=== FreeBSD Software Bill of Materials (SBOM)

Links: +
link:https://github.com/illuusio/freebsd-src/tree/freebsd-lua-tools-sbom/share/sbom[FreeBSD Lua Tools for SBOM] URL: https://github.com/illuusio/freebsd-src/tree/freebsd-lua-tools-sbom/share/sbom +
link:https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig-meld/share/sbom[FreeBSD pkg-config WIP SBOM files which are base for Pierre Pronchery's work] URL: https://github.com/illuusio/freebsd-src/tree/sbom-pkgconfig-meld/share/sbom +
link:https://reviews.freebsd.org/D56474[Generate SBOM files as part of the build review] URL: https://reviews.freebsd.org/D56474 +

Open upstream SPDX license identifier PRs: +
link:https://github.com/freebsd/atf/pull/128[ATF PR#128] URL: https://github.com/freebsd/atf/pull/128 +
link:https://gnats.netbsd.org/60308[bmake NetBSD GNATS#60308] URL: https://gnats.netbsd.org/60308 +
link:https://github.com/NLnetLabs/ldns/issues/305[LDNS ISSUE#305] URL: https://github.com/NLnetLabs/ldns/issues/305 +
link:https://github.com/gwsw/less/pull/792[Less PR#792] URL: https://github.com/gwsw/less/pull/792 +
link:https://github.com/libarchive/libarchive/pull/3129[Libarchive PR#3129] URL: https://github.com/libarchive/libarchive/pull/3129 +
link:https://github.com/PJK/libcbor/issues/430[LibCBOR ISSUE#430] URL: https://github.com/PJK/libcbor/issues/430 +
link:https://gnats.netbsd.org/60309[libedit NetBSD GNATS#60309] URL: https://gnats.netbsd.org/60309 +
link:https://github.com/libevent/libevent/issues/1864[Libevent ISSUE#1864] URL: https://github.com/libevent/libevent/issues/1864 +
link:https://github.com/the-tcpdump-group/libpcap/pull/1689[LibPCAP PR#1689] URL: https://github.com/the-tcpdump-group/libpcap/pull/1689 +
link:https://github.com/vstakhov/libucl/pull/386[LibUCL PR#386] URL: https://github.com/vstakhov/libucl/pull/386 +
link:https://bugs.astron.com/view.php?id=777[TCSH Mantis#777] URL: https://bugs.astron.com/view.php?id=777 +

Contact: Tuukka Pasanen <tuukka.pasanen@ilmi.fi>

The FreeBSD Software Bill of Materials (SBOM) effort has been continued during Q2 2026.
This quarter’s focus has been reviewing and updating pkg-config [.filename]#.pc# files and adding SPDX-License-Identifier to third-party projects included in the FreeBSD source.
This effort will be continued in Q3.

As said, most of the quarter’s work has been dedicated to polishing pkg-config [.filename]#.pc#, as these files are needed when generating SPDX 2.2 and SPDX Lite 3.0.1-compatible SBOM files.
During this year Pierre Pronchery has been adding other crucial parts like pkgconf to the FreeBSD source.
Currently, the biggest effort lead by him on the tooling side is the review of the SBOM generation part of the build, which holds [.filename]#.pc# as part of the review.
When the review is ready and the source is added to FreeBSD, SBOMs can be created during the building process.

Besides work on [.filename]#.pc#, there has also been polishing of The FreeBSD Lua Tools for SBOM, which have been used to create the current set of [.filename]#.pc# files and can be used for future updates.
These scripts are still somewhat raw and complicated to use but are now in much better shape than before, and there is documentation on how to use them.

Adding SPDX-License-Identifier to third-party repositories is also a work in progress and will proceed in an order that aligns with project maintainers’ preferences.
Why are license identifiers being added to third-party projects?
There is no simple answer to this question, but the closest explanation is that machine-readable license identifiers help maintain SBOM information in the future.

If you want to help with this effort:

* Review [.filename]#.pc# files in Phabricator as part of the "Generate SBOM files as part of the build" review.
* Assist in reviewing the pkgconf 3.0 import to the FreeBSD source.

Sponsor: FreeBSD Foundation