Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-134894

Various improvements for SBOM generation

    XMLWordPrintable

Details

    • Task
    • Resolution: Unresolved
    • P3: Somewhat important
    • None
    • None
    • Build System: CMake
    • None

    Description

      While working on the SBOM for Qt Creator and Qt Design studio, I encountered some points that could be improved:
      https://codereview.qt-project.org/c/qt-creator/qt-creator/+/615674/42//COMMIT_MSG#13

      Keeping them here so as to not forget them.

      • Non-intuitive behavior, that a target file is not added to the SBOM when it's created in the same directory as the qt_sbom_project_end() call,
        because the target is finalized after sbom_end() has been called,
        consider adding a check for this in a finalizer in Qt itself if possible.
      • Need to come up with a way to reference sbom directories for
        standalone plugin build case, without having to specify
        QT_ADDITIONAL_SBOM_DOCUMENT_PATHS explicitly, so we need to 'save' the
        info somehow like we do for qt sbom paths. Perhaps by exporting some target
        properties to carry the info and match it back to the Foo_DIR var of the originating package.
      • Consider creating minimal sbom packages for targets that are not sbom-aware. We can't provide any meaningful data for them, but at least other targets that depend on them via target_link_libraries will have them as dependencies in the sbom, and can thus signal 'unknown' extra deps.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              qtbuildsystem Qt Build System Team
              alexandru.croitor Alexandru Croitor
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Gerrit Reviews

                  There are no open Gerrit changes