Qt 6.8软件物料清单

Qt 6.8 Software Bill of Materials

Qt 6.8软件物料清单

December 03, 2024 by Alexandru Croitor | Comments

2024年12月3日，亚历山德鲁·克鲁托

TL;DR: The binary packages of Qt 6.8 or later in the Qt Online installer contain build SBOM documents.

TL；DR：Qt Online安装程序中Qt 6.8或更高版本的二进制包包含构建SBOM文档。

An SBOM is:

SBOM是：

A machine-processable document containing the details and supply chain relationships of various components used in building software, similar to food ingredient labels on packaging.

一种机器可处理的文档，包含构建软件中使用的各种组件的详细信息和供应链关系，类似于包装上的食品成分标签。

Why SBOM?

为什么选择SBOM？

Building and shipping software requires a lot of care. Some aspects of building software are often neglected yet are considered important by many. I'm talking about security, build reproducibility, supply chain tracking, license compliance, and copyright attribution.

构建和运输软件需要非常小心。构建软件的某些方面经常被忽视，但被许多人认为很重要。我说的是安全性、构建可重复性、供应链跟踪、许可证合规性和版权归属。

The European Union partly shares that opinion, which is why, among other things, it is adopting the Cyber-Resilience Act (CRA) regulation, which aims to improve the security of hardware and software.

​欧盟部分赞同这一观点，这就是为什么除其他外，它正在通过《网络弹性法案》（CRA）条例，该条例旨在提高硬件和软件的安全性。

The CRA mentions automatic security updates, as well as vulnerability and incident reports. Now, software products are usually not created from scratch and rely on 3rd party components that are authored externally. To ensure security updates and to find whether one's software is vulnerable, one would first have to identify these components and their versions, find out which parts of the components are used, which of them are vulnerable, which of them have to be updated, etc

CRA提到了自动安全更新，以及漏洞和事件报告。现在，软件产品通常不是从头开始创建的，而是依赖于外部编写的第三方组件。为了确保安全更新并发现自己的软件是否存在漏洞，首先必须识别这些组件及其版本，找出使用了哪些组件，哪些组件存在漏洞，哪些组件必须更新，等等

For a big software project, that can get burdensome quite fast. This is where SBOMs come in.

对于一个大型软件项目来说，这可能会很快变得繁重。这就是SBOM发挥作用的地方。

Build SBOM

构建SBOM

There are many SBOM types and formats, but one of the most useful ones is a Build SBOM, which is generated as part of the build process based on source files, dependency information, already created components, volatile build process data, and other SBOMs.

有许多SBOM类型和格式，但最有用的一种是构建SBOM，它是基于源文件、依赖关系信息、已创建的组件、易失性构建过程数据和其他SBOM在构建过程中生成的。

And that's exactly what we are now shipping with Qt 6.8.0 and later.

这正是我们现在在Qt 6.8.0及更高版本中提供的。

Specifically, we ship one document for each Qt framework git repository built, using the SPDX v2.3 format, in both tag:value and JSON formats. When installing Qt via the online installer, you will automatically get the SBOM documents in your ~/Qt/<platform>/sbom directory for the relevant packages that you have installed.

​具体来说，我们为每个使用SPDX v2.3格式构建的Qt框架git存储库提供一个文档，包括tag:value和JSON格式。通过在线安装程序安装Qt时，您将自动在~/Qt/<platform>/SBOM目录中获取已安装相关软件包的SBOM文档。

These documents contain:

这些文件包括：

• An entry describing each Qt module or plugin built as part of the build process
• 描述作为构建过程一部分构建的每个Qt模块或插件的条目
• An entry for each 3rd party or system library used
• 每个使用的第三方或系统库的条目
• Dependency relationships between these entries, e.g. the fact that Qt Core links against a system ZLIB library
• 这些条目之间的依赖关系，例如Qt Core链接到系统ZLIB库的事实
• License information, copyright attribution, and version information for each of these components, where available
• 许可证信息、版权归属和每个组件的版本信息（如有）
• Source file information that was used to generate each specific library
• 用于生成每个特定库的源文件信息
• A SHA1 checksum for each installed binary file, as well as an overall checksum for the whole document
• 每个已安装二进制文件的SHA1校验和，以及整个文档的总体校验和
• Security-relevant information, like package-specific CPEs and PURLs, to aid tooling in finding vulnerabilities
• 安全相关信息，如特定于包的CPE和PURL，以帮助工具发现漏洞
• Other information like the compiler version used, the build tool version used, the build date and SBOM creation date, a unique URI identifying the SBOM document, etc
• 其他信息，如使用的编译器版本、使用的构建工具版本、构建日期和SBOM创建日期、标识SBOM文档的唯一URI等

Because these SBOM documents are machine-readable and have a well-defined structure, they can be fed to various tooling for useful purposes like:

由于这些SBOM文档是机器可读的，并且具有明确定义的结构，因此可以将它们馈送到各种工具中，用于以下有用目的：

• Finding vulnerabilities based on component versions in databases like the National Vulnerability Database (where CVEs are usually filed), Github Advisories, etc
• ​根据国家漏洞数据库（通常提交CVE）、Github公告等数据库中的组件版本查找漏洞
• License compliance (e.g. deny all usage of GPL libraries)
• 许可证合规性（例如拒绝使用GPL库）
• File integrity checking (based on the SBOM embedded checksums)
• 文件完整性检查（基于SBOM嵌入的校验和）
• Copyright attribution collection (to generate an 'About dialog' with all the copyrights)
• 版权归属收集（生成包含所有版权的“关于”对话框）

Getting SBOMs for your own Qt

为自己的Qt获取SBOM

These SBOMs are not limited to Qt's official packages.

这些SBOM不仅限于Qt的官方软件包。

If you're building Qt from scratch, just ensure you have the required dependencies installed (link pending), and just pass -sbom as an additional argument to the configure script. This will automatically generate and install the SBOM documents along with your Qt framework.

如果从头开始构建Qt，只需确保安装了所需的依赖项（链接待定），并将-sbom作为额外参数传递给配置脚本。这将自动生成并安装SBOM文档以及Qt框架。

Because this feature was added fairly recently, there are still some gaps in the gathered information (e.g, there's no SBOM information for Qt translations yet), but we aim to improve this in the future. You can check the known gaps by looking at the related issues of QTBUG-122899.

​因为这个功能是最近才添加的，所以收集到的信息仍然存在一些差距（例如，Qt翻译还没有SBOM信息），但我们的目标是在未来改进这一点。可以通过查看QTBUG-122899的相关问题来检查已知的差距。

We are also looking into adding a public CMake API to generate SBOMs for your Qt projects, which would make CRA compliance easier for you.

我们也在考虑添加一个公共CMake API，为Qt项目生成SBOM，这将使您更容易遵守CRA。

As time passes, the CRA's expectations for software authors will become clearer, and we will incorporate the necessary changes into our generated SBOMs.

随着时间的推移，CRA对软件作者的期望将变得更加明确，我们将在生成的SBOM中纳入必要的更改。

Until then, happy SBOMing.

在那之前，祝SBOMing快乐。