coin: Add syft to provisioning

Syft is a tool that scans package manager manifest or lock files and
generates an SBOM (Software Bill of Materials) file based on the
found packages. It can generated both CycloneDX and SPDX SBOM formats.

The tool will be used by the Qt for Python project to generate SBOMs
based on the python packages used during the build.

The tool is provisioned on all the platforms that have the
GenerateSBOM feature.

Pick-to: 6.11 6.8
Task-number: PYSIDE-3366
Change-Id: I1369f7b1b041b1fc0d8a56a20446df322d26d33a
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
(cherry picked from commit 341fe4e602)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

coin/provisioning/common/linux/syft.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 The Qt Company Ltd.
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+# This script installs Syft
+
+# Syft is used for generating SBOM (Software Bill of Materials) files.
+
+# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh
+source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh"
+# shellcheck source=../unix/SetEnvVar.sh
+source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh"
+
+
+version="1.45.1"
+
+uname_m="$(uname -m)"
+case "$uname_m" in
+    x86_64|amd64)
+        SHA1="06e1d56173209977df8b11ad955843cb62f874fd"
+        arch="amd64"
+        ;;
+    arm64|aarch64)
+        SHA1="c48638b3998066dbd139e94e116a81a6cc6299be"
+        arch="arm64"
+        ;;
+    *) fatal "Unknown architecture in uname: $uname_m" 43 ;;
+esac
+
+PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_linux_${arch}.tar.gz"
+AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_${arch}.tar.gz"
+targetFolder="/opt/syft-$version"
+appPrefix=""
+
+InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix"
+
+SetEnvVar "PATH" "$targetFolder:\$PATH"
+
+echo "Syft = $version" >> ~/versions.txt

coin/provisioning/common/macos/syft.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 The Qt Company Ltd.
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+# This script installs Syft
+
+# Syft is used for generating SBOM (Software Bill of Materials) files.
+
+# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh
+source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh"
+# shellcheck source=../unix/SetEnvVar.sh
+source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh"
+
+
+version="1.45.1"
+
+uname_m="$(uname -m)"
+case "$uname_m" in
+    x86_64|amd64)
+        SHA1="ecd1a9283e4ce025b5905a85e505fcba237edd51"
+        arch="amd64"
+        ;;
+    arm64|aarch64)
+        SHA1="996f3985f14ebbe8661c0b72d7ad520200155c46"
+        arch="arm64"
+        ;;
+    *) fatal "Unknown architecture in uname: $uname_m" 43 ;;
+esac
+
+PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_darwin_${arch}.tar.gz"
+AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_darwin_${arch}.tar.gz"
+targetFolder="/opt/syft-$version"
+appPrefix=""
+
+InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix"
+
+SetEnvVar "PATH" "$targetFolder:\$PATH"
+
+echo "Syft = $version" >> ~/versions.txt

coin/provisioning/common/windows/syft.ps1

@@ -0,0 +1,44 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\helpers.ps1"
+
+$version = "1.45.1"
+
+$cpu_arch = Get-CpuArchitecture
+Write-Host "Installing Syft for architecture $cpu_arch"
+switch ($cpu_arch) {
+    arm64 {
+        $arch = "arm64"
+        $sha1 = "f629f6fa9c542e8803aa13987f8104a441c15878"
+        Break
+    }
+    x64 {
+        $arch = "amd64"
+        $sha1 = "debd2e1e77763fe8cf224e791abf79e11dc4a93b"
+        Break
+    }
+    default {
+        throw "Unknown architecture $cpu_arch"
+    }
+}
+
+$filename = "syft_" + $version + "_windows_" + $arch
+$filename_zip = $filename + ".zip"
+
+$zip = Get-DownloadLocation ($filename_zip)
+$externalUrl = "https://github.com/anchore/syft/releases/download/v" + $version + "/" + $filename_zip
+$internalUrl = "https://ci-files01-hki.ci.qt.io/input/syft/" + $filename_zip
+
+Write-Host "Removing old syft"
+Remove "C:\syft"
+
+Download $externalUrl $internalUrl $zip
+Verify-Checksum $zip $sha1
+
+Extract-7Zip $zip C:\syft
+Remove "$zip"
+
+Add-Path "C:\syft"
+
+Write-Output "Syft ($arch) = $version" >> ~\versions.txt

coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"

coin/provisioning/qtci-macos-15-arm/27-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+# shellcheck source=../common/macos/syft.sh
+source "${BASH_SOURCE%/*}/../common/macos/syft.sh"

coin/provisioning/qtci-macos-26-arm/27-syft.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+# shellcheck source=../common/macos/syft.sh
+source "${BASH_SOURCE%/*}/../common/macos/syft.sh"

coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1

@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"

coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1

@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"

coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1

@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"