Re: [PATCH v2 00/14] Add SPDX SBOM generation tool

[Luis Augenstein <luis.augenstein@tngtech.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1545 bytes --]

Hi Nathan,

> I wonder if it would be better for this to live within scripts/ instead
> of tools/, as that should allow it to be integrated into the build
> process a little bit more naturally, such as using $(Q) instead of @,
> $(PYTHON3) instead of the bare python3, being able to access
> CONFIG_MODULES directly, and cleaning up the actual implementation of
> the sbom target in Makefile.

Thanks, I wasn’t aware that targets under scripts/ have access to more
Make variables by default. During development, we didn’t have strong
reasons for choosing either tools/ or scripts/. I’m happy to move it to
scripts/ if that is the preferred location.

Regarding $(Q) and $(PYTHON3), I noticed that these variables are
actually available within the tools/ directory as well, so we could
switch to using them even if we stay under tools/.

CONFIG_MODULES and src_tree, on the other hand, need to be passed
explicitly when staying in tools/, whereas they would be available by
default under scripts/ in which case we could simply invoke the script via:
```Makefile
PHONY += sbom
sbom: all
	$(Q)$(MAKE) $(build)=scripts/sbom
```

So yes, I think it makes sense to move it to scripts then.

Best,
Luis


-- 
Luis Augenstein * luis.augenstein@tngtech.com * +49-152-25275761
TNG Technology Consulting GmbH, Beta-Str. 13, 85774 Unterföhring
Geschäftsführer: Henrik Klagges, Dr. Robert Dahlke, Thomas Endres
Aufsichtsratsvorsitzender: Christoph Stock
Sitz: Unterföhring * Amtsgericht München * HRB 135082

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3207 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]