Re: [ptxdist] SBOM support

[Michael Olbrich <m.olbrich@pengutronix.de>]

Hi,

On Mon, Feb 19, 2024 at 04:54:16PM +0000, Simon Falsig wrote:
> > I'd be happy to get a bit of initial feedback on the approach. I'll have a
> > look at putting up some initial patches in the coming days too.
> > 
> > Thanks in advance and best regards,
> 
> Sorry for the silence around this, but I've been busy with other things in
> the last months.

No problem. That's just the way it works. I've been looking into SBOMs as
well but my current focus is spdx.

> Finally managed to get something working, that integrates with the existing
> host-system-python3 handling. I'll be sending some patches right after this.
> 
> Main open questions would be:
> - Currently HOST_SYSTEM_PYTHON3 and (the new) HOST_SYSTEM_PYTHON3_CYCLONEDX
>   packages need to be enabled manually through the "enable sbom report
>   generation" option in PTXdist options. Not sure if that is the right place
>   for it, or if there is a nicer way of handling it? (for instance, if it's
>   not enabled, 'ptxdist sbom-report' will just fail with a not-so-helpful
>   error message...)

Hmm, maybe we can do something with a lazy package. That would require a
real package, that actually builds the stuff, but I prefer that anyways.
Otherwise we'll just add an option next to PROJECT_GENERATE_REPORTS that
selects this.
I'm not sure yet, let me worry about that part.

> - It looks a bit like a local venv is being set up (in sysroot-host), but
>   I can't really figure out how to use it. A nice change could be to install
>   whatever host-system packages are needed in that venv automatically? Right
>   now the functionality requires users to manually install the required
>   python library with pip.

So this stuff is not packaged anywhere and as far as I can tell it's not on
pypi either, so I really prefer to package this locally.

And yes, PTXdist now installs this stuff into a venv. Use host-meson as an
example. It is installed into the venv. You may not need all the
dependencies, it depends a bit on the package. The installation into the
venv should happen automatically.

I'll reply to the patches for more stuff.

Michael

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |