git: 65329e18c0 - main - Status/2026Q2/sbom.adoc: Add report

The branch main has been updated by salvadore:

URL: https://cgit.FreeBSD.org/doc/commit/?id=65329e18c004bbb7da54623532618a10d4bde7d6

commit 65329e18c004bbb7da54623532618a10d4bde7d6
Author:     Tuukka Pasanen <[email protected]>
AuthorDate: 2026-07-22 14:51:13 +0000
Commit:     Lorenzo Salvadore <[email protected]>
CommitDate: 2026-07-22 14:51:13 +0000

    Status/2026Q2/sbom.adoc: Add report
    
    Differential Revision:  https://reviews.freebsd.org/D57994
---
 .../en/status/report-2026-04-2026-06/sbom.adoc     | 44 ++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/website/content/en/status/report-2026-04-2026-06/sbom.adoc b/website/content/en/status/report-2026-04-2026-06/sbom.adoc
new file mode 100644
index 0000000000..dab704b19f
--- /dev/null
+++ b/website/content/en/status/report-2026-04-2026-06/sbom.adoc
@@ -0,0 +1,44 @@
+=== FreeBSD Software Bill of Materials (SBOM)
+
+Links: +
+link:https://github.com/illuusio/freebsd-src/tree/freebsd-lua-tools-sbom/share/sbom[FreeBSD Lua Tools for SBOM] URL: https://github.com/illuusio/freebsd-src/tree/freebsd-lua-tools-sbom/share/sbom +
+link:https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig-meld/share/sbom[FreeBSD pkg-config WIP SBOM files which are base for Pierre Pronchery's work] URL: https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig-meld/share/sbom +
+link:https://reviews.freebsd.org/D56474[Generate SBOM files as part of the build review] URL: https://reviews.freebsd.org/D56474 +
+
+Open upstream SPDX license identifier PRs: +
+link:https://github.com/freebsd/atf/pull/128[ATF PR#128] URL: https://github.com/freebsd/atf/pull/128 +
+link:https://gnats.netbsd.org/60308[bmake NetBSD GNATS#60308] URL: https://gnats.netbsd.org/60308 +
+link:https://github.com/NLnetLabs/ldns/issues/305[LDNS ISSUE#305] URL: https://github.com/NLnetLabs/ldns/issues/305 +
+link:https://github.com/gwsw/less/pull/792[Less PR#792] URL: https://github.com/gwsw/less/pull/792 +
+link:https://github.com/libarchive/libarchive/pull/3129[Libarchive PR#3129] URL: https://github.com/libarchive/libarchive/pull/3129 +
+link:https://github.com/PJK/libcbor/issues/430[LibCBOR ISSUE#430] URL: https://github.com/PJK/libcbor/issues/430 +
+link:https://gnats.netbsd.org/60309[libedit NetBSD GNATS#60309] URL: https://gnats.netbsd.org/60309 +
+link:https://github.com/libevent/libevent/issues/1864[Libevent ISSUE#1864] URL: https://github.com/libevent/libevent/issues/1864 +
+link:https://github.com/the-tcpdump-group/libpcap/pull/1689[LibPCAP PR#1689] URL: https://github.com/the-tcpdump-group/libpcap/pull/1689 +
+link:https://github.com/vstakhov/libucl/pull/386[LibUCL PR#386] URL: https://github.com/vstakhov/libucl/pull/386 +
+link:https://bugs.astron.com/view.php?id=777[TCSH Mantis#777] URL: https://bugs.astron.com/view.php?id=777 +
+
+Contact: Tuukka Pasanen <[email protected]>
+
+The FreeBSD Software Bill of Materials (SBOM) effort has been continued during Q2 2026.
+This quarter’s focus has been reviewing and updating pkg-config [.filename]#.pc# files and adding SPDX-License-Identifier to third-party projects included in the FreeBSD source.
+This effort will be continued in Q3.
+
+As said, most of the quarter’s work has been dedicated to polishing pkg-config [.filename]#.pc#, as these files are needed when generating SPDX 2.2 and SPDX Lite 3.0.1-compatible SBOM files.
+During this year Pierre Pronchery has been adding other crucial parts like pkgconf to the FreeBSD source.
+Currently, the biggest effort lead by him on the tooling side is the review of the SBOM generation part of the build, which holds [.filename]#.pc# as part of the review.
+When the review is ready and the source is added to FreeBSD, SBOMs can be created during the building process.
+
+Besides work on [.filename]#.pc#, there has also been polishing of The FreeBSD Lua Tools for SBOM, which have been used to create the current set of [.filename]#.pc# files and can be used for future updates.
+These scripts are still somewhat raw and complicated to use but are now in much better shape than before, and there is documentation on how to use them.
+
+Adding SPDX-License-Identifier to third-party repositories is also a work in progress and will proceed in an order that aligns with project maintainers’ preferences.
+Why are license identifiers being added to third-party projects?
+There is no simple answer to this question, but the closest explanation is that machine-readable license identifiers help maintain SBOM information in the future.
+
+If you want to help with this effort:
+
+* Review [.filename]#.pc# files in Phabricator as part of the "Generate SBOM files as part of the build" review.
+* Assist in reviewing the pkgconf 3.0 import to the FreeBSD source.
+
+Sponsor: FreeBSD Foundation