FreeBSD/src
FreeBSD/src
0
4
Code Issues Pull requests 10 Projects Releases Packages Activity Actions 29

Generate SBOM files as part of the build #20

Open
khorben wants to merge 1 commit from khorben/sbom-bomtool into main AGit
pull from: khorben/sbom-bomtool
merge into: FreeBSD:main
Conversation 0 Commits 1 Files changed 8 +60 -1
khorben commented 2026-04-22 22:22:28 +00:00
Member
Copy link

This introduces the following option:

  • MK_SBOM: enables the generation of SBOM files during the build.

This option uses bomtool(1) from the pkgconf project, as provided by the
MK_PKGCONF option. Consequently, MK_SBOM is automatically disabled when
MK_PKGCONF is disabled.

The following parameters are available as well:

  • BOMTOOL: Path to bomtool(1) (for SPDX version 2 files)
  • SBOMDIR: Source directory for pkg-config files (release/sbom/pkgconfig)
  • SPDXDIR: Destination for SPDX version 2 files (/usr/share/sbom/spdx)

Another tool from the pkgconf project, spdxtool(1), is planned for
import and will use the following options:

  • JSONLDDIR: Destination for SPDX version 3 files (/usr/share/sbom/jsonld)
  • SPDXTOOL: Path to spdxtool(1) (for SPDX version 3 files)

Sponsored by: Alpha-Omega, The FreeBSD Foundation

This introduces the following option: * MK_SBOM: enables the generation of SBOM files during the build. This option uses bomtool(1) from the pkgconf project, as provided by the MK_PKGCONF option. Consequently, MK_SBOM is automatically disabled when MK_PKGCONF is disabled. The following parameters are available as well: - BOMTOOL: Path to bomtool(1) (for SPDX version 2 files) - SBOMDIR: Source directory for pkg-config files (release/sbom/pkgconfig) - SPDXDIR: Destination for SPDX version 2 files (/usr/share/sbom/spdx) Another tool from the pkgconf project, spdxtool(1), is planned for import and will use the following options: - JSONLDDIR: Destination for SPDX version 3 files (/usr/share/sbom/jsonld) - SPDXTOOL: Path to spdxtool(1) (for SPDX version 3 files) Sponsored by: Alpha-Omega, The FreeBSD Foundation
Generate SBOM files as part of the build
Some checks failed
Checklist / commit (pull_request_target) Has been cancelled
Details
Cross-build Kernel / amd64 ubuntu-22.04 (clang-15) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 ubuntu-22.04 (clang-15) (pull_request) Has been cancelled
Details
Cross-build Kernel / amd64 ubuntu-24.04 (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 ubuntu-24.04 (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / amd64 macos-latest (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 macos-latest (clang-18) (pull_request) Has been cancelled
Details
88d4108f45 
This introduces the following option:

* MK_SBOM: enables the generation of SBOM files during the build.

This option uses bomtool(1) from the pkgconf project, as provided by the
MK_PKGCONF option. Consequently, MK_SBOM is automatically disabled when
MK_PKGCONF is disabled.

The following parameters are available as well:

- BOMTOOL:   Path to bomtool(1) (for SPDX version 2 files)
- SBOMDIR:   Source directory for pkg-config files (release/sbom/pkgconfig)
- SPDXDIR:   Destination for SPDX version 2 files (/usr/share/sbom/spdx)

Another tool from the pkgconf project, spdxtool(1), is planned for
import and will use the following options:

- JSONLDDIR: Destination for SPDX version 3 files (/usr/share/sbom/jsonld)
- SPDXTOOL:  Path to spdxtool(1) (for SPDX version 3 files)

Sponsored by:	Alpha-Omega, The FreeBSD Foundation
Some checks failed
Checklist / commit (pull_request_target) Has been cancelled
Details
Cross-build Kernel / amd64 ubuntu-22.04 (clang-15) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 ubuntu-22.04 (clang-15) (pull_request) Has been cancelled
Details
Cross-build Kernel / amd64 ubuntu-24.04 (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 ubuntu-24.04 (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / amd64 macos-latest (clang-18) (pull_request) Has been cancelled
Details
Cross-build Kernel / aarch64 macos-latest (clang-18) (pull_request) Has been cancelled
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/20/head:khorben/sbom-bomtool
git switch khorben/sbom-bomtool
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
FreeBSD/src!20
No description provided.