Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122899

Generate SBOM from Qt build system

    XMLWordPrintable

Details

    • All
    • d940399b3 (dev), 37a5e0012 (dev), 79f9b490e (dev), 65bf57ce7 (6.8), fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8)

    Description

      Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

      Related work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          resulted in

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-127335 Check that sbom spdx files are included in release packages

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Open
          split to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          Task - A task that needs to be done. QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-128320 Generate an SBOM for qttranslations

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129601 Provide custom SBOM's in deployment tooling

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-131281 Provide SBOM information for tools used during Qt build

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open
          For Gerrit Dashboard: QTBUG-122899
          # Subject Branch Project Status CR V
          564092,3 WIP: coin: Enable git cloning dev qt/qtbase Status: NEW -2 -1
          565524,7 WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries dev qt/qtwebengine Status: NEW -2 0
          586284,1 WIP: coin: Enable git cloning dev qt/qtdeclarative Status: NEW -2 +1
          586287,1 WIP: coin: Enable git cloning dev qt/qtsvg Status: NEW -2 +1
          604364,7 CMake: Create separate SBOM documents for QtWebEngine and QtPdf dev qt/qtwebengine Status: NEW +2 0
          604971,27 CMake: Add SBOM support for translations, custom files and friends dev qt/qtbase Status: NEW 0 0
          604973,8 CMake: Add translation files to SBOM 6.8 qt/qttranslations Status: NEW 0 0
          608770,19 CMake: Add API to include custom cmake files during SBOM generation dev qt/qtbase Status: NEW 0 0
          608773,20 CMake: Add API to allow referencing external packages in the SPDX SBOM dev qt/qtbase Status: NEW +2 0
          608782,18 CMake: Allow adding custom SBOM relationships to targets and projects dev qt/qtbase Status: NEW 0 0
          608784,23 CMake: Add way to convert JSON SPDX to tag/value SPDX document dev qt/qtbase Status: NEW +2 0
          608786,10 WIP: CMake: Experiments with SBOM API for webengine dev qt/qtsvg Status: NEW -2 0
          609644,5 CMake: Remove SBOM multi-config dead code dev qt/qtbase Status: NEW +2 0
          610136,4 CMake: Move SBOM project ops setup to run at project begin time dev qt/qtbase Status: NEW +2 0
          610148,10 CMake: Add internal functions to get various kinds of spdx ids dev qt/qtbase Status: NEW +2 0
          578552,19 CMake: Rework SBOM PURL handling to handle multiple values dev qt/qtbase Status: MERGED +2 0
          578553,44 CMake: Add PURL and CPE info to 3rd party attribution files dev qt/qtbase Status: MERGED +2 0
          580720,5 CMake: Detect 3rd party header modules during SBOM generation dev qt/qtbase Status: MERGED +2 0
          581397,8 CMake: Read UpstreamPURL from attribution files when generating SBOMs dev qt/qtbase Status: MERGED +2 0
          581607,7 CMake: Read CPEs from attribution files when generating SBOMs dev qt/qtbase Status: MERGED +2 0
          583605,2 CMake: Expose the short git hash during SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          583606,2 CMake: Propagate SBOM options to auto-created attribution targets 6.8 qt/qtbase Status: MERGED +2 0
          583607,2 CMake: Detect 3rd party header modules during SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          583608,2 CMake: Rework SBOM PURL handling to handle multiple values 6.8 qt/qtbase Status: MERGED +2 0
          583609,2 CMake: Read UpstreamPURL from attribution files when generating SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          583610,2 CMake: Read CPEs from attribution files when generating SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          583708,4 Use SPDX license identifiers tqtc/lts-6.5 qt/tqtc-qmlcompilerplus Status: MERGED +2 +1
          583859,3 CMake: Don't use root attribution file for system libraries dev qt/qtbase Status: MERGED +2 0
          583890,2 CMake: Don't forward FRIENDLY_PACKAGE_NAME to sub-attribution targets dev qt/qtbase Status: MERGED +2 0
          583994,2 CMake: Don't use root attribution file for system libraries 6.8 qt/qtbase Status: MERGED +2 0
          583995,2 CMake: Don't forward FRIENDLY_PACKAGE_NAME to sub-attribution targets 6.8 qt/qtbase Status: MERGED +2 0
          584937,2 CMake: Fix incorrectly computed ffmpeg attribution file path dev qt/qtmultimedia Status: MERGED +2 0
          585002,2 CMake: Fix incorrectly computed ffmpeg attribution file path 6.8 qt/qtmultimedia Status: MERGED +2 0
          585028,6 CMake: Handle multi-value PURLs and CPEs in attribution files dev qt/qtbase Status: MERGED +2 0
          585341,3 CMake: Generate SBOM for more platforms tagged with Packaging dev qt/qt5 Status: MERGED +2 0
          585458,7 qtattributionsscanner: Add support for CPE and PURL fields dev qt/qttools Status: MERGED +2 0
          585519,4 CMake: Generate SBOM for more platforms tagged with Packaging 6.8 qt/qt5 Status: MERGED +2 0
          586159,6 qtattributionsscanner: Fix error message formatting for invalid values dev qt/qttools Status: MERGED +2 0
          586283,3 coin: Enable git cloning dev qt/qtwebengine Status: MERGED +2 0
          586664,2 qtattributionsscanner: Add support for CPE and PURL fields 6.8 qt/qttools Status: MERGED +2 0
          586665,2 qtattributionsscanner: Fix error message formatting for invalid values 6.8 qt/qttools Status: MERGED +2 0
          586762,2 qtattributionsscanner: Add support for CPE and PURL fields 6.7 qt/qttools Status: MERGED +2 0
          586763,2 qtattributionsscanner: Fix error message formatting for invalid values 6.7 qt/qttools Status: MERGED +2 0
          586824,2 qtattributionsscanner: Add support for CPE and PURL fields tqtc/lts-6.5 qt/tqtc-qttools Status: MERGED +2 0
          586825,2 qtattributionsscanner: Fix error message formatting for invalid values tqtc/lts-6.5 qt/tqtc-qttools Status: MERGED +2 0
          587133,2 CMake: Add a function to detect qt 3rd party entity types for SBOM dev qt/qtbase Status: MERGED +2 0
          587134,2 CMake: Add the Qt-specific CPE to 3rd party entity types in SBOM dev qt/qtbase Status: MERGED +2 0
          587147,2 CMake: Handle multi-value PURLs and CPEs in attribution files 6.8 qt/qtbase Status: MERGED +2 0
          588096,2 CMake: Add a function to detect qt 3rd party entity types for SBOM 6.8 qt/qtbase Status: MERGED +2 0
          588097,2 CMake: Add the Qt-specific CPE to 3rd party entity types in SBOM 6.8 qt/qtbase Status: MERGED +2 0
          589094,3 CMake: Update default copyright for Qt SBOM packages dev qt/qtbase Status: MERGED +2 0
          590642,2 CMake: Update default copyright for Qt SBOM packages 6.8 qt/qtbase Status: MERGED +2 0
          595284,3 WIP: coin: Try to use Python 3.10+ on Windows for reuse tool dev qt/qtbase Status: ABANDONED -2 -1
          595288,6 coin: Move cross-compilation build directories outside of sources dev qt/qtbase Status: MERGED +2 0
          596167,5 coin: Explicitly specify Python 3.10 for SBOM processing on Windows dev qt/qt5 Status: MERGED +2 0
          596171,5 coin: Explicitly specify SBOM_PYTHON_APPS_PATH for all platforms dev qt/qt5 Status: MERGED +2 0
          596183,5 CMake: Remove double addition of LicenseRef-ICC-License to the SBOM dev qt/qtbase Status: MERGED +2 -1
          596405,2 coin: Move cross-compilation build directories outside of sources 6.8 qt/qtbase Status: MERGED +2 0
          597465,13 CMake: Change SBOM generation to be enabled by default (mostly) dev qt/qtbase Status: MERGED +2 0
          597474,2 CMake: Add configure-time dependency on project attribution files dev qt/qtbase Status: MERGED +2 0
          597594,2 CMake: Add configure-time dependency on project attribution files 6.8 qt/qtbase Status: MERGED +2 0
          597859,7 CMake: Rework SBOM python dependency lookup and handling dev qt/qtbase Status: MERGED +2 0
          597915,5 CMake: Split SBOM verification and NTIA compliance into separate ops dev qt/qtbase Status: MERGED +2 0
          598149,2 CMake: Check for target existence before recording system lib spdx id dev qt/qtbase Status: MERGED +2 0
          598156,5 coin: Remove unused QT_INTERNAL_NO_SBOM_FIND_PYTHON_FRAMEWORK var dev qt/qtbase Status: MERGED +2 0
          598170,5 CMake: Allow adding content to the SBOM repo project comment dev qt/qtbase Status: MERGED +2 0
          598171,6 CMake: When available add the repo configure line to the SBOM dev qt/qtbase Status: MERGED +2 +1
          598185,2 CMake: Fix DESTDIR handling in SBOM checksum verification dev qt/qtbase Status: MERGED +2 0
          598186,3 coin: Always pass the SBOM python interpreter to configure dev qt/qtbase Status: MERGED +2 0
          598509,2 CMake: Check for target existence before recording system lib spdx id 6.8 qt/qtbase Status: MERGED +2 0
          598512,2 CMake: Fix DESTDIR handling in SBOM checksum verification 6.8 qt/qtbase Status: MERGED +2 0
          598513,2 CMake: Rework SBOM python dependency lookup and handling 6.8 qt/qtbase Status: MERGED +2 0
          598514,2 CMake: Split SBOM verification and NTIA compliance into separate ops 6.8 qt/qtbase Status: MERGED +2 0
          598515,2 CMake: Change SBOM generation to be enabled by default (mostly) 6.8 qt/qtbase Status: MERGED +2 0
          598516,2 coin: Remove unused QT_INTERNAL_NO_SBOM_FIND_PYTHON_FRAMEWORK var 6.8 qt/qtbase Status: MERGED +2 0
          598517,2 coin: Always pass the SBOM python interpreter to configure 6.8 qt/qtbase Status: MERGED +2 0
          598518,2 CMake: Allow adding content to the SBOM repo project comment 6.8 qt/qtbase Status: MERGED +2 0
          598519,2 CMake: When available add the repo configure line to the SBOM 6.8 qt/qtbase Status: MERGED +2 0
          599885,4 CMake: Improve handling of file paths embedded into SBOM dev qt/qtbase Status: MERGED +2 0
          599886,3 CMake: Remove the CMAKE_CXX_COMPILER path from the SBOM dev qt/qtbase Status: MERGED +2 +1
          599999,3 coin: Explicitly specify Python 3.10 for SBOM processing on Windows 6.8 qt/qt5 Status: MERGED +2 0
          600000,3 coin: Explicitly specify SBOM_PYTHON_APPS_PATH for all platforms 6.8 qt/qt5 Status: MERGED +2 0
          600293,4 coin: Enable git cloning dev qt/qttools Status: MERGED +2 -1
          600316,2 coin: Enable git cloning 6.8 qt/qttools Status: MERGED +2 0
          600323,2 CMake: Improve handling of file paths embedded into SBOM 6.8 qt/qtbase Status: MERGED +2 0
          600325,2 CMake: Remove the CMAKE_CXX_COMPILER path from the SBOM 6.8 qt/qtbase Status: MERGED +2 0
          600857,3 coin: Enable git cloning dev qt/qtquick3d Status: MERGED +2 0
          600909,2 coin: Enable git cloning 6.8 qt/qtquick3d Status: MERGED +2 0
          601374,2 coin: Enable git cloning 6.8 qt/qtwebengine Status: MERGED +2 0
          604300,2 CMake: Remove double addition of LicenseRef-ICC-License to the SBOM 6.8 qt/qtbase Status: MERGED +2 0
          604363,15 CMake: Support manual multiple projects within-a-repo SBOM generation dev qt/qtbase Status: MERGED +2 0
          604618,3 CMake: Add PURL and CPE info to 3rd party attribution files 6.8 qt/qtbase Status: MERGED +2 0
          604960,5 CMake: Modernize the CMake code 6.8 qt/qttranslations Status: MERGED +2 +1
          608611,2 CMake: Add imgui attribution to SBOM 6.8 qt/qt3d Status: MERGED +2 0
          608623,5 CMake: Add missing SBOM attribution entries dev qt/qtbase Status: MERGED +2 0
          608631,2 CMake: Add imgui attribution to SBOM dev qt/qt3d Status: MERGED +2 0
          608694,2 CMake: Fix unescaped path MATCH condition in QtPublicSbomHelpers dev qt/qtbase Status: MERGED +2 0
          608722,2 CMake: Add missing SBOM attribution entries 6.8 qt/qtbase Status: MERGED +2 0
          608806,2 CMake: Fix unescaped path MATCH condition in QtPublicSbomHelpers 6.8 qt/qtbase Status: MERGED +2 0
          609602,2 CMake: Support manual multiple projects within-a-repo SBOM generation 6.8 qt/qtbase Status: MERGED +2 0

          Activity

            People

              alexandru.croitor Alexandru Croitor
              kkohne Kai Köhne
              Votes:
              2 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:

                Gerrit Reviews

                  There are 15 open Gerrit changes