From 341fe4e6020340137f20564bbebbd5abde0b4b18 Mon Sep 17 00:00:00 2001 From: Alexandru Croitor Date: Fri, 19 Jun 2026 14:26:19 +0200 Subject: [PATCH] coin: Add syft to provisioning Syft is a tool that scans package manager manifest or lock files and generates an SBOM (Software Bill of Materials) file based on the found packages. It can generated both CycloneDX and SPDX SBOM formats. The tool will be used by the Qt for Python project to generate SBOMs based on the python packages used during the build. The tool is provisioned on all the platforms that have the GenerateSBOM feature. Pick-to: 6.8 6.11 6.12 Task-number: PYSIDE-3366 Change-Id: I1369f7b1b041b1fc0d8a56a20446df322d26d33a Reviewed-by: Joerg Bornemann --- coin/provisioning/common/linux/syft.sh | 39 ++++++++++++++++ coin/provisioning/common/macos/syft.sh | 39 ++++++++++++++++ coin/provisioning/common/windows/syft.ps1 | 44 +++++++++++++++++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../09-install-syft.sh | 8 ++++ .../provisioning/qtci-macos-15-arm/27-syft.sh | 8 ++++ .../provisioning/qtci-macos-26-arm/27-syft.sh | 8 ++++ .../qtci-windows-10_22H2-x86_64/09-syft.ps1 | 4 ++ .../qtci-windows-11_23H2-aarch64/09-syft.ps1 | 4 ++ .../qtci-windows-11_24H2-x86_64/09-syft.ps1 | 4 ++ 15 files changed, 206 insertions(+) create mode 100755 coin/provisioning/common/linux/syft.sh create mode 100755 coin/provisioning/common/macos/syft.sh create mode 100644 coin/provisioning/common/windows/syft.ps1 create mode 100755 coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh create mode 100755 coin/provisioning/qtci-macos-15-arm/27-syft.sh create mode 100755 coin/provisioning/qtci-macos-26-arm/27-syft.sh create mode 100644 coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1 create mode 100644 coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1 create mode 100644 coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1 diff --git a/coin/provisioning/common/linux/syft.sh b/coin/provisioning/common/linux/syft.sh new file mode 100755 index 00000000..cb9aa96b --- /dev/null +++ b/coin/provisioning/common/linux/syft.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash +# Copyright (C) 2026 The Qt Company Ltd. +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +# This script installs Syft + +# Syft is used for generating SBOM (Software Bill of Materials) files. + +# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh +source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh" +# shellcheck source=../unix/SetEnvVar.sh +source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh" + + +version="1.45.1" + +uname_m="$(uname -m)" +case "$uname_m" in + x86_64|amd64) + SHA1="06e1d56173209977df8b11ad955843cb62f874fd" + arch="amd64" + ;; + arm64|aarch64) + SHA1="c48638b3998066dbd139e94e116a81a6cc6299be" + arch="arm64" + ;; + *) fatal "Unknown architecture in uname: $uname_m" 43 ;; +esac + +PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_linux_${arch}.tar.gz" +AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_${arch}.tar.gz" +targetFolder="/opt/syft-$version" +appPrefix="" + +InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix" + +SetEnvVar "PATH" "$targetFolder:\$PATH" + +echo "Syft = $version" >> ~/versions.txt diff --git a/coin/provisioning/common/macos/syft.sh b/coin/provisioning/common/macos/syft.sh new file mode 100755 index 00000000..e044203d --- /dev/null +++ b/coin/provisioning/common/macos/syft.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash +# Copyright (C) 2026 The Qt Company Ltd. +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +# This script installs Syft + +# Syft is used for generating SBOM (Software Bill of Materials) files. + +# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh +source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh" +# shellcheck source=../unix/SetEnvVar.sh +source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh" + + +version="1.45.1" + +uname_m="$(uname -m)" +case "$uname_m" in + x86_64|amd64) + SHA1="ecd1a9283e4ce025b5905a85e505fcba237edd51" + arch="amd64" + ;; + arm64|aarch64) + SHA1="996f3985f14ebbe8661c0b72d7ad520200155c46" + arch="arm64" + ;; + *) fatal "Unknown architecture in uname: $uname_m" 43 ;; +esac + +PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_darwin_${arch}.tar.gz" +AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_darwin_${arch}.tar.gz" +targetFolder="/opt/syft-$version" +appPrefix="" + +InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix" + +SetEnvVar "PATH" "$targetFolder:\$PATH" + +echo "Syft = $version" >> ~/versions.txt diff --git a/coin/provisioning/common/windows/syft.ps1 b/coin/provisioning/common/windows/syft.ps1 new file mode 100644 index 00000000..d521ce93 --- /dev/null +++ b/coin/provisioning/common/windows/syft.ps1 @@ -0,0 +1,44 @@ +# Copyright (C) 2026 The Qt Company Ltd +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +. "$PSScriptRoot\helpers.ps1" + +$version = "1.45.1" + +$cpu_arch = Get-CpuArchitecture +Write-Host "Installing Syft for architecture $cpu_arch" +switch ($cpu_arch) { + arm64 { + $arch = "arm64" + $sha1 = "f629f6fa9c542e8803aa13987f8104a441c15878" + Break + } + x64 { + $arch = "amd64" + $sha1 = "debd2e1e77763fe8cf224e791abf79e11dc4a93b" + Break + } + default { + throw "Unknown architecture $cpu_arch" + } +} + +$filename = "syft_" + $version + "_windows_" + $arch +$filename_zip = $filename + ".zip" + +$zip = Get-DownloadLocation ($filename_zip) +$externalUrl = "https://github.com/anchore/syft/releases/download/v" + $version + "/" + $filename_zip +$internalUrl = "https://ci-files01-hki.ci.qt.io/input/syft/" + $filename_zip + +Write-Host "Removing old syft" +Remove "C:\syft" + +Download $externalUrl $internalUrl $zip +Verify-Checksum $zip $sha1 + +Extract-7Zip $zip C:\syft +Remove "$zip" + +Add-Path "C:\syft" + +Write-Output "Syft ($arch) = $version" >> ~\versions.txt diff --git a/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh new file mode 100755 index 00000000..cc0db58b --- /dev/null +++ b/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +BASEDIR=$(dirname "$0") +"$BASEDIR/../common/linux/syft.sh" diff --git a/coin/provisioning/qtci-macos-15-arm/27-syft.sh b/coin/provisioning/qtci-macos-15-arm/27-syft.sh new file mode 100755 index 00000000..60d8bd25 --- /dev/null +++ b/coin/provisioning/qtci-macos-15-arm/27-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +# shellcheck source=../common/macos/syft.sh +source "${BASH_SOURCE%/*}/../common/macos/syft.sh" diff --git a/coin/provisioning/qtci-macos-26-arm/27-syft.sh b/coin/provisioning/qtci-macos-26-arm/27-syft.sh new file mode 100755 index 00000000..60d8bd25 --- /dev/null +++ b/coin/provisioning/qtci-macos-26-arm/27-syft.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +#Copyright (C) 2026 The Qt Company Ltd +#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +set -ex + +# shellcheck source=../common/macos/syft.sh +source "${BASH_SOURCE%/*}/../common/macos/syft.sh" diff --git a/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1 b/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1 new file mode 100644 index 00000000..4e5d15ec --- /dev/null +++ b/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1 @@ -0,0 +1,4 @@ +# Copyright (C) 2026 The Qt Company Ltd +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +. "$PSScriptRoot\..\common\windows\syft.ps1" diff --git a/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1 b/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1 new file mode 100644 index 00000000..4e5d15ec --- /dev/null +++ b/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1 @@ -0,0 +1,4 @@ +# Copyright (C) 2026 The Qt Company Ltd +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +. "$PSScriptRoot\..\common\windows\syft.ps1" diff --git a/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1 b/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1 new file mode 100644 index 00000000..4e5d15ec --- /dev/null +++ b/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1 @@ -0,0 +1,4 @@ +# Copyright (C) 2026 The Qt Company Ltd +# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only + +. "$PSScriptRoot\..\common\windows\syft.ps1"