linux-kernel - Re: [PATCH v2 00/14] Add SPDX SBOM generation tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2026012558-shield-backward-5bd7@gregkh>
Date: Sun, 25 Jan 2026 16:40:52 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
Cc: Luis Augenstein <luis.augenstein@...tech.com>, nathan@...nel.org,
	nsc@...nel.org, linux-kbuild@...r.kernel.org,
	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	maximilian.huber@...tech.com
Subject: Re: [PATCH v2 00/14] Add SPDX SBOM generation tool

On Sun, Jan 25, 2026 at 04:33:28PM +0100, Miguel Ojeda wrote:
> On Sun, Jan 25, 2026 at 4:20 PM Miguel Ojeda
> <miguel.ojeda.sandonis@...il.com> wrote:
> >
> > After all, the kernel image should not change at all whether there is
> > an SBOM or not.
> 
> Well, I guess the SBOM could be saved into the kernel itself (and
> perhaps retrieved in different ways, e.g. at runtime), in which case,
> then an option definitely makes sense.

Ick, let's not dump the HUGE sbom json file inside the binary kernel
image itself, unless you want to do something like /proc/sbom.gz?

That would be funny, but a big waste of memory :)

greg k-h