SBOM installation fail

[ilnadi]

Windows 11, Intel i7, python 3.11.3, pip 24.0

I am trying to use sbom following the instructions here (https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/scripts/west_commands/sbom/README.html) using:

pip3 install -r nrf/scripts/requirements-west-ncs-sbom.txt

When I run the pip command (I tried both pip and pip3), the installation fails with the following:

copying build\lib\licensedcode\data\rules\epl-2.0_or_apache-2.0_or_gpl-2.0_with_classpath-exception-2.0_or_gpl-2.0_with_openjdk-exception_1.RULE -> build\bdist.win-amd64\wheel\.\licensedcode\data\rules
error: could not create 'build\bdist.win-amd64\wheel\.\licensedcode\data\rules\epl-2.0_or_apache-2.0_or_gpl-2.0_with_classpath-exception-2.0_or_gpl-2.0_with_openjdk-exception_1.RULE': No such file or directory
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed building wheel for scancode-toolkit
Failed to build scancode-toolkit
ERROR: Could not build wheels for scancode-toolkit, which is required to install pyproject.toml-based projects

So far:

• I tried to see what's wrong with those directories or files but I cannot find on my computer where the files are being copied from and to.  I tried searching for the files that did copy but cannot find them.
• I could not capture the whole thing but the attached file has the beginning and the end. 

Fullscreen sbomInstallLog.txt Download

Collecting jinja2 (from -r v2.5.2/nrf/scripts/requirements-west-ncs-sbom.txt (line 1))
  Using cached Jinja2-3.1.3-py3-none-any.whl.metadata (3.3 kB)
Collecting scancode-toolkit==31.2.6 (from scancode-toolkit[full]==31.2.6->-r v2.5.2/nrf/scripts/requirements-west-ncs-sbom.txt (line 2))
  Using cached scancode-toolkit-31.2.6.tar.gz (15.9 MB)
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Getting requirements to build wheel: started
  Getting requirements to build wheel: finished with status 'done'
  Preparing metadata (pyproject.toml): started
  Preparing metadata (pyproject.toml): finished with status 'done'
Collecting attrs!=20.1.0,>=18.1 (from scancode-toolkit==31.2.6->scancode-toolkit[full]==31.2.6->-r v2.5.2/nrf/scripts/requirements-west-ncs-sbom.txt (line 2))
  Using cached attrs-23.2.0-py3-none-any.whl.metadata (9.5 kB)
 :
 :
Building wheels for collected packages: scancode-toolkit
  Building wheel for scancode-toolkit (pyproject.toml): started
   :
   :
   error: could not create 'build\bdist.win-amd64\wheel\.\licensedcode\data\rules\epl-2.0_or_apache-2.0_or_gpl-2.0_with_classpath-exception-2.0_or_gpl-2.0_with_openjdk-exception_1.RULE': No such file or directory
  Building wheel for scancode-toolkit (pyproject.toml): finished with status 'error'
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
  ERROR: Failed building wheel for scancode-toolkit
Failed to build scancode-toolkit
ERROR: Could not build wheels for scancode-toolkit, which is required to install pyproject.toml-based projects

Any ideas?

[Michal]

Hello,

I will look into it and get back to you.

Best regards,

Michal

[Michal]

I did some testing and it looks like the issue is in ScanCode, it could be for example that your python version is not compatible with this ScanCode version.

I would recommend maybe reporting it on their github issues. You could also try to install the newest ScanCode from pip instead of the specific version in the script and check if that works.

Best regards,

Michal

[ilnadi]

Installing the latest ScanCode (32.0.8) instead of the one specifies in the 2.5.2 script worked.  However, still a few worries:

The installation went much much faster.  e.g. the "Building wheels for collected packages: scancode-toolkit" step from before never happened.  Not sure what it means or if it is only needed for the old version.

Trying to run sbom using the instructions here did not work either.

When I run west mcs-sbom -h, I get an error:

usage: west [-h] [-z ZEPHYR_BASE] [-v] [-V] <command> ...
west: unknown command "ncs-sbom"; do you need to run this inside a workspace?

I tried running it from Windows PowerShell and from the vsCode terminal (where I build the code).

Any idea how I persuade wet to fund and run ncs-sbom?

[Michal]

1. What is the output of west -h? Can you see ncs-sbom in the output? If it doesn't appear, could you try installing it from the same terminal?

If it doesn't help:

2. Where are you running it from?

3. Can you check if you have the ZEPHYR_BASE environmental variable set up in the terminal (and if it is pointing to the correct SDK?)

Best regards,

Michal