linux-kernel - Re: [PATCH 00/14] Add SPDX SBOM generation tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2026012009-applied-napped-42e2@gregkh>
Date: Tue, 20 Jan 2026 07:08:44 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Luis Augenstein <luis.augenstein@...tech.com>
Cc: nathan@...nel.org, nsc@...nel.org, linux-kbuild@...r.kernel.org,
	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	maximilian.huber@...tech.com
Subject: Re: [PATCH 00/14] Add SPDX SBOM generation tool

On Mon, Jan 19, 2026 at 09:08:14PM +0100, Luis Augenstein wrote:
> > Also, I don't know if this is even possible, or you care about it, but
> > if you have ANY sbom file present, it is not regenerated:
> > [...]
> > So, if I change the build config, which will change the sbom output,
> > will the sbom be regenerated?
> > Should it depend on the config .h files to know this?
> 
> Thanks for pointing this out.
> Yes, we can add the following to the Makefile dependencies to ensure the
> SBOM is regenerated when the build changes:
> - $(objtree)/$(KBUILD_IMAGE)
> - $(objtree)/include/generated/autoconf.h
> - $(objtree)/modules.order (if CONFIG_MODULES is set)
> 
> This should cover most changes.
> When you mentioned "config .h files," did you have any other specific
> files in mind that should be included as dependencies?

I was referring to the autoconf.h file, thanks for figuring that out, I
couldn't remember what the exact name was.  So that should be sufficient
here.

thanks,

greg k-h