Software Bill of Materials | Qt 6.11
Description: Qt package information in SPDX and CycloneDX formats

- Qt 6.11
- Product information
- Qt Licensing
- Software Bill of Materials
- Qt 6.11.0 Reference Documentation

License Changes ◦ Trademarks

# Software Bill of Materials

A Software Bill of Materials (SBOM) document is a declaration of installed files, copyrights, licenses, versions, source repositories, and other relevant information about a Qt installation. The SBOM documents facilitate supply chain management by sharing component information to Qt users and other interested parties. Qt's SBOM documents are especially useful for license compliance and security vulnerability management.

Starting from Qt 6.8, Qt's build system can generate SBOM documents tailored for different platforms and build configurations. The Qt Online Installer places the SBOM documents in an `sbom` directory located in the installation directory of the respective Qt version. For example, for the Qt 6.11.0 Android arm64-v8a installation, the SBOM documents are at:

     <INSTALL_DIR>/6.11.0/android_arm64_v8a/sbom/

To generate SBOM documents from the Qt sources yourself, set `-sbom` as a configure option.

For example, during the configure step:

     ./configure  -sbom

Generation of SBOM documents then becomes a part of the regular Qt installation:

     ninja install
     cmake --install .

This build process creates SBOM documents in JSON and `tag:value` format as specified by the SPDX format.

Starting from Qt 6.11, the build process optionally creates CycloneDX SBOM documents.

See Building Qt Sources and Qt Configure Options for more information about the Qt build procedure.

For Qt developers and maintainers, the SBOM Wiki has specific information for creating SBOM documents.

## REUSE-compliant Qt modules

Qt modules are REUSE compliant starting from Qt 6.9. Specifically, license documentation and license checks are part of Qt's development process. Various tools check Qt repositories for licenses in files or externally in REUSE.toml files.

The reuse-tool checks for REUSE compliance and generates source SBOMs. An internal tool checks that the generated source SBOM files comply with the Qt license specification.

For more information about licenses documentation in the Qt sources, visit the following:

- QUIP 18: License specification in Qt's modules
- Licensing in Qt sources

## SPDX Format

The SBOM documents are in SPDX 2.3 format. A document begins with information about the Qt module. SPDX packages follow as separate entries.

For a Qt installation, an SPDX package may be a:

- Qt module
- Qt plugin - for example, platform plugins
- Qt tool - for example, moc
- Qt application - for example, Qt Widgets Designer
- Third-party component - see Third-Party Code Used in Qt
- System library dependency - Qt Configure Options

An SPDX package typically contains at least:

- Package name, version, supplier name, and build information
- Qt License Attribution - a Qt product may be under different commercial or open source licenses. For example, a package may list several concluded licenses:

       LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

  The Qt Licensing has more information about licensing options.

- Copyright notices - SBOM documents include Qt source copyrights and copyrights from third-party sources or authors.
- CPE (Common Platform Enumeration) - a naming scheme for package identification. For Qt, the SBOM CPE format is typically:

       cpe:<cpe_version>:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>

  An example identifier for a Qt Network Authorization package is:

       cpe:2.3:a:qt:qtnetworkauth:6.11.0:*:*:*:*:*:*:*

  For more information, see CPE Specification page.

- PURL (Package URL) - an alternative to CPE, PURL is an identifier scheme that uses the following format:

       scheme:type/namespace/name@version?qualifiers#subpath

  An example PURL for a package is:

       pkg:generic/TheQtCompany/qtnetworkauth@6.11.0

  For more information, Package URL page.

- Package relationships between packages such as dependencies.

  For example, the `DEPENDS_ON` for listing a dependency relationship. Refer to Clause 11 of the SPDX 2.3 for a list of valid relationship types.

## Third-party SPDX Packages

An SPDX package for a third-party component typically contains at least:

- Name, version, and description
- Homepage and download location
- Usage in Qt
- License and copyright information
- Whether the component is security critical - the code may process untrusted code

## SPDX SBOM Example

The following is an example of an SPDX SBOM document for the Qt Network Authorization module. The SBOM filename is `qtnetworkauth-6.9.0.spdx` and is in the installation's `sbom` directory. Note that the SBOM document contains several other packages not listed in the following example.

     SPDXVersion: SPDX-2.3
     DataLicense: CC0-1.0
     SPDXID: SPDXRef-DOCUMENT
     DocumentName: qtnetworkauth-6.9.0
     DocumentNamespace: https://qt.io/spdxdocs/qtnetworkauth-6.9.0
     Creator: Organization: TheQtCompany
     Creator: Tool: Qt Build System
     CreatorComment: <text>This SPDX document was created from CMake 3.27.7, using the qt
     build system from https://code.qt.io/cgit/qt/qtbase.git/tree/cmake/QtPublicSbomHelpers.cmake</text>
     Created: 2024-09-19T11:07:23Z
     ExternalDocumentRef: DocumentRef-qtbase https://qt.io/spdxdocs/qtbase-6.9.0 SHA1: 3dbc51259a07d458524a976da2e9607a76fab7e7

     PackageName: NetworkAuth
     SPDXID: SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth
     PackageDownloadLocation: git://code.qt.io/qt/qtnetworkauth.git
     PackageVersion: 6.9.0
     PackageSupplier: Organization: TheQtCompany
     PackageLicenseConcluded: LicenseRef-Qt-Commercial OR GPL-3.0-only
     PackageLicenseDeclared: LicenseRef-Qt-Commercial OR GPL-3.0-only
     ExternalRef: PACKAGE-MANAGER purl pkg:github/qt/qtnetworkauth?library_name=NetworkAuth#src/oauth
     ExternalRef: PACKAGE-MANAGER purl pkg:generic/TheQtCompany/qtnetworkauth-NetworkAuth?vcs_url=https://code.qt.io/qt/qtnetworkauth.git&library_name=NetworkAuth#src/oauth
     FilesAnalyzed: true
     PackageCopyrightText: <text>Copyright (C) 2024 The Qt Company Ltd.</text>
     PrimaryPackagePurpose: LIBRARY
     ExternalRef: SECURITY cpe23Type cpe:2.3:a:qt:qtnetworkauth:6.9.0:*:*:*:*:*:*:*
     ExternalRef: SECURITY cpe23Type cpe:2.3:a:qt:qt:6.9.0:*:*:*:*:*:*:*
     Relationship: SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth DEPENDS_ON DocumentRef-qtbase:SPDXRef-Package-qtbase-qt-module-Core
     Relationship: SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth DEPENDS_ON DocumentRef-qtbase:SPDXRef-Package-qtbase-qt-module-PlatformModuleInternal
     Relationship: SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth DEPENDS_ON DocumentRef-qtbase:SPDXRef-Package-qtbase-qt-module-Gui
     Relationship: SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth DEPENDS_ON DocumentRef-qtbase:SPDXRef-Package-qtbase-qt-module-Network
     Relationship: SPDXRef-Package-qtnetworkauth CONTAINS SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth

## CycloneDX Format

Starting from Qt 6.11, the build process optionally creates SBOM documents in CycloneDX v1.6 format.

To require CycloneDX generation, configure Qt with:

     ./configure -sbom -sbom-cyclonedx-v1_6 -sbom-cyclonedx-v1_6-required

Generating CycloneDX documents requires the following dependencies:

- Python version 3.9 or newer
- Python packages:
  - cyclonedx-python-lib[json-validation]
  - tomli

You can use Python's `pip` tool to install the required packages:

     pip install 'cyclonedx-python-lib[json-validation]' tomli

CycloneDX documents provide similar information as SPDX documents, including components, licenses, dependencies, and security metadata.

Compared to SPDX, the CycloneDX information contains less detail about some areas like licenses and relationship types.

Installed CycloneDX SBOM documents have filenames in the format: `<module>-<version>.cdx.json`.

## CycloneDX SBOM Example

The following is an example of a CycloneDX SBOM document for the Qt Network Authorization module. The SBOM filename is `qtnetworkauth-6.11.0.cdx.json` and is in the installation's `sbom` directory. Note that the SBOM document contains several other components not listed in the following example.

     {
       "components": [
         {
           "bom-ref": "SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth",
           "copyright": "Copyright (C) The Qt Company Ltd. and other contributors.",
           "cpe": "cpe:2.3:a:qt:qt:6.11.0:*:*:*:*:*:*:*",
           "licenses": [
             {
               "license": {
                 "acknowledgement": "concluded",
                 "id": "GPL-3.0-only"
               }
             }
           ],
           "name": "NetworkAuth",
           "properties": [
             {
               "name": "qt:sbom:entity_type",
               "value": "QT_MODULE"
             },
             {
               "name": "qt:sbom:is_qt_entity_type",
               "value": "true"
             },
             {
               "name": "spdx:external-reference:package-manager:purl",
               "value": "pkg:github/qt/qtnetworkauth?library_name=NetworkAuth#src/oauth"
             },
             {
               "name": "spdx:external-reference:security:cpe23",
               "value": "cpe:2.3:a:qt:qtnetworkauth:6.11.0:*:*:*:*:*:*:*"
             }
           ],
           "purl": "pkg:generic/TheQtCompany/qtnetworkauth-NetworkAuth?library_name=NetworkAuth&vcs_url=https://code.qt.io/qt/qtnetworkauth.git#src/oauth",
           "supplier": {
             "name": "TheQtCompany",
             "url": [
               "https://qt.io"
             ]
           },
           "type": "library",
           "version": "6.11.0"
         }
       ],
       "dependencies": [
         {
           "dependsOn": [
             "SPDXRef-Package-qtbase-qt-module-Core",
             "SPDXRef-Package-qtbase-qt-module-Gui",
             "SPDXRef-Package-qtbase-qt-module-Network",
             "SPDXRef-Package-qtbase-qt-module-PlatformModuleInternal"
           ],
           "ref": "SPDXRef-Package-qtnetworkauth-qt-module-NetworkAuth"
         }
       ],
       "serialNumber": "urn:uuid:ce0d41b5-0fe8-5383-bf31-ff353a05b8be",
       "version": 1,
       "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
       "bomFormat": "CycloneDX",
       "specVersion": "1.6"
     }

## Yocto builds with meta-qt6

Boot to Qt uses the meta-qt6 layer to build all Qt modules and the generated SBOM documents are available as SPDX files when installing Boot to Qt through the Qt Online Installer. The install path depends on the Qt version and the target hardware.

For example, for the Raspberry Pi target, the SBOM .spdx documents are at:

     <INSTALL_DIR>/6.11.0/Boot2Qt/raspberrypi-armv8/toolchain/sysroots/cortexa53-poky-linux/usr/lib/sbom/

For more information, visit the following pages:

- Using meta-qt6
- meta-qt6 repository

## Related Topics

- SPDX 2.3
- Qt Wiki - SBOM - generating SBOM documents from Qt sources
- Third-Party Code Used in Qt

License Changes ◦ Trademarks