git: 6b95694419 - main - Status/2026Q3/sbom.adoc: Add report

The branch main has been updated by salvadore:

URL: https://cgit.FreeBSD.org/doc/commit/?id=6b95694419272b9b55416bcfbcb260e5fa6ff8f7

commit 6b95694419272b9b55416bcfbcb260e5fa6ff8f7
Author:     Tuukka Pasanen <tuukka.pasanen@ilmi.fi>
AuthorDate: 2026-11-01 14:30:04 +0000
Commit:     Lorenzo Salvadore <salvadore@FreeBSD.org>
CommitDate: 2026-11-01 14:31:22 +0000

    Status/2026Q3/sbom.adoc: Add report
    
    Differential Revision:  https://reviews.freebsd.org/D60640
---
 .../en/status/report-2026-07-2026-09/sbom.adoc     | 59 ++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/website/content/en/status/report-2026-07-2026-09/sbom.adoc b/website/content/en/status/report-2026-07-2026-09/sbom.adoc
new file mode 100644
index 0000000000..885b44eb67
--- /dev/null
+++ b/website/content/en/status/report-2026-07-2026-09/sbom.adoc
@@ -0,0 +1,59 @@
+=== FreeBSD Software Bill of Materials (SBOM)
+
+Links: +
+link:https://reviews.freebsd.org/D59528[sys/arm/arm/busdma_machdep.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59528 +
+link:https://reviews.freebsd.org/D59527[sys/powerpc/powerpc/busdma_machdep.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59527 +
+link:https://reviews.freebsd.org/D59526[sys/powerpc/powerpc/busdma_bounce.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59526 +
+link:https://reviews.freebsd.org/D59525[sys/x86/x86/busdma_machdep.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59525 +
+link:https://reviews.freebsd.org/D59524[sys/x86/x86/busdma_bounce.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59524 + 
+link:https://reviews.freebsd.org/D59523[sys/kern/subr_busdma_bounce.c: Correct SPDX-License-Identifier] URL: https://reviews.freebsd.org/D59523 +
+link:https://reviews.freebsd.org/D60352[D60352] URL: https://reviews.freebsd.org/D60352
+link:https://reviews.freebsd.org/D60441[D60441] URL: https://reviews.freebsd.org/D60441
+
+Open upstream SPDX license identifier PRs: +
+link:https://github.com/freebsd/atf/pull/128[ATF PR#128] URL: https://github.com/freebsd/atf/pull/128 +
+link:https://gnats.netbsd.org/60308[bmake NetBSD GNATS#60308] URL: https://gnats.netbsd.org/60308 +
+link:https://github.com/NLnetLabs/ldns/issues/305[LDNS ISSUE#305] URL: https://github.com/NLnetLabs/ldns/issues/305 +
+link:https://github.com/gwsw/less/pull/792[Less PR#792] URL: https://github.com/gwsw/less/pull/792 +
+link:https://github.com/libarchive/libarchive/pull/3129[Libarchive PR#3129] URL: https://github.com/libarchive/libarchive/pull/3129 +
+link:https://github.com/PJK/libcbor/issues/430[LibCBOR ISSUE#430] URL: https://github.com/PJK/libcbor/issues/430 +
+link:https://github.com/libevent/libevent/issues/1864[Libevent ISSUE#1864] URL: https://github.com/libevent/libevent/issues/1864 +
+link:https://github.com/the-tcpdump-group/libpcap/pull/1689[LibPCAP PR#1689] URL: https://github.com/the-tcpdump-group/libpcap/pull/1689 +
+link:https://github.com/vstakhov/libucl/pull/386[LibUCL PR#386] URL: https://github.com/vstakhov/libucl/pull/386 +
+link:https://bugs.astron.com/view.php?id=777[TCSH Mantis#777] URL: https://bugs.astron.com/view.php?id=777 +
+
+Contact: Tuukka Pasanen <tuukka.pasanen@ilmi.fi>
+
+The FreeBSD Software Bill of Materials (SBOM) effort has been continued during Q3 2026.
+At last, getting SBOM into FreeBSD source is manifesting itself and hopefully will be finalized in Q4.
+Thanks to Pierre Pronchery, there is a Phabricator review ongoing: https://reviews.freebsd.org/D60352[D60352] for FreeBSD source.
+Also, ports have one for reviewing: https://reviews.freebsd.org/D60441[D60441] made by Mathieu Arnold.
+
+As an option for SBOM output, there are currently available SPDX 2.2 and Lite 3.0.1.
+CycloneDX SBOM tool is in work in progress and still needs some love to be as qualified as the output for SPDX.
+In the future, all SBOM outputs will be under one tool, which will be named `sbomtool`, and as both solutions rely on pkgconf, they will have CycloneDX when it lands in FreeBSD source.
+
+Additionally, several new SPDX License Identifiers have been accepted. All three are in FreeBSD source:
+* link:https://github.com/spdx/license-list-XML/issues/3007[BSD-2-Clause-pos-unchanged]
+* link:https://github.com/spdx/license-list-XML/issues/3000[BSD-Source-Code-no-disclaimer]
+* link:https://github.com/spdx/license-list-XML/issues/2939[BSD-Source-alt-GPL]
+
+There are several updates from `BSD-2-Clause` to `BSD-Source-beginning-file` in review:
+
+* link:https://reviews.freebsd.org/D59528[sys/arm/arm/busdma_machdep.c: Correct SPDX-License-Identifier]
+* link:https://reviews.freebsd.org/D59527[sys/powerpc/powerpc/busdma_machdep.c: Correct SPDX-License-Identifier]
+* link:https://reviews.freebsd.org/D59526[sys/powerpc/powerpc/busdma_bounce.c: Correct SPDX-License-Identifier]
+* link:https://reviews.freebsd.org/D59525[sys/x86/x86/busdma_machdep.c: Correct SPDX-License-Identifier]
+* link:https://reviews.freebsd.org/D59524[sys/x86/x86/busdma_bounce.c: Correct SPDX-License-Identifier]
+* link:https://reviews.freebsd.org/D59523[sys/kern/subr_busdma_bounce.c: Correct SPDX-License-Identifier]
+
+Additionally, many third-party repositories have received SPDX License Identifiers, such as libxo (thanks to Juniper for that), and others.
+Some projects do not want headers, and some are still in active development.
+
+If you want to help with this effort:
+
+* Review Phabricator changes.
+  SPDX License Identifier corrections are at a very low level to review.
+* When pkgconf CycloneDX is available, help review and test it.
+
+Sponsor: FreeBSD Foundation