Creating an SBOM for a QT applicatin (C++) which uses QMake to build it

[ruksan]

Hi,
I have a customized QT application (C++) of a forked open source project. I can build it on my Linux environment for both Linux and android. I do build it on windows as well to create a windows installer. I need to create an SBOM for the application using cdxgen. cdxgen does not seem to extract dependencies using QMake. Any help is much appreciated. Thanks

[aryan-rajoria]

Hello @ruksan,
you are right we do not take qmake into account yet. We support conan, meson and cmake.
Could you kindly share a qmake project so we could replicate the issue.

[ruksan]

Thanks @aryan-rajoria,
The application I am working on is https://github.com/mavlink/qgroundcontrol.
You need to checkout the source code at the tag v4.3.0 (which is 83d9a3) . This project is using some sub modules. So you need ti initialize the sub modules as well to get the full source code.
So the command set is
git clone [email protected]:mavlink/qgroundcontrol.git
cd qgroundcontrol
git checkout 83d9a3
git submodule update --init --recursive

Now you can run the cdxgen to generate the SBOM.
Special Note -
I noticed the sub module code contain a lot of meson.build and CMakeList files which are not actually used by qgroundcontrol to build the application. In fact, I can build qground control even if I remove all the meson.build and CMakeList files. So these build files are actually not used and gets checkout with the submodules. When we run the cdxgen it generates it result based on these build files. So We should first rename all these meson.build and CMakeList files first before running the cdxgen.
So I would run something like
find . -name 'meson.build' -exec sh -c 'mv "$0" "${0%/}/test_mes.b"' {} ;
find . -name 'CMakeLists.txt' -exec sh -c 'mv "$0" "${0%/}/Lists.txt"' {} ;
and then run cdxgen.
Since cdxgen is not supporing qmake, it does not actually extract all dependencies based on qmake here
Thanks