Re: [PATCH v5 00/15] add SPDX SBOM generation script

[Nathan Chancellor]

On Fri, 10 Apr 2026 23:22:40 +0200, Luis <luis.augenstein@xxxxxxxxxxx> wrote:
> This patch series introduces a Python-based script for generating SBOM
> documents in the SPDX 3.0.1 format for kernel builds.

I see the following error when building ARCH=arm64 virtconfig sbom:

  | $ make -skj"$(nproc)" ARCH=arm64 CROSS_COMPILE=aarch64-linux- CROSS_COMPILE_COMPAT=arm-linux-gnueabi- mrproper virtconfig sbom
  | [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py", line 33, in log_error_or_warning
  | Skipped parsing command arch/arm64/kernel/vdso32/../../../arm/vdso/vdsomunge arch/arm64/kernel/vdso32/vdso.so.raw arch/arm64/kernel/vdso32/vdso32.so.dbg because no matching parser was found
  | ...
  | make[3]: *** [/src/Makefile:2184: sbom] Error 1
  | ...

I would highly recommend running some randconfig builds with ARCH=arm64
and ARCH=x86_64 if you have not already done so to ensure you have
caught all corner cases. This one was understandably missed because GCC
builds require a separate 32-bit cross compiler (specified with
CROSS_COMPILE_COMPAT) to build this code. Testing with LLVM=1 would help
with that since the build system handles cross compile automatically in
that case.

> [...]
> modules as root nodes, the script reconstructs the dependency graph up
> to the original source files. Build dependencies are primarily derived from
> the `.cmd` files generated by Kbuild, which record the full command used
> to build each output file.
> 
> Currently, the script only supports x86 and arm64 architectures.

This does not appear to be codified anywhere? I can run the sbom target
when targeting ARCH=arm for example, resulting in:

  | [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py", line 33, in log_error_or_warning
  | Skipped parsing command sh /src/arch/arm/tools/syscallnr.sh /src/arch/arm/tools/syscall.tbl arch/arm/include/generated/asm/unistd-nr.h because no matching parser was found
  | [ERROR] File "/src/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py", line 33, in log_error_or_warning
  | Skipped parsing command ./arch/arm/vdso/vdsomunge arch/arm/vdso/vdso.so.raw arch/arm/vdso/vdso.so.dbg because no matching parser was found
  | [WARNING] Could not infer primary purpose for /src/arch/arm/tools/mach-types
  | [WARNING] Could not infer primary purpose for /build/arch/arm/boot/compressed/piggy_data

Otherwise, from a Kbuild perspective, this seems fine. I will provide my
Ack on patch 2, which is the only place it should matter. I think Greg
can take this when he thinks it is in good enough shape.

Sashiko points out a number of things as well:

  https://sashiko.dev/#/patchset/20260410212255.9883-1-luis.augenstein@xxxxxxxxxxx

-- 
Cheers,
Nathan