Skip to content

feature: sbom macro to based on debuginfo_template #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

feature: sbom macro to based on debuginfo_template #303

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions macros/shared
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,9 +297,29 @@ CROSS_CMAKE_TOOLCHAIN_EOF\
%_cross_sbom_dir %{_cross_datadir}/sboms
%_cross_sbom_package_dir %{_cross_sbom_dir}/%{_uncross_name}

%cross_generate_sbom \
%cross_sbom_files %{_cross_sbom_package_dir}/*
Copy link
Contributor

@bcressey bcressey Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: might not be worth the extra macro for this.


%_sbom_template \
%package sbom\
Summary: SBOM (Software Bill of Materials) for %{name}\
Group: Documentation\
AutoReqProv: 0\
%description sbom\
This package provides SBOM files for %{name}.\
%files sbom\
%{cross_sbom_files}\
%{nil}

%_enable_sbom_packages 1
Copy link
Contributor

@bcressey bcressey Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like it's two ways to disable SBOM generation:

%undefine _enable_sbom_packages
%global __sbom_package %{nil}

I think it'd be more clear to do what debuginfo_package does, so there's only one "user-facing" macro to set:

# The duplicate __sbom_package definition is needed to ensure matching
# state when %install is skipped due to short-circuit, IFF buildsubdir
# is defined (indicating use of automatic debuginfo generation)
%sbom_package \
%global __sbom_package 1\
%{?buildsubdir:%%global __sbom_package 1}\
%_sbom_template\
%{nil}

At the spec level:

# turns off debug package
%global debug_package %{nil}

# turns off sbom package
%global sbom_package %{nil}

At the macro level (here):

%__arch_install_post \
...
%{?__sbom_package:%{__sbom_install_post}}\


# Auto-inject SBOM subpackage - set flag then expand template
%install %{?_enable_sbom_packages:%{?buildsubdir:%{expand:%%global __sbom_package 1}%_sbom_template}}\
%%install\
%{nil}
Comment on lines +315 to +318
Copy link
Contributor

@bcressey bcressey Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like messing with %install like this. What does it actually do?


%cross_generate_sbom() \
mkdir -p %{_builddir}/sbom-temp \
sbomtool generate --name %{name} --out-dir %{_builddir}/sbom-temp --build-dir %{_builddir} --spdx --cyclonedx
sbomtool generate --name %{?1:%{1}}%{!?1:%{name}} --out-dir %{_builddir}/sbom-temp --build-dir %{?2:%{2}}%{!?2:%{_builddir}} --spdx --cyclonedx
Copy link
Contributor

@bcressey bcressey Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you give some examples of %cross_generate_sbom invocations? The two argument form vs. no arguments?


%cross_install_sbom \
install -d %{buildroot}%{_cross_sbom_package_dir} \
Expand Down Expand Up @@ -354,7 +374,13 @@ CROSS_CMAKE_TOOLCHAIN_EOF\
%__arch_install_post \
/usr/lib/rpm/check-buildroot \
%{?cross_check_fips:%{__cross_check_fips_cmd}} \
%cross_generate_attribution
%cross_generate_attribution \
%{?__sbom_package:%cross_install_sbom}

# Post-build hook for SBOM generation
%__spec_build_post \
%{?__sbom_package:%cross_generate_sbom} \
%{___build_post}
Comment on lines +380 to +383
Copy link
Contributor

@bcressey bcressey Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need to split this into two phases, instead of combining generate and install?


# Link "sources" from the new per-package build directory to the old location.
%__spec_prep_pre \
Expand Down