ8ICI1hXD?= =?us-ascii?Q?gU5Lld+2EUm0je4KIOimGF2cYdmFSt/rkbrq3Oxnz1qzLk/1xF5QM1F2OTUH?= =?us-ascii?Q?OfY/GW0klDXRbc/JF7T334HyVxKO2pJ44vbsNuBUevroiXZAniJ2QabMLCQR?= =?us-ascii?Q?A7FqsPcvhNqzhDLLbgGBtlgKEdwfibDXJq8bWIs6RPpQ5Y/NEdVR6VW6XRSx?= =?us-ascii?Q?7MCBnEzxd1t+jPmymKTA6JmC7XRaoJIqXOjMciJuHl6muTIWBWJwPymMbojZ?= =?us-ascii?Q?ovGZ7A48IzTy/vnzsOjzoM5LygilPLXAlFCNprXG01kegAsM9PSdqduvWN7h?= =?us-ascii?Q?awYecOHwoXZI1+RHOuuM6TTkjiePtpFr19v00nn/nGeDGFawoJQqzeb0cTJ2?= =?us-ascii?Q?/vqOTurb4GtaYTFZoziOP7vNUgPz9fs/Qb6KuZhxUpxtrruMsAp3e/6JdI1m?= =?us-ascii?Q?9/NbIksPNgLO3+RHrQNTpcFsc7yHThJ8n541bNVu/zPdh4EJJvCyzbqJNpgB?= =?us-ascii?Q?6xeBE7PjDLMXOTgKtcnUMUXtLN1qO0OcO+hsWjmcxVYMP7K8KhO1KqK5bv0d?= =?us-ascii?Q?zCxxgEZix5TDnYCq6yTbhmOStnx/X8lWLFInNc4j7I6VXpyFwUVgN7SbP3LQ?= =?us-ascii?Q?Z8qz/Mt+BrOfmRhz2kbp82J/j9yK/pJhisHQxF7s3vg16ccEYdsWzJbtH3bm?= =?us-ascii?Q?rSfZaoEI5xz5/aW1lM/JrPRWCm991m6sgnD48M2LcKCFl1FCMEnOWNkW/JTp?= =?us-ascii?Q?MIdfDfhqyE3KjW01ro78uuX9kjfbEtpVlgseGPkP1TYFOkLZkOQfsHX5chzj?= =?us-ascii?Q?3p9Uyf+fT3RpaH25q7pTW58xDP3df7hrbbIugSVBBi1j6bQp/0/ftxhdawIO?= =?us-ascii?Q?UPcY1AlBjXxc/76pq1bfttweXE8Ax2jNTEG2EyXZpgPhdiIyM6OV9aPjKox5?= =?us-ascii?Q?Sq+JZbYNC8wHyqtwv8m9aqPol3l6h5WabP8LKdE/iJaZ0nQO+tYFumDNavh8?= =?us-ascii?Q?9nT4jSA0NMw/z6c3dkJFCdo3dDZzCEdZjQI2RlempHDPqIux2CXUWHNFVVES?= =?us-ascii?Q?YPql3yCQO3Oo6nj/i3R9P4rMj/4dxzp2z3UNq6HgNZ69VmohIGhX3wco6dJA?= =?us-ascii?Q?nEnCUp4PbCJuVX2TMn8sA4SnXDwy1UQltNfnIUwrxZ6rohatkamLyM0s5NFR?= =?us-ascii?Q?6xBxesDHYeRagGOjjZDDDoTb/rL44dVx5EzhHNlMMkO9x9GvDD3z1vm2lPK1?= =?us-ascii?Q?ESN3uuBy/o5SpuChZtCgNdFKZx3zUCeoTTLBja6f2Ws7QxCV0DY+YtyHwGUj?= =?us-ascii?Q?sJfZPdmgDTDZdZuii34=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: verity.net X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: ZR0P278MB0991.CHEP278.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a5e5ba24-d903-4d3a-bb90-08dc316b6867 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Feb 2024 16:54:16.2296 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 06487c72-7d88-4632-bf56-071603defa0a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ajIermYlWS0POWsDz7Vd3VjHxef2ZKo3xIreY7TvQxBIcu4WUMYPHoHNj0PEuBJlbnT5brCePG7lZBfgA4hShg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVAP278MB0764 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] SBOM support X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hi, > I'd be happy to get a bit of initial feedback on the approach. I'll have = a > look at putting up some initial patches in the coming days too. >=20 > Thanks in advance and best regards, Sorry for the silence around this, but I've been busy with other things in the last months. Finally managed to get something working, that integrates with the existing host-system-python3 handling. I'll be sending some patches right after this= . Main open questions would be: - Currently HOST_SYSTEM_PYTHON3 and (the new) HOST_SYSTEM_PYTHON3_CYCLONEDX packages need to be enabled manually through the "enable sbom report generation" option in PTXdist options. Not sure if that is the right plac= e for it, or if there is a nicer way of handling it? (for instance, if it's not enabled, 'ptxdist sbom-report' will just fail with a not-so-helpful error message...) - It looks a bit like a local venv is being set up (in sysroot-host), but I can't really figure out how to use it. A nice change could be to instal= l whatever host-system packages are needed in that venv automatically? Righ= t now the functionality requires users to manually install the required python library with pip. Happy to hear of any input! Thanks in advance, Simon