staging/xback/scripts/make-sbom.py, branch master

build: create reproducible CycloneDX SBOMs

2026-09-22T16:46:30Z

Both SBOM generators produce a different file on every run, so the published .bom.cdx.json of an image and of a package feed never match a rebuild. dump_cyclonedxsbom_json() in scripts/package-metadata.pl has three causes. It draws the serial number from rand(), it takes the timestamp from the wall clock, and encode_json() follows the Perl hash order, which changes with the hash seed of each run. The last one alone reorders every key in the file. scripts/make-sbom.py has the first two causes, through uuid.uuid4() and datetime.utcnow(). Take the timestamp from SOURCE_DATE_EPOCH, which the build exports. Derive the serial number from the timestamp and the component list, so it stays a valid RFC 4122 identifier and still changes when the content changes. Sort the keys of the Perl output. Tested with the package index and the image manifest of an ipq40xx build. Two runs with the same SOURCE_DATE_EPOCH are now identical, two runs with different values differ, and the scripts exit with an error when the value is not a number. Both files differ between two runs without the change. Signed-off-by: John Crispin

scripts: fix CycloneDX BOM version type

2026-09-07T07:58:43Z

CycloneDX 1.4 requires the top-level BOM version to be an integer. Emit numeric 1 so SBOMs generated from both APK and opkg package indexes conform to the schema. Signed-off-by: Cui Shuang Link: https://github.com/openwrt/openwrt/pull/25059 Signed-off-by: Robert Marko

build: add CycloneDX SBOM processing to apk

2026-05-17T10:21:09Z

Currently, there is no SBOM generation in imagebuilder when the package system 'apk' is used. This commit adds this feature back. This already worked for the package system 'opkg'. Furthermore, generating the SBOM using perl is not reproducible if the input data has not changed. A different file is always generated. This is not the case with Python. For this reason, Python is now used to generate the SBOM for the imagebuilder. The script has already been prepared so that it can also process the opkg package system for generating the SBOM. Signed-off-by: Florian Eckert