Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122899

Generate SBOM from Qt build system

    XMLWordPrintable

Details

    • All
    • d940399b3 (dev), 37a5e0012 (dev), 79f9b490e (dev), 65bf57ce7 (6.8), fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8)

    Description

      Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

      Related work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          resulted in

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-127335 Check that sbom spdx files are included in release packages

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Open
          split to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          Task - A task that needs to be done. QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-128320 Generate an SBOM for qttranslations

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129601 Provide custom SBOM's in deployment tooling

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-131281 Provide SBOM information for tools used during Qt build

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open
          For Gerrit Dashboard: QTBUG-122899
          # Subject Branch Project Status CR V
          616350,11 CMake: Simplify and fix target dependency handling in SBOMs dev qt/qtbase Status: NEW +2 0
          616661,16 CMake: Decouple Qt specific handling from SBOM implementation dev qt/qtbase Status: NEW 0 0
          621858,2 CMake: Fix location of build time sboms in no-prefix builds dev qt/qtbase Status: NEW +2 0
          564092,5 coin: Enable git cloning dev qt/qtbase Status: MERGED +2 -1
          565524,7 WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries dev qt/qtwebengine Status: DEFERRED -2 0
          578553,44 CMake: Add PURL and CPE info to 3rd party attribution files dev qt/qtbase Status: MERGED +2 0
          586284,3 coin: Enable git cloning dev qt/qtdeclarative Status: MERGED +2 +1
          586287,3 coin: Enable git cloning dev qt/qtsvg Status: MERGED +2 0
          604300,2 CMake: Remove double addition of LicenseRef-ICC-License to the SBOM 6.8 qt/qtbase Status: MERGED +2 0
          604363,15 CMake: Support manual multiple projects within-a-repo SBOM generation dev qt/qtbase Status: MERGED +2 0
          604364,8 CMake: Create separate SBOM documents for QtWebEngine and QtPdf dev qt/qtwebengine Status: MERGED +2 0
          604618,3 CMake: Add PURL and CPE info to 3rd party attribution files 6.8 qt/qtbase Status: MERGED +2 0
          604960,5 CMake: Modernize the CMake code 6.8 qt/qttranslations Status: MERGED +2 +1
          604971,32 CMake: Add SBOM support for translations, custom files and friends dev qt/qtbase Status: MERGED +2 0
          604973,12 CMake: Add translation files to SBOM 6.8 qt/qttranslations Status: MERGED +2 +1
          608611,2 CMake: Add imgui attribution to SBOM 6.8 qt/qt3d Status: MERGED +2 0
          608623,5 CMake: Add missing SBOM attribution entries dev qt/qtbase Status: MERGED +2 0
          608631,2 CMake: Add imgui attribution to SBOM dev qt/qt3d Status: MERGED +2 0
          608694,2 CMake: Fix unescaped path MATCH condition in QtPublicSbomHelpers dev qt/qtbase Status: MERGED +2 0
          608722,2 CMake: Add missing SBOM attribution entries 6.8 qt/qtbase Status: MERGED +2 0
          608770,24 CMake: Add API to include custom cmake files during SBOM generation dev qt/qtbase Status: MERGED +2 0
          608773,26 CMake: Add API to allow referencing external packages in the SPDX SBOM dev qt/qtbase Status: MERGED +2 0
          608782,26 CMake: Allow adding custom SBOM relationships to targets and projects dev qt/qtbase Status: MERGED +2 0
          608784,31 CMake: Add way to convert JSON SPDX to tag/value SPDX document dev qt/qtbase Status: MERGED +2 0
          608786,13 WIP: CMake: Experiments with SBOM API for webengine dev qt/qtsvg Status: ABANDONED -2 0
          608806,2 CMake: Fix unescaped path MATCH condition in QtPublicSbomHelpers 6.8 qt/qtbase Status: MERGED +2 0
          609602,2 CMake: Support manual multiple projects within-a-repo SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          609644,7 CMake: Remove SBOM multi-config dead code dev qt/qtbase Status: MERGED +2 0
          610136,6 CMake: Move SBOM project ops setup to run at project begin time dev qt/qtbase Status: MERGED +2 0
          610148,18 CMake: Add internal functions to get various kinds of spdx ids dev qt/qtbase Status: MERGED +2 0
          615633,7 CMake: Fix project spdx id used in implicit relationships dev qt/qtbase Status: MERGED +2 0
          616081,5 CMake: Fix file path in checksum computation to allow spaces dev qt/qtbase Status: MERGED +2 0
          616104,3 CMake: Fix LINK_LIBRARIES not being properly processed for SBOM dev qt/qtbase Status: MERGED +2 +1
          616124,2 CMake: Move SBOM project ops setup to run at project begin time 6.9 qt/qtbase Status: MERGED +2 0
          616125,2 CMake: Remove SBOM multi-config dead code 6.9 qt/qtbase Status: MERGED +2 0
          616126,2 CMake: Add SBOM support for translations, custom files and friends 6.9 qt/qtbase Status: MERGED +2 0
          616127,2 CMake: Add API to include custom cmake files during SBOM generation 6.9 qt/qtbase Status: MERGED +2 0
          616128,2 CMake: Add API to allow referencing external packages in the SPDX SBOM 6.9 qt/qtbase Status: MERGED +2 0
          616129,2 CMake: Fix project spdx id used in implicit relationships 6.9 qt/qtbase Status: MERGED +2 0
          616130,2 CMake: Allow adding custom SBOM relationships to targets and projects 6.9 qt/qtbase Status: MERGED +2 0
          616131,2 CMake: Add way to convert JSON SPDX to tag/value SPDX document 6.9 qt/qtbase Status: MERGED +2 0
          616132,2 CMake: Add internal functions to get various kinds of spdx ids 6.9 qt/qtbase Status: MERGED +2 0
          616138,2 CMake: Fix purl variant list iteration dev qt/qtbase Status: MERGED +2 0
          616155,2 CMake: Fix file path in checksum computation to allow spaces 6.9 qt/qtbase Status: MERGED +2 0
          616165,2 CMake: Move SBOM project ops setup to run at project begin time 6.8 qt/qtbase Status: MERGED +2 0
          616166,2 CMake: Remove SBOM multi-config dead code 6.8 qt/qtbase Status: MERGED +2 0
          616167,2 CMake: Add SBOM support for translations, custom files and friends 6.8 qt/qtbase Status: MERGED +2 0
          616168,2 CMake: Add API to include custom cmake files during SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          616169,2 CMake: Add API to allow referencing external packages in the SPDX SBOM 6.8 qt/qtbase Status: MERGED +2 0
          616170,2 CMake: Fix project spdx id used in implicit relationships 6.8 qt/qtbase Status: MERGED +2 0
          616171,2 CMake: Allow adding custom SBOM relationships to targets and projects 6.8 qt/qtbase Status: MERGED +2 0
          616172,2 CMake: Add way to convert JSON SPDX to tag/value SPDX document 6.8 qt/qtbase Status: MERGED +2 0
          616173,2 CMake: Add internal functions to get various kinds of spdx ids 6.8 qt/qtbase Status: MERGED +2 0
          616196,3 CMake: Fix file path in checksum computation to allow spaces 6.8 qt/qtbase Status: MERGED +2 0
          616264,6 CMake: Fix sbom git vars not being available in various scopes dev qt/qtbase Status: MERGED +2 0
          616281,3 CMake: Split SBOM implementation into separate files dev qt/qtbase Status: MERGED +2 +1
          616294,2 CMake: Fix LINK_LIBRARIES not being properly processed for SBOM 6.9 qt/qtbase Status: MERGED +2 0
          616295,2 CMake: Fix purl variant list iteration 6.9 qt/qtbase Status: MERGED +2 0
          616306,2 CMake: Create separate SBOM documents for QtWebEngine and QtPdf 6.9 qt/qtwebengine Status: MERGED +2 0
          616346,3 CMake: Prepend underscore to qt_internal_sbom_set_default_option_value dev qt/qtbase Status: MERGED +2 0
          616347,3 CMake: Add SUPPLIER as an option to SBOM packages dev qt/qtbase Status: MERGED +2 0
          616348,3 CMake: Allow skipping some parts of SBOM generation dev qt/qtbase Status: MERGED +2 0
          616349,5 CMake: Add qt exported target name and package name into SBOM dev qt/qtbase Status: MERGED +2 0
          616366,2 CMake: Split SBOM implementation into separate files 6.9 qt/qtbase Status: MERGED +2 0
          616367,2 CMake: Fix sbom git vars not being available in various scopes 6.9 qt/qtbase Status: MERGED +2 0
          616371,3 CMake: Fix LINK_LIBRARIES not being properly processed for SBOM 6.8 qt/qtbase Status: MERGED +2 0
          616372,3 CMake: Fix purl variant list iteration 6.8 qt/qtbase Status: MERGED +2 0
          616410,3 CMake: Split SBOM implementation into separate files 6.8 qt/qtbase Status: MERGED +2 0
          616412,3 CMake: Fix sbom git vars not being available in various scopes 6.8 qt/qtbase Status: MERGED +2 +1
          616422,2 CMake: Create separate SBOM documents for QtWebEngine and QtPdf 6.8 qt/qtwebengine Status: MERGED +2 0
          616534,3 CMake: Add a fake deterministic SBOM generation option dev qt/qtbase Status: MERGED +2 0
          616535,4 CMake: Fix SBOM inline comment dev qt/qtbase Status: MERGED +2 0
          616660,3 CMake: Remove qt executable SBOM generation stale code dev qt/qtbase Status: MERGED +2 0
          618356,4 CMake: Only create sbom documents when the respective feature is on dev qt/qtwebengine Status: MERGED +2 0
          618799,4 CMake: Add a few more internal sbom helper functions dev qt/qtbase Status: MERGED +2 0
          618979,2 CMake: Only create sbom documents when the respective feature is on 6.9 qt/qtwebengine Status: MERGED +2 0
          619453,4 CMake: Only create sbom documents when the respective feature is on 6.8 qt/qtwebengine Status: MERGED +2 0
          619761,2 CMake: Add PURL and CPE info to 3rd party attribution files tqtc/lts-6.5 qt/tqtc-qtbase Status: MERGED +2 0
          620010,2 CMake: Prepend underscore to qt_internal_sbom_set_default_option_value 6.9 qt/qtbase Status: MERGED +2 0
          620012,2 CMake: Add SUPPLIER as an option to SBOM packages 6.9 qt/qtbase Status: MERGED +2 0
          620013,2 CMake: Allow skipping some parts of SBOM generation 6.9 qt/qtbase Status: MERGED +2 0
          620014,2 CMake: Add a fake deterministic SBOM generation option 6.9 qt/qtbase Status: MERGED +2 0
          620015,2 CMake: Add qt exported target name and package name into SBOM 6.9 qt/qtbase Status: MERGED +2 0
          620016,2 CMake: Fix SBOM inline comment 6.9 qt/qtbase Status: MERGED +2 0
          620017,2 CMake: Remove qt executable SBOM generation stale code 6.9 qt/qtbase Status: MERGED +2 0
          620018,2 CMake: Add a few more internal sbom helper functions 6.9 qt/qtbase Status: MERGED +2 0
          620266,2 CMake: Prepend underscore to qt_internal_sbom_set_default_option_value 6.8 qt/qtbase Status: MERGED +2 0
          620269,2 CMake: Add SUPPLIER as an option to SBOM packages 6.8 qt/qtbase Status: MERGED +2 0
          620270,2 CMake: Allow skipping some parts of SBOM generation 6.8 qt/qtbase Status: MERGED +2 0
          620271,2 CMake: Add a fake deterministic SBOM generation option 6.8 qt/qtbase Status: MERGED +2 0
          620272,2 CMake: Add qt exported target name and package name into SBOM 6.8 qt/qtbase Status: MERGED +2 0
          620273,2 CMake: Fix SBOM inline comment 6.8 qt/qtbase Status: MERGED +2 0
          620274,2 CMake: Remove qt executable SBOM generation stale code 6.8 qt/qtbase Status: MERGED +2 0
          620275,2 CMake: Add a few more internal sbom helper functions 6.8 qt/qtbase Status: MERGED +2 0
          621575,2 coin: Enable git cloning 6.9 qt/qtsvg Status: MERGED +2 0
          621633,2 coin: Enable git cloning 6.9 qt/qtbase Status: MERGED +2 0
          621657,2 coin: Enable git cloning 6.8 qt/qtsvg Status: MERGED +2 0
          621677,2 coin: Enable git cloning 6.8 qt/qtbase Status: MERGED +2 0
          621834,2 coin: Enable git cloning 6.9 qt/qtdeclarative Status: MERGED +2 0
          621907,2 coin: Enable git cloning 6.8 qt/qtdeclarative Status: MERGED +2 0

          Activity

            People

              alexandru.croitor Alexandru Croitor
              kkohne Kai Köhne
              Votes:
              2 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:

                Gerrit Reviews

                  There are 3 open Gerrit changes