Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122899

Generate SBOM from Qt build system

    XMLWordPrintable

Details

    • All
    • fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8), 3db537ee8 (dev), c7c98574d (6.9), 1a917237f (tqtc/lts-6.8)

    Description

      Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

      Related work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          relates to

          Task - A task that needs to be done. QTBUG-133796 Use correct info for Creator Organization in REUSE-generated source SBOMs

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          resulted in

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-127335 Check that sbom spdx files are included in release packages

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; Flaky tests; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Open
          split to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          Task - A task that needs to be done. QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-134894 Various improvements for SBOM generation

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          Task - A task that needs to be done. QTBUG-128320 Generate an SBOM for qttranslations

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129601 Provide custom SBOM's in deployment tooling

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-131281 Provide SBOM information for tools used during Qt build

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          For Gerrit Dashboard: QTBUG-122899
          # Subject Branch Project Status CR V
          564092,5 coin: Enable git cloning dev qt/qtbase Status: MERGED +2 -1
          565524,7 WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries dev qt/qtwebengine Status: DEFERRED -2 0
          586284,3 coin: Enable git cloning dev qt/qtdeclarative Status: MERGED +2 +1
          586287,3 coin: Enable git cloning dev qt/qtsvg Status: MERGED +2 0
          608786,14 WIP: CMake: Experiments with SBOM API for webengine dev qt/qtsvg Status: ABANDONED -2 0
          616350,12 CMake: Simplify and fix target dependency handling in SBOMs dev qt/qtbase Status: MERGED +2 0
          616661,17 CMake: Decouple Qt specific handling from SBOM implementation dev qt/qtbase Status: MERGED +2 0
          619984,15 CMake: Rework SBOM PURL handling dev qt/qtbase Status: MERGED +2 +1
          620266,2 CMake: Prepend underscore to qt_internal_sbom_set_default_option_value 6.8 qt/qtbase Status: MERGED +2 0
          620270,2 CMake: Allow skipping some parts of SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          620271,2 CMake: Add a fake deterministic SBOM generation option 6.8 qt/qtbase Status: MERGED +2 0
          620272,2 CMake: Add qt exported target name and package name into SBOM 6.8 qt/qtbase Status: MERGED +2 0
          620273,2 CMake: Fix SBOM inline comment 6.8 qt/qtbase Status: MERGED +2 0
          620274,2 CMake: Remove qt executable SBOM generation stale code 6.8 qt/qtbase Status: MERGED +2 0
          620275,2 CMake: Add a few more internal sbom helper functions 6.8 qt/qtbase Status: MERGED +2 0
          621575,2 coin: Enable git cloning 6.9 qt/qtsvg Status: MERGED +2 0
          621633,2 coin: Enable git cloning 6.9 qt/qtbase Status: MERGED +2 0
          621657,2 coin: Enable git cloning 6.8 qt/qtsvg Status: MERGED +2 0
          621677,2 coin: Enable git cloning 6.8 qt/qtbase Status: MERGED +2 0
          621834,2 coin: Enable git cloning 6.9 qt/qtdeclarative Status: MERGED +2 0
          621858,3 CMake: Fix location of build time sboms in no-prefix builds dev qt/qtbase Status: MERGED +2 0
          621907,2 coin: Enable git cloning 6.8 qt/qtdeclarative Status: MERGED +2 0
          623731,2 CMake: Fix location of build time sboms in no-prefix builds 6.9 qt/qtbase Status: MERGED +2 0
          623734,2 CMake: Decouple Qt specific handling from SBOM implementation 6.9 qt/qtbase Status: MERGED +2 0
          623776,2 CMake: Simplify and fix target dependency handling in SBOMs 6.9 qt/qtbase Status: MERGED +2 0
          623805,2 CMake: Fix broken qt_attribution.json files after cherry-pick tqtc/lts-6.5 qt/tqtc-qtbase Status: MERGED +2 0
          623847,2 CMake: Fix location of build time sboms in no-prefix builds 6.8 qt/qtbase Status: MERGED +2 0
          623851,2 CMake: Decouple Qt specific handling from SBOM implementation 6.8 qt/qtbase Status: MERGED +2 0
          623852,2 CMake: Simplify and fix target dependency handling in SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          624288,2 CMake: Always save SBOM python interpreter path dev qt/qtbase Status: MERGED +2 0
          624289,2 CMake: Improve error reporting about missing SBOM dependencies dev qt/qtbase Status: MERGED +2 0
          624290,5 CMake: Make sure to look up deps when converting json to tag SPDX doc dev qt/qtbase Status: MERGED +2 0
          624503,3 CMake: Add internal API to check if json SBOM generation deps are met dev qt/qtbase Status: MERGED +2 0
          624633,2 CMake: Always save SBOM python interpreter path 6.9 qt/qtbase Status: MERGED +2 0
          624795,2 CMake: Improve error reporting about missing SBOM dependencies 6.9 qt/qtbase Status: MERGED +2 0
          624796,2 CMake: Make sure to look up deps when converting json to tag SPDX doc 6.9 qt/qtbase Status: MERGED +2 0
          624797,2 CMake: Add internal API to check if json SBOM generation deps are met 6.9 qt/qtbase Status: MERGED +2 0
          624822,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders dev qt/qtbase Status: MERGED +2 0
          624884,2 CMake: Always save SBOM python interpreter path 6.8 qt/qtbase Status: MERGED +2 0
          624887,2 CMake: Improve error reporting about missing SBOM dependencies 6.8 qt/qtbase Status: MERGED +2 0
          624888,2 CMake: Make sure to look up deps when converting json to tag SPDX doc 6.8 qt/qtbase Status: MERGED +2 0
          624889,2 CMake: Add internal API to check if json SBOM generation deps are met 6.8 qt/qtbase Status: MERGED +2 0
          625801,3 CMake: Move more Qt-specific SBOM PURL functions to the right file dev qt/qtbase Status: MERGED +2 0
          625802,3 CMake: Move generic PURL function from qt-specific file to main one dev qt/qtbase Status: MERGED +2 0
          626229,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders 6.9 qt/qtbase Status: MERGED +2 0
          626298,2 CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders 6.8 qt/qtbase Status: MERGED +2 0
          626511,2 CMake: Move more Qt-specific SBOM PURL functions to the right file 6.9 qt/qtbase Status: MERGED +2 0
          626512,2 CMake: Move generic PURL function from qt-specific file to main one 6.9 qt/qtbase Status: MERGED +2 0
          626513,2 CMake: Rework SBOM PURL handling 6.9 qt/qtbase Status: MERGED +2 0
          626564,2 CMake: Move more Qt-specific SBOM PURL functions to the right file 6.8 qt/qtbase Status: MERGED +2 0
          626565,2 CMake: Move generic PURL function from qt-specific file to main one 6.8 qt/qtbase Status: MERGED +2 0
          626566,2 CMake: Rework SBOM PURL handling 6.8 qt/qtbase Status: MERGED +2 0
          626921,3 CMake: Remove type restriction on attribution download location dev qt/qtbase Status: MERGED +2 0
          626922,3 CMake: Remove type restriction on attribution file extra SBOM info dev qt/qtbase Status: MERGED +2 0
          626923,5 CMake: Allow including specific attribution ids in SBOMs dev qt/qtbase Status: MERGED +2 0
          626924,5 CMake: Allow creating nested SBOM attribution targets for all entities dev qt/qtbase Status: MERGED +2 0
          626939,4 CMake: Re-order SBOM embedded qt_attribution.json fields dev qt/qtbase Status: MERGED +2 0
          626940,4 CMake: Remove leftover code after refactoring dev qt/qtbase Status: MERGED +2 0
          626941,4 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES dev qt/qtbase Status: MERGED +2 0
          626942,4 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions dev qt/qtbase Status: MERGED +2 0
          626943,4 CMake: Extract Qt-specific license concluded handling dev qt/qtbase Status: MERGED +2 0
          626944,3 CMake: Sanitize nested SBOM attribution target names dev qt/qtbase Status: MERGED +2 0
          627240,4 CMake: Handle installing files with same name during SBOM generation dev qt/qtbase Status: MERGED +2 0
          627533,2 CMake: Handle DIRECTORIES in SBOM custom file sets dev qt/qtbase Status: MERGED +2 0
          627774,2 CMake: Remove type restriction on attribution download location 6.9 qt/qtbase Status: MERGED +2 0
          627775,2 CMake: Remove type restriction on attribution file extra SBOM info 6.9 qt/qtbase Status: MERGED +2 0
          627776,2 CMake: Sanitize nested SBOM attribution target names 6.9 qt/qtbase Status: MERGED +2 0
          627777,2 CMake: Allow including specific attribution ids in SBOMs 6.9 qt/qtbase Status: MERGED +2 0
          627778,2 CMake: Allow creating nested SBOM attribution targets for all entities 6.9 qt/qtbase Status: MERGED +2 0
          627779,2 CMake: Re-order SBOM embedded qt_attribution.json fields 6.9 qt/qtbase Status: MERGED +2 0
          627780,2 CMake: Remove leftover code after refactoring 6.9 qt/qtbase Status: MERGED +2 0
          627781,2 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES 6.9 qt/qtbase Status: MERGED +2 0
          627782,2 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions 6.9 qt/qtbase Status: MERGED +2 0
          627783,2 CMake: Extract Qt-specific license concluded handling 6.9 qt/qtbase Status: MERGED +2 0
          627784,2 CMake: Handle DIRECTORIES in SBOM custom file sets 6.9 qt/qtbase Status: MERGED +2 0
          627865,2 CMake: Include license and license file attribution in SBOM comment dev qt/qtbase Status: MERGED +2 0
          627877,3 CMake: Add function to set up SBOM generation defaults dev qt/qtbase Status: MERGED +2 0
          627896,2 CMake: Handle installing files with same name during SBOM generation 6.9 qt/qtbase Status: MERGED +2 0
          627899,2 CMake: Remove type restriction on attribution download location 6.8 qt/qtbase Status: MERGED +2 0
          627900,2 CMake: Remove type restriction on attribution file extra SBOM info 6.8 qt/qtbase Status: MERGED +2 0
          627901,2 CMake: Sanitize nested SBOM attribution target names 6.8 qt/qtbase Status: MERGED +2 0
          627902,2 CMake: Allow including specific attribution ids in SBOMs 6.8 qt/qtbase Status: MERGED +2 0
          627903,2 CMake: Allow creating nested SBOM attribution targets for all entities 6.8 qt/qtbase Status: MERGED +2 0
          627904,2 CMake: Re-order SBOM embedded qt_attribution.json fields 6.8 qt/qtbase Status: MERGED +2 0
          627905,2 CMake: Remove leftover code after refactoring 6.8 qt/qtbase Status: MERGED +2 0
          627906,2 CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES 6.8 qt/qtbase Status: MERGED +2 0
          627907,2 CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions 6.8 qt/qtbase Status: MERGED +2 0
          627908,2 CMake: Extract Qt-specific license concluded handling 6.8 qt/qtbase Status: MERGED +2 0
          627929,2 CMake: Handle DIRECTORIES in SBOM custom file sets 6.8 qt/qtbase Status: MERGED +2 0
          627942,2 CMake: Handle installing files with same name during SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          628177,2 CMake: Include license and license file attribution in SBOM comment 6.9 qt/qtbase Status: MERGED +2 0
          628178,2 CMake: Add function to set up SBOM generation defaults 6.9 qt/qtbase Status: MERGED +2 0
          628376,2 CMake: Include license and license file attribution in SBOM comment 6.8 qt/qtbase Status: MERGED +2 0
          628378,2 CMake: Add function to set up SBOM generation defaults 6.8 qt/qtbase Status: MERGED +2 0
          628509,2 CMake: Remove semicolon from SBOM external document references dev qt/qtbase Status: MERGED +2 0
          628614,2 CMake: Remove semicolon from SBOM external document references 6.9 qt/qtbase Status: MERGED +2 0
          628717,2 CMake: Remove semicolon from SBOM external document references 6.8 qt/qtbase Status: MERGED +2 0
          644881,2 CMake: Fix showing exit code when SBOM NTIA verification fails dev qt/qtbase Status: MERGED +2 0
          645450,2 CMake: Fix showing exit code when SBOM NTIA verification fails 6.9 qt/qtbase Status: MERGED +2 0
          645845,2 CMake: Fix showing exit code when SBOM NTIA verification fails tqtc/lts-6.8 qt/tqtc-qtbase Status: MERGED +2 0

          Activity

            People

              alexandru.croitor Alexandru Croitor
              kkohne Kai Köhne
              Votes:
              2 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes