Loading...

XML

Word

Printable

Type: User Story
Resolution: Fixed
Priority: P2: Important
Fix Version/s: None
Affects Version/s: None
Component/s: Build System: CMake
Labels:
- EUCRA
- Reported_by_support_standard

Platform/s:

All
Epic Link:
SBOM for Qt
Commits:
fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8), 3db537ee8 (dev), c7c98574d (6.9), 1a917237f (tqtc/lts-6.8)

Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

Related work

depends on

QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

Closed

relates to

QTBUG-133796 Use correct info for Creator Organization in REUSE-generated source SBOMs

Closed

resulted in

QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

Open

QTBUG-127335 Check that sbom spdx files are included in release packages

Closed

QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

Open

split to

QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

Closed

QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

Reported

QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

Reported

QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

Reported

QTBUG-134894 Various improvements for SBOM generation

Reported

QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

In Progress

QTBUG-128320 Generate an SBOM for qttranslations

Closed

QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

Closed

QTBUG-129601 Provide custom SBOM's in deployment tooling

Open

QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

Open

QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

Open

QTBUG-131281 Provide SBOM information for tools used during Qt build

Open

QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

Closed

(13 split to)

- Issue Only
- Show All Reviews
- Show Open Reviews
- Show All Issues
- Show Open Issues

No reviews matched the request. Check your Options in the drop-down menu of this sections header.

Assignee:: Alexandru Croitor

Reporter:: Kai Köhne

Votes:: 2 Vote for this issue

Watchers:: 8 Start watching this issue

Created:: 29 Feb '24 18:59

Updated:: 19 May '25 11:28

Resolved:: 17 Feb '25 15:31

There are no open Gerrit changes

Show There are 100 closed Gerrit changes

Hide There are 100 closed Gerrit changes

coin: Enable git cloning: Gerrit Review:

WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries: Gerrit Review:

CMake: Add PURL and CPE info to 3rd party attribution files: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

CMake: Add PURL and CPE info to 3rd party attribution files: Gerrit Review:

WIP: CMake: Experiments with SBOM API for webengine: Gerrit Review:

CMake: Simplify and fix target dependency handling in SBOMs: Gerrit Review:

CMake: Decouple Qt specific handling from SBOM implementation: Gerrit Review:

CMake: Add PURL and CPE info to 3rd party attribution files: Gerrit Review:

CMake: Rework SBOM PURL handling: Gerrit Review:

CMake: Add qt exported target name and package name into SBOM: Gerrit Review:

CMake: Fix SBOM inline comment: Gerrit Review:

CMake: Remove qt executable SBOM generation stale code: Gerrit Review:

CMake: Add a few more internal sbom helper functions: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

CMake: Fix location of build time sboms in no-prefix builds: Gerrit Review:

coin: Enable git cloning: Gerrit Review:

CMake: Fix location of build time sboms in no-prefix builds: Gerrit Review:

CMake: Decouple Qt specific handling from SBOM implementation: Gerrit Review:

CMake: Simplify and fix target dependency handling in SBOMs: Gerrit Review:

CMake: Fix broken qt_attribution.json files after cherry-pick: Gerrit Review:

CMake: Fix location of build time sboms in no-prefix builds: Gerrit Review:

CMake: Decouple Qt specific handling from SBOM implementation: Gerrit Review:

CMake: Simplify and fix target dependency handling in SBOMs: Gerrit Review:

CMake: Always save SBOM python interpreter path: Gerrit Review:

CMake: Improve error reporting about missing SBOM dependencies: Gerrit Review:

CMake: Make sure to look up deps when converting json to tag SPDX doc: Gerrit Review:

CMake: Add internal API to check if json SBOM generation deps are met: Gerrit Review:

CMake: Always save SBOM python interpreter path: Gerrit Review:

CMake: Improve error reporting about missing SBOM dependencies: Gerrit Review:

CMake: Make sure to look up deps when converting json to tag SPDX doc: Gerrit Review:

CMake: Add internal API to check if json SBOM generation deps are met: Gerrit Review:

CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders: Gerrit Review:

CMake: Always save SBOM python interpreter path: Gerrit Review:

CMake: Improve error reporting about missing SBOM dependencies: Gerrit Review:

CMake: Make sure to look up deps when converting json to tag SPDX doc: Gerrit Review:

CMake: Add internal API to check if json SBOM generation deps are met: Gerrit Review:

CMake: Move more Qt-specific SBOM PURL functions to the right file: Gerrit Review:

CMake: Move generic PURL function from qt-specific file to main one: Gerrit Review:

CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders: Gerrit Review:

CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders: Gerrit Review:

CMake: Move more Qt-specific SBOM PURL functions to the right file: Gerrit Review:

CMake: Move generic PURL function from qt-specific file to main one: Gerrit Review:

CMake: Rework SBOM PURL handling: Gerrit Review:

CMake: Move more Qt-specific SBOM PURL functions to the right file: Gerrit Review:

CMake: Move generic PURL function from qt-specific file to main one: Gerrit Review:

CMake: Rework SBOM PURL handling: Gerrit Review:

CMake: Remove type restriction on attribution download location: Gerrit Review:

CMake: Remove type restriction on attribution file extra SBOM info: Gerrit Review:

CMake: Allow including specific attribution ids in SBOMs: Gerrit Review:

CMake: Allow creating nested SBOM attribution targets for all entities: Gerrit Review:

CMake: Re-order SBOM embedded qt_attribution.json fields: Gerrit Review:

CMake: Remove leftover code after refactoring: Gerrit Review:

CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES: Gerrit Review:

CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions: Gerrit Review:

CMake: Extract Qt-specific license concluded handling: Gerrit Review:

CMake: Sanitize nested SBOM attribution target names: Gerrit Review:

CMake: Handle installing files with same name during SBOM generation: Gerrit Review:

CMake: Handle DIRECTORIES in SBOM custom file sets: Gerrit Review:

CMake: Remove type restriction on attribution download location: Gerrit Review:

CMake: Remove type restriction on attribution file extra SBOM info: Gerrit Review:

CMake: Sanitize nested SBOM attribution target names: Gerrit Review:

CMake: Allow including specific attribution ids in SBOMs: Gerrit Review:

CMake: Allow creating nested SBOM attribution targets for all entities: Gerrit Review:

CMake: Re-order SBOM embedded qt_attribution.json fields: Gerrit Review:

CMake: Remove leftover code after refactoring: Gerrit Review:

CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES: Gerrit Review:

CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions: Gerrit Review:

CMake: Extract Qt-specific license concluded handling: Gerrit Review:

CMake: Handle DIRECTORIES in SBOM custom file sets: Gerrit Review:

CMake: Include license and license file attribution in SBOM comment: Gerrit Review:

CMake: Add function to set up SBOM generation defaults: Gerrit Review:

CMake: Handle installing files with same name during SBOM generation: Gerrit Review:

CMake: Remove type restriction on attribution download location: Gerrit Review:

CMake: Remove type restriction on attribution file extra SBOM info: Gerrit Review:

CMake: Sanitize nested SBOM attribution target names: Gerrit Review:

CMake: Allow including specific attribution ids in SBOMs: Gerrit Review:

CMake: Allow creating nested SBOM attribution targets for all entities: Gerrit Review:

CMake: Re-order SBOM embedded qt_attribution.json fields: Gerrit Review:

CMake: Remove leftover code after refactoring: Gerrit Review:

CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES: Gerrit Review:

CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions: Gerrit Review:

CMake: Extract Qt-specific license concluded handling: Gerrit Review:

CMake: Handle DIRECTORIES in SBOM custom file sets: Gerrit Review:

CMake: Handle installing files with same name during SBOM generation: Gerrit Review:

CMake: Include license and license file attribution in SBOM comment: Gerrit Review:

CMake: Add function to set up SBOM generation defaults: Gerrit Review:

CMake: Include license and license file attribution in SBOM comment: Gerrit Review:

CMake: Add function to set up SBOM generation defaults: Gerrit Review:

CMake: Remove semicolon from SBOM external document references: Gerrit Review:

CMake: Remove semicolon from SBOM external document references: Gerrit Review:

CMake: Remove semicolon from SBOM external document references: Gerrit Review:

CMake: Fix showing exit code when SBOM NTIA verification fails: Gerrit Review:

CMake: Fix showing exit code when SBOM NTIA verification fails: Gerrit Review:

CMake: Fix showing exit code when SBOM NTIA verification fails: Gerrit Review: