Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-122899

Generate SBOM from Qt build system

    XMLWordPrintable

Details

    • All
    • d940399b3 (dev), 37a5e0012 (dev), 79f9b490e (dev), 65bf57ce7 (6.8), fc3ac85db (6.8), 699d50bd8 (6.8), 8f04225c5 (dev), fe90ba704 (dev), d78ee6933 (dev), 877ba5504 (dev), 81162cc8b (dev), 9be3d7a7a (6.8), aea52288d (6.8), 596d07f64 (6.8), ba08a2fb1 (6.8)

    Description

      Generate an SPDX or CycloneDX document for Qt components and third party components, taking the Qt configuration system into account.

      Related work

      Attachments

        Issue Links

          depends on

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-125371 Problematic calling of qt_find_package(Qt6) in qt_internal_project_setup

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Closed
          resulted in

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-131850 'reuse lint' fails to parse "Apache-2.0 WITH LLVM-exception"

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          Task - A task that needs to be done. QTBUG-127335 Check that sbom spdx files are included in release packages

          • P1: Critical - Urgent and Important, will STOP the release if matched with set FixVersion field. This includes regressions from the last version that are not edge cases; Data loss; Build issues; All but the most unlikely crashes/lockups/hanging; Serious usability issues and embarrassing bugs & Bugs critical to a deliverable. This is the highest possible priority for requirements.
          • Closed

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129916 Consider hosting prebuilt Qt SBOMs as plain text files on a well-defined location on the web

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Open
          split to

          Bug - A problem which impairs or prevents the functions of the product. QTBUG-128893 sbom for qtpdf gets lost , as it ends up as qtwebengine sbom

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          Task - A task that needs to be done. QTBUG-129600 Investigate generation of SPDX v3.0 documents for Qt build SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129602 Annotate all qt_attribution.json files with CPE and PURL values

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Reported

          Task - A task that needs to be done. QTBUG-129598 Investigate generation of CycloneDX documents for Qt build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129605 Revisit how we handle system libraries when adding their information to the build SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-129607 Investigate how to integrate Qt's build SBOM with Yocto SBOM

          • P3: Somewhat important - Should be fixed, but doesn't affect the release in any way.
          • Reported

          Task - A task that needs to be done. QTBUG-128320 Generate an SBOM for qttranslations

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • In Progress

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129601 Provide custom SBOM's in deployment tooling

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129609 Provide a public CMake API for user projects to generate an SBOM

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129901 Provide an SBOM for Qt WebEngine And Qt Pdf

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-129906 Consider making our SBOMs compliant with the German SBOM guideline

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open

          User Story - Created by Jira Software - do not edit or delete. Issue type for a user story. QTBUG-131281 Provide SBOM information for tools used during Qt build

          • P2: Important - Urgent, should be fixed, but will not stop the release.
          • Open
          For Gerrit Dashboard: QTBUG-122899
          # Subject Branch Project Status CR V
          564092,3 WIP: coin: Enable git cloning dev qt/qtbase Status: NEW -2 -1
          565524,7 WIP: CMake: Add SBOM information for some QtPdf 3rd party libraries dev qt/qtwebengine Status: NEW -2 0
          586284,1 WIP: coin: Enable git cloning dev qt/qtdeclarative Status: NEW -2 +1
          586287,1 WIP: coin: Enable git cloning dev qt/qtsvg Status: NEW -2 +1
          604364,7 CMake: Create separate SBOM documents for QtWebEngine and QtPdf dev qt/qtwebengine Status: NEW +2 0
          604971,28 CMake: Add SBOM support for translations, custom files and friends dev qt/qtbase Status: NEW 0 0
          604973,8 CMake: Add translation files to SBOM 6.8 qt/qttranslations Status: NEW 0 0
          608770,20 CMake: Add API to include custom cmake files during SBOM generation dev qt/qtbase Status: NEW +2 0
          608773,21 CMake: Add API to allow referencing external packages in the SPDX SBOM dev qt/qtbase Status: NEW -1 0
          608782,19 CMake: Allow adding custom SBOM relationships to targets and projects dev qt/qtbase Status: NEW +2 0
          608784,24 CMake: Add way to convert JSON SPDX to tag/value SPDX document dev qt/qtbase Status: NEW +2 0
          608786,10 WIP: CMake: Experiments with SBOM API for webengine dev qt/qtsvg Status: NEW -2 0
          609644,5 CMake: Remove SBOM multi-config dead code dev qt/qtbase Status: NEW +2 0
          610136,4 CMake: Move SBOM project ops setup to run at project begin time dev qt/qtbase Status: NEW +2 0
          610148,11 CMake: Add internal functions to get various kinds of spdx ids dev qt/qtbase Status: NEW +2 0

          Activity

            People

              alexandru.croitor Alexandru Croitor
              kkohne Kai Köhne
              Votes:
              2 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:

                Gerrit Reviews

                  There are 15 open Gerrit changes