Loading...

XML

Word

Printable

Type: User Story
Resolution: Fixed
Priority: P2: Important
Fix Version/s: None
Affects Version/s: None
Component/s: Build System: CMake
Labels:
- EUCRA
- Reported_by_support_standard

Platform/s:

All
Epic Link:
SBOM for Qt
Commits:
fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8), 3db537ee8 (dev), c7c98574d (6.9), 1a917237f (tqtc/lts-6.8)

Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

Related work

depends on

QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

Closed

relates to

QTBUG-133796 Use correct info for Creator Organization in REUSE-generated source SBOMs

Closed

resulted in

QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

Open

QTBUG-127335 Check that sbom spdx files are included in release packages

Closed

QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

Open

split to

QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

Closed

QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

Reported

QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

Reported

QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

Reported

QTBUG-134894 Various improvements for SBOM generation

Reported

QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

In Progress

QTBUG-128320 Generate an SBOM for qttranslations

Closed

QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

Closed

QTBUG-129601 Provide custom SBOM's in deployment tooling

Open

QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

Open

QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

Open

QTBUG-131281 Provide SBOM information for tools used during Qt build

Open

QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

Closed

(13 split to)

- Issue Only
- Show All Reviews
- Show Open Reviews
- Show All Issues
- Show Open Issues

For Gerrit Dashboard: QTBUG-122899
#	Subject	Branch	Project	Status	CR	V
564092,5	coin: Enable git cloning	dev	qt/qtbase	Status: MERGED	+2	-1
565524,7	WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries	dev	qt/qtwebengine	Status: DEFERRED	-2	0
578553,44	CMake: Add PURL and CPE info to 3rd party attribution files	dev	qt/qtbase	Status: MERGED	+2	0
586284,3	coin: Enable git cloning	dev	qt/qtdeclarative	Status: MERGED	+2	+1
586287,3	coin: Enable git cloning	dev	qt/qtsvg	Status: MERGED	+2	0
604618,3	CMake: Add PURL and CPE info to 3rd party attribution files	6.8	qt/qtbase	Status: MERGED	+2	0
608786,14	WIP: CMake: Experiments with SBOM API for webengine	dev	qt/qtsvg	Status: ABANDONED	-2	0
616350,12	CMake: Simplify and fix target dependency handling in SBOMs	dev	qt/qtbase	Status: MERGED	+2	0
616661,17	CMake: Decouple Qt specific handling from SBOM implementation	dev	qt/qtbase	Status: MERGED	+2	0
619761,2	CMake: Add PURL and CPE info to 3rd party attribution files	tqtc/lts-6.5	qt/tqtc-qtbase	Status: MERGED	+2	0
619984,15	CMake: Rework SBOM PURL handling	dev	qt/qtbase	Status: MERGED	+2	+1
620272,2	CMake: Add qt exported target name and package name into SBOM	6.8	qt/qtbase	Status: MERGED	+2	0
620273,2	CMake: Fix SBOM inline comment	6.8	qt/qtbase	Status: MERGED	+2	0
620274,2	CMake: Remove qt executable SBOM generation stale code	6.8	qt/qtbase	Status: MERGED	+2	0
620275,2	CMake: Add a few more internal sbom helper functions	6.8	qt/qtbase	Status: MERGED	+2	0
621575,2	coin: Enable git cloning	6.9	qt/qtsvg	Status: MERGED	+2	0
621633,2	coin: Enable git cloning	6.9	qt/qtbase	Status: MERGED	+2	0
621657,2	coin: Enable git cloning	6.8	qt/qtsvg	Status: MERGED	+2	0
621677,2	coin: Enable git cloning	6.8	qt/qtbase	Status: MERGED	+2	0
621834,2	coin: Enable git cloning	6.9	qt/qtdeclarative	Status: MERGED	+2	0
621858,3	CMake: Fix location of build time sboms in no-prefix builds	dev	qt/qtbase	Status: MERGED	+2	0
621907,2	coin: Enable git cloning	6.8	qt/qtdeclarative	Status: MERGED	+2	0
623731,2	CMake: Fix location of build time sboms in no-prefix builds	6.9	qt/qtbase	Status: MERGED	+2	0
623734,2	CMake: Decouple Qt specific handling from SBOM implementation	6.9	qt/qtbase	Status: MERGED	+2	0
623776,2	CMake: Simplify and fix target dependency handling in SBOMs	6.9	qt/qtbase	Status: MERGED	+2	0
623805,2	CMake: Fix broken qt_attribution.json files after cherry-pick	tqtc/lts-6.5	qt/tqtc-qtbase	Status: MERGED	+2	0
623847,2	CMake: Fix location of build time sboms in no-prefix builds	6.8	qt/qtbase	Status: MERGED	+2	0
623851,2	CMake: Decouple Qt specific handling from SBOM implementation	6.8	qt/qtbase	Status: MERGED	+2	0
623852,2	CMake: Simplify and fix target dependency handling in SBOMs	6.8	qt/qtbase	Status: MERGED	+2	0
624288,2	CMake: Always save SBOM python interpreter path	dev	qt/qtbase	Status: MERGED	+2	0
624289,2	CMake: Improve error reporting about missing SBOM dependencies	dev	qt/qtbase	Status: MERGED	+2	0
624290,5	CMake: Make sure to look up deps when converting json to tag SPDX doc	dev	qt/qtbase	Status: MERGED	+2	0
624503,3	CMake: Add internal API to check if json SBOM generation deps are met	dev	qt/qtbase	Status: MERGED	+2	0
624633,2	CMake: Always save SBOM python interpreter path	6.9	qt/qtbase	Status: MERGED	+2	0
624795,2	CMake: Improve error reporting about missing SBOM dependencies	6.9	qt/qtbase	Status: MERGED	+2	0
624796,2	CMake: Make sure to look up deps when converting json to tag SPDX doc	6.9	qt/qtbase	Status: MERGED	+2	0
624797,2	CMake: Add internal API to check if json SBOM generation deps are met	6.9	qt/qtbase	Status: MERGED	+2	0
624822,2	CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders	dev	qt/qtbase	Status: MERGED	+2	0
624884,2	CMake: Always save SBOM python interpreter path	6.8	qt/qtbase	Status: MERGED	+2	0
624887,2	CMake: Improve error reporting about missing SBOM dependencies	6.8	qt/qtbase	Status: MERGED	+2	0
624888,2	CMake: Make sure to look up deps when converting json to tag SPDX doc	6.8	qt/qtbase	Status: MERGED	+2	0
624889,2	CMake: Add internal API to check if json SBOM generation deps are met	6.8	qt/qtbase	Status: MERGED	+2	0
625801,3	CMake: Move more Qt-specific SBOM PURL functions to the right file	dev	qt/qtbase	Status: MERGED	+2	0
625802,3	CMake: Move generic PURL function from qt-specific file to main one	dev	qt/qtbase	Status: MERGED	+2	0
626229,2	CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders	6.9	qt/qtbase	Status: MERGED	+2	0
626298,2	CMake: Avoid warnings _qt_internal_sbom_replace_qa_placeholders	6.8	qt/qtbase	Status: MERGED	+2	0
626511,2	CMake: Move more Qt-specific SBOM PURL functions to the right file	6.9	qt/qtbase	Status: MERGED	+2	0
626512,2	CMake: Move generic PURL function from qt-specific file to main one	6.9	qt/qtbase	Status: MERGED	+2	0
626513,2	CMake: Rework SBOM PURL handling	6.9	qt/qtbase	Status: MERGED	+2	0
626564,2	CMake: Move more Qt-specific SBOM PURL functions to the right file	6.8	qt/qtbase	Status: MERGED	+2	0
626565,2	CMake: Move generic PURL function from qt-specific file to main one	6.8	qt/qtbase	Status: MERGED	+2	0
626566,2	CMake: Rework SBOM PURL handling	6.8	qt/qtbase	Status: MERGED	+2	0
626921,3	CMake: Remove type restriction on attribution download location	dev	qt/qtbase	Status: MERGED	+2	0
626922,3	CMake: Remove type restriction on attribution file extra SBOM info	dev	qt/qtbase	Status: MERGED	+2	0
626923,5	CMake: Allow including specific attribution ids in SBOMs	dev	qt/qtbase	Status: MERGED	+2	0
626924,5	CMake: Allow creating nested SBOM attribution targets for all entities	dev	qt/qtbase	Status: MERGED	+2	0
626939,4	CMake: Re-order SBOM embedded qt_attribution.json fields	dev	qt/qtbase	Status: MERGED	+2	0
626940,4	CMake: Remove leftover code after refactoring	dev	qt/qtbase	Status: MERGED	+2	0
626941,4	CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES	dev	qt/qtbase	Status: MERGED	+2	0
626942,4	CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions	dev	qt/qtbase	Status: MERGED	+2	0
626943,4	CMake: Extract Qt-specific license concluded handling	dev	qt/qtbase	Status: MERGED	+2	0
626944,3	CMake: Sanitize nested SBOM attribution target names	dev	qt/qtbase	Status: MERGED	+2	0
627240,4	CMake: Handle installing files with same name during SBOM generation	dev	qt/qtbase	Status: MERGED	+2	0
627533,2	CMake: Handle DIRECTORIES in SBOM custom file sets	dev	qt/qtbase	Status: MERGED	+2	0
627774,2	CMake: Remove type restriction on attribution download location	6.9	qt/qtbase	Status: MERGED	+2	0
627775,2	CMake: Remove type restriction on attribution file extra SBOM info	6.9	qt/qtbase	Status: MERGED	+2	0
627776,2	CMake: Sanitize nested SBOM attribution target names	6.9	qt/qtbase	Status: MERGED	+2	0
627777,2	CMake: Allow including specific attribution ids in SBOMs	6.9	qt/qtbase	Status: MERGED	+2	0
627778,2	CMake: Allow creating nested SBOM attribution targets for all entities	6.9	qt/qtbase	Status: MERGED	+2	0
627779,2	CMake: Re-order SBOM embedded qt_attribution.json fields	6.9	qt/qtbase	Status: MERGED	+2	0
627780,2	CMake: Remove leftover code after refactoring	6.9	qt/qtbase	Status: MERGED	+2	0
627781,2	CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES	6.9	qt/qtbase	Status: MERGED	+2	0
627782,2	CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions	6.9	qt/qtbase	Status: MERGED	+2	0
627783,2	CMake: Extract Qt-specific license concluded handling	6.9	qt/qtbase	Status: MERGED	+2	0
627784,2	CMake: Handle DIRECTORIES in SBOM custom file sets	6.9	qt/qtbase	Status: MERGED	+2	0
627865,2	CMake: Include license and license file attribution in SBOM comment	dev	qt/qtbase	Status: MERGED	+2	0
627877,3	CMake: Add function to set up SBOM generation defaults	dev	qt/qtbase	Status: MERGED	+2	0
627896,2	CMake: Handle installing files with same name during SBOM generation	6.9	qt/qtbase	Status: MERGED	+2	0
627899,2	CMake: Remove type restriction on attribution download location	6.8	qt/qtbase	Status: MERGED	+2	0
627900,2	CMake: Remove type restriction on attribution file extra SBOM info	6.8	qt/qtbase	Status: MERGED	+2	0
627901,2	CMake: Sanitize nested SBOM attribution target names	6.8	qt/qtbase	Status: MERGED	+2	0
627902,2	CMake: Allow including specific attribution ids in SBOMs	6.8	qt/qtbase	Status: MERGED	+2	0
627903,2	CMake: Allow creating nested SBOM attribution targets for all entities	6.8	qt/qtbase	Status: MERGED	+2	0
627904,2	CMake: Re-order SBOM embedded qt_attribution.json fields	6.8	qt/qtbase	Status: MERGED	+2	0
627905,2	CMake: Remove leftover code after refactoring	6.8	qt/qtbase	Status: MERGED	+2	0
627906,2	CMake: Add a new SBOM entity type: THIRD_PARTY_SOURCES	6.8	qt/qtbase	Status: MERGED	+2	0
627907,2	CMake: Unqtify THIRD_PARTY_SOURCES handling for SBOM attributions	6.8	qt/qtbase	Status: MERGED	+2	0
627908,2	CMake: Extract Qt-specific license concluded handling	6.8	qt/qtbase	Status: MERGED	+2	0
627929,2	CMake: Handle DIRECTORIES in SBOM custom file sets	6.8	qt/qtbase	Status: MERGED	+2	0
627942,2	CMake: Handle installing files with same name during SBOM generation	6.8	qt/qtbase	Status: MERGED	+2	0
628177,2	CMake: Include license and license file attribution in SBOM comment	6.9	qt/qtbase	Status: MERGED	+2	0
628178,2	CMake: Add function to set up SBOM generation defaults	6.9	qt/qtbase	Status: MERGED	+2	0
628376,2	CMake: Include license and license file attribution in SBOM comment	6.8	qt/qtbase	Status: MERGED	+2	0
628378,2	CMake: Add function to set up SBOM generation defaults	6.8	qt/qtbase	Status: MERGED	+2	0
628509,2	CMake: Remove semicolon from SBOM external document references	dev	qt/qtbase	Status: MERGED	+2	0
628614,2	CMake: Remove semicolon from SBOM external document references	6.9	qt/qtbase	Status: MERGED	+2	0
628717,2	CMake: Remove semicolon from SBOM external document references	6.8	qt/qtbase	Status: MERGED	+2	0
644881,2	CMake: Fix showing exit code when SBOM NTIA verification fails	dev	qt/qtbase	Status: MERGED	+2	0
645450,2	CMake: Fix showing exit code when SBOM NTIA verification fails	6.9	qt/qtbase	Status: MERGED	+2	0
645845,2	CMake: Fix showing exit code when SBOM NTIA verification fails	tqtc/lts-6.8	qt/tqtc-qtbase	Status: MERGED	+2	0