Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122899

Generate SBOM from Qt build system

    XMLWordPrintable

Details

    • All
    • d940399b3 (dev), 37a5e0012 (dev), 79f9b490e (dev), 65bf57ce7 (6.8), fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8)

    Description

      Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

      Related work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          relates to

          Task - A task that needs to be done. QTBUG-133796 Use correct info for Creator Organization in REUSE-generated source SBOMs

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          resulted in

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-127335 Check that sbom spdx files are included in release packages

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; Flaky tests; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Open
          split to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          Task - A task that needs to be done. QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-134894 Various improvements for SBOM generation

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-128320 Generate an SBOM for qttranslations

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129601 Provide custom SBOM's in deployment tooling

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-131281 Provide SBOM information for tools used during Qt build

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          For Gerrit Dashboard: QTBUG-122899
          # Subject Branch Project Status CR V
          564092,5 coin: Enable git cloning dev qt/qtbase Status: MERGED +2 -1
          565524,7 WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries dev qt/qtwebengine Status: DEFERRED -2 0
          586284,3 coin: Enable git cloning dev qt/qtdeclarative Status: MERGED +2 +1
          586287,3 coin: Enable git cloning dev qt/qtsvg Status: MERGED +2 0
          608786,14 WIP: CMake: Experiments with SBOM API for webengine dev qt/qtsvg Status: ABANDONED -2 0
          616350,12 CMake: Simplify and fix target dependency handling in SBOMs dev qt/qtbase Status: MERGED +2 0
          616661,17 CMake: Decouple Qt specific handling from SBOM implementation dev qt/qtbase Status: MERGED +2 0
          619984,15 CMake: Rework SBOM PURL handling dev qt/qtbase Status: MERGED +2 +1
          620017,2 CMake: Remove qt executable SBOM generation stale code 6.9 qt/qtbase Status: MERGED +2 0
          620018,2 CMake: Add a few more internal sbom helper functions 6.9 qt/qtbase Status: MERGED +2 0
          620266,2 CMake: Prepend underscore to qt_internal_sbom_set_default_option_value 6.8 qt/qtbase Status: MERGED +2 0
          620269,2 CMake: Add SUPPLIER as an option to SBOM packages 6.8 qt/qtbase Status: MERGED +2 0
          620270,2 CMake: Allow skipping some parts of SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          620271,2 CMake: Add a fake deterministic SBOM generation option 6.8 qt/qtbase Status: MERGED +2 0
          620272,2 CMake: Add qt exported target name and package name into SBOM 6.8 qt/qtbase Status: MERGED +2 0
          620273,2 CMake: Fix SBOM inline comment 6.8 qt/qtbase Status: MERGED +2 0
          620274,2 CMake: Remove qt executable SBOM generation stale code 6.8 qt/qtbase Status: MERGED +2 0
          620275,2 CMake: Add a few more internal sbom helper functions 6.8 qt/qtbase Status: MERGED +2 0
          621575,2 coin: Enable git cloning 6.9 qt/qtsvg Status: MERGED +2 0
          621633,2 coin: Enable git cloning 6.9 qt/qtbase Status: MERGED +2 0
          621657,2 coin: Enable git cloning 6.8 qt/qtsvg Status: MERGED +2 0
          621677,2 coin: Enable git cloning 6.8 qt/qtbase Status: MERGED +2 0
          621834,2 coin: Enable git cloning 6.9 qt/qtdeclarative Status: MERGED +2 0
          621858,3 CMake: Fix location of build time sboms in no-prefix builds dev qt/qtbase Status: MERGED +2 0
          621907,2 coin: Enable git cloning 6.8 qt/qtdeclarative Status: MERGED +2 0
          623731,2 CMake: Fix location of build time sboms in no-prefix builds 6.9 qt/qtbase Status: MERGED +2 0
          623734,2 CMake: Decouple Qt specific handling from SBOM implementation 6.9 qt/qtbase Status: MERGED +2 0
          623776,2 CMake: Simplify and fix target dependency handling in SBOMs 6.9 qt/qtbase Status: MERGED +2 0
          623805,2 CMake: Fix broken qt_attribution.json files after cherry-pick tqtc/lts-6.5 qt/tqtc-qtbase Status: MERGED +2 0
          623847,2 CMake: Fix location of build time sboms in no-prefix builds 6.8 qt/qtbase Status: MERGED +2 0
          623851,2 CMake: Decouple Qt specific handling from SBOM implementation 6.8 qt/qtbase Status: MERGED +2 0
          623852,2 CMake: Simplify and fix target dependency handling in SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          624288,2 CMake: Always save SBOM python interpreter path dev qt/qtbase Status: MERGED +2 0
          624289,2 CMake: Improve error reporting about missing SBOM dependencies dev qt/qtbase Status: MERGED +2 0
          624290,5 CMake: Make sure to look up deps when converting json to tag SPDX doc dev qt/qtbase Status: MERGED +2 0
          624503,3 CMake: Add internal API to check if json SBOM generation deps are met dev qt/qtbase Status: MERGED +2 0
          624633,2 CMake: Always save SBOM python interpreter path 6.9 qt/qtbase Status: MERGED +2 0
          624795,2 CMake: Improve error reporting about missing SBOM dependencies 6.9 qt/qtbase Status: MERGED +2 0
          624796,2 CMake: Make sure to look up deps when converting json to tag SPDX doc 6.9 qt/qtbase Status: MERGED +2 0
          624797,2 CMake: Add internal API to check if json SBOM generation deps are met 6.9 qt/qtbase Status: MERGED +2 0
          624822,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders dev qt/qtbase Status: MERGED +2 0
          624884,2 CMake: Always save SBOM python interpreter path 6.8 qt/qtbase Status: MERGED +2 0
          624887,2 CMake: Improve error reporting about missing SBOM dependencies 6.8 qt/qtbase Status: MERGED +2 0
          624888,2 CMake: Make sure to look up deps when converting json to tag SPDX doc 6.8 qt/qtbase Status: MERGED +2 0
          624889,2 CMake: Add internal API to check if json SBOM generation deps are met 6.8 qt/qtbase Status: MERGED +2 0
          625801,3 CMake: Move more Qt-specific SBOM PURL functions to the right file dev qt/qtbase Status: MERGED +2 0
          625802,3 CMake: Move generic PURL function from qt-specific file to main one dev qt/qtbase Status: MERGED +2 0
          626229,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders 6.9 qt/qtbase Status: MERGED +2 0
          626298,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders 6.8 qt/qtbase Status: MERGED +2 0
          626511,2 CMake: Move more Qt-specific SBOM PURL functions to the right file 6.9 qt/qtbase Status: MERGED +2 0
          626512,2 CMake: Move generic PURL function from qt-specific file to main one 6.9 qt/qtbase Status: MERGED +2 0
          626513,2 CMake: Rework SBOM PURL handling 6.9 qt/qtbase Status: MERGED +2 0
          626564,2 CMake: Move more Qt-specific SBOM PURL functions to the right file 6.8 qt/qtbase Status: MERGED +2 0
          626565,2 CMake: Move generic PURL function from qt-specific file to main one 6.8 qt/qtbase Status: MERGED +2 0
          626566,2 CMake: Rework SBOM PURL handling 6.8 qt/qtbase Status: MERGED +2 0
          626921,3 CMake: Remove type restriction on attribution download location dev qt/qtbase Status: MERGED +2 0
          626922,3 CMake: Remove type restriction on attribution file extra SBOM info dev qt/qtbase Status: MERGED +2 0
          626923,5 CMake: Allow including specific attribution ids in SBOMs dev qt/qtbase Status: MERGED +2 0
          626924,5 CMake: Allow creating nested SBOM attribution targets for all entities dev qt/qtbase Status: MERGED +2 0
          626939,4 CMake: Re-order SBOM embedded qt_attribution.json fields dev qt/qtbase Status: MERGED +2 0
          626940,4 CMake: Remove leftover code after refactoring dev qt/qtbase Status: MERGED +2 0
          626941,4 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES dev qt/qtbase Status: MERGED +2 0
          626942,4 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions dev qt/qtbase Status: MERGED +2 0
          626943,4 CMake: Extract Qt-specific license concluded handling dev qt/qtbase Status: MERGED +2 0
          626944,3 CMake: Sanitize nested SBOM attribution target names dev qt/qtbase Status: MERGED +2 0
          627240,4 CMake: Handle installing files with same name during SBOM generation dev qt/qtbase Status: MERGED +2 0
          627533,2 CMake: Handle DIRECTORIES in SBOM custom file sets dev qt/qtbase Status: MERGED +2 0
          627774,2 CMake: Remove type restriction on attribution download location 6.9 qt/qtbase Status: MERGED +2 0
          627775,2 CMake: Remove type restriction on attribution file extra SBOM info 6.9 qt/qtbase Status: MERGED +2 0
          627776,2 CMake: Sanitize nested SBOM attribution target names 6.9 qt/qtbase Status: MERGED +2 0
          627777,2 CMake: Allow including specific attribution ids in SBOMs 6.9 qt/qtbase Status: MERGED +2 0
          627778,2 CMake: Allow creating nested SBOM attribution targets for all entities 6.9 qt/qtbase Status: MERGED +2 0
          627779,2 CMake: Re-order SBOM embedded qt_attribution.json fields 6.9 qt/qtbase Status: MERGED +2 0
          627780,2 CMake: Remove leftover code after refactoring 6.9 qt/qtbase Status: MERGED +2 0
          627781,2 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES 6.9 qt/qtbase Status: MERGED +2 0
          627782,2 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions 6.9 qt/qtbase Status: MERGED +2 0
          627783,2 CMake: Extract Qt-specific license concluded handling 6.9 qt/qtbase Status: MERGED +2 0
          627784,2 CMake: Handle DIRECTORIES in SBOM custom file sets 6.9 qt/qtbase Status: MERGED +2 0
          627865,2 CMake: Include license and license file attribution in SBOM comment dev qt/qtbase Status: MERGED +2 0
          627877,3 CMake: Add function to set up SBOM generation defaults dev qt/qtbase Status: MERGED +2 0
          627896,2 CMake: Handle installing files with same name during SBOM generation 6.9 qt/qtbase Status: MERGED +2 0
          627899,2 CMake: Remove type restriction on attribution download location 6.8 qt/qtbase Status: MERGED +2 0
          627900,2 CMake: Remove type restriction on attribution file extra SBOM info 6.8 qt/qtbase Status: MERGED +2 0
          627901,2 CMake: Sanitize nested SBOM attribution target names 6.8 qt/qtbase Status: MERGED +2 0
          627902,2 CMake: Allow including specific attribution ids in SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          627903,2 CMake: Allow creating nested SBOM attribution targets for all entities 6.8 qt/qtbase Status: MERGED +2 0
          627904,2 CMake: Re-order SBOM embedded qt_attribution.json fields 6.8 qt/qtbase Status: MERGED +2 0
          627905,2 CMake: Remove leftover code after refactoring 6.8 qt/qtbase Status: MERGED +2 0
          627906,2 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES 6.8 qt/qtbase Status: MERGED +2 0
          627907,2 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions 6.8 qt/qtbase Status: MERGED +2 0
          627908,2 CMake: Extract Qt-specific license concluded handling 6.8 qt/qtbase Status: MERGED +2 0
          627929,2 CMake: Handle DIRECTORIES in SBOM custom file sets 6.8 qt/qtbase Status: MERGED +2 0
          627942,2 CMake: Handle installing files with same name during SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          628177,2 CMake: Include license and license file attribution in SBOM comment 6.9 qt/qtbase Status: MERGED +2 0
          628178,2 CMake: Add function to set up SBOM generation defaults 6.9 qt/qtbase Status: MERGED +2 0
          628376,2 CMake: Include license and license file attribution in SBOM comment 6.8 qt/qtbase Status: MERGED +2 0
          628378,2 CMake: Add function to set up SBOM generation defaults 6.8 qt/qtbase Status: MERGED +2 0
          628509,2 CMake: Remove semicolon from SBOM external document references dev qt/qtbase Status: MERGED +2 0
          628614,2 CMake: Remove semicolon from SBOM external document references 6.9 qt/qtbase Status: MERGED +2 0
          628717,2 CMake: Remove semicolon from SBOM external document references 6.8 qt/qtbase Status: MERGED +2 0

          Activity

            People

              alexandru.croitor Alexandru Croitor
              kkohne Kai Köhne
              Votes:
              2 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes