search

openSUSE / obs-build

OBS build script, can be used with OBS or stand alone
GNU General Public License v2.0
130 stars 181 forks source link

Adding debian support to generate_sbom #997

Closed cschneemann closed 2 months ago

cschneemann commented 3 months ago

Added support for debian images to generate_sbom. It checks if it is a debian based image by evaluating the os-release file.

It introduces some new BuildFlags to configure "special" behaviour:

spdx-declared-license:NOASSERTION licenseDeclared in spdx info for a package is set to "NOASSERATION", if not set the found license from the package information is used (like for "licenseConcluded").

The license information is taken from the package's copyrightfile.

The generation of spdx' file section can be disabled, if just the package information is wanted. This can be switched by buildflag "spdx-files-generation". To switch it off it has to be set to "no": spdx-files-generation:no. Default is to generate also the files information. This option is just available in the deb-handling. No changes to rpm made here.

As debian packages does not have a vendor information this information is taken from the OBS vendor macro/OBS instance name.

Added the sbom generation also to build-receipe-livebuild for a first usage.

mlschroe commented 2 months ago

What's with the "just join licenses" commit? Why is it needed? I think it was correct before, now there is $ret{'license'} = @license_uniq[0]; which doesn't seem to be good perl...

cschneemann commented 2 months ago

What's with the "just join licenses" commit? Why is it needed? I think it was correct before, now there is $ret{'license'} = @license_uniq[0]; which doesn't seem to be good perl...

deleted my last comment, because it was "stupid".. The behaviour I wanted to fix with this was fixed by another change.