Skip to content

sbom: add spdx file and sbom generation to cmake #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MariusBgm wants to merge 4 commits into
base: main
Choose a base branch
from
Open

sbom: add spdx file and sbom generation to cmake #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c4d5403
sbom: add sbom generation
MariusBgm Aug 19, 2026
3acfd43
fixup! sbom: add sbom generation
MariusBgm Aug 19, 2026
47d8a20
generate thirdparty licenses notes in the docs
MariusBgm Aug 19, 2026
f4ecb00
use organization sil kit developers, not vector informatik
MariusBgm Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/sil-kit-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,22 @@ jobs:
sh ./SilKit/ci/check_licenses.sh
shell: bash

check-thirdparty:
name: SBOM and third party notices are up to date
runs-on: ubuntu-22.04
steps:
# The check reads the submodule commits from the tree via 'git ls-tree' and the license texts
# from ThirdParty/licenses/, so the submodules themselves are not needed.
- uses: actions/checkout@v6
with:
submodules: false

- name: Check third party files
id: thirdparty-check
run: |
python3 ./SilKit/ci/generate_thirdparty.py --check
shell: bash

check-run-builds:
runs-on: ubuntu-22.04
outputs:
Expand Down
5 changes: 5 additions & 0 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ option(SILKIT_USE_SYSTEM_LIBRARIES "Use the libraries installed on the system fo
option(SILKIT_BUILD_REPRODUCIBLE "Creates a reproducible build by omitting timestamps/unique build ids" ON)
option(SILKIT_BUILD_LINUX_PACKAGE "Creates SIL Kit builds suitable for package managers in Linux Distributions (.deb)" OFF)
option(SILKIT_BUILD_LTO "Build with link time optimizations" OFF)
option(SILKIT_BUILD_SBOM "Generate an SPDX software bill of materials (requires Python 3)" ON)

if(SILKIT_BUILD_LINUX_PACKAGE)

Expand Down Expand Up @@ -146,6 +147,10 @@ if(SILKIT_BUILD_DOCS)
add_subdirectory(docs)
endif()

# Must come after add_subdirectory(SilKit), which is where SILKIT_GIT_HASH is determined
include(SilKitSbom)
silkit_add_sbom()

################################################################################
# Distribution of the source code
################################################################################
Expand Down
4 changes: 3 additions & 1 deletion README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ Build) and is provided in pre-built form with the SIL Kit packages.

The SIL Kit source and documentation is licensed under a permissible open
source license, see LICENSE file. For licenses of third party dependencies,
see `ThirdParty/LICENSES.rst`.
see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components
is provided as an SPDX software bill of materials in `SilKit.spdx.json`.
Both are generated from `ThirdParty/third-party-components.json`.

For supported platforms, see `Developer Guide <docs/for-developers/developers.rst>`_

Expand Down
Loading
Loading