Problems installing and using ncs-sbom

[Scott Grubb]

I'd like to use the SBOM tool to generate a list of licenses used in my build.

I've been following the instructions here: Software Bill of Materials

In order to run pip, I first had to install Python for Windows.  Was this a mistake or unnecessary?  Is there a version of pip included somewhere in the SDK that I should have used?

Having installed Python, I then ran the above command from the \ncs\v3.0.0 folder.  This installed jinja2 and MarkupSafe but did not install the scancode-toolkit because "markers 'platform_machine == "x86_64"' don't match your environment" (even though I am on a 64bit Windows platform).

When I tried to run the ncs-sbom tool, it then errored, saying that it couldn't find the scancode-toolkit.

I then tried to install the scancode toolkit manually using pip3 install scancode-toolkit[full]==31.2.6 (copied from the sbom-requirements file but without the platform condition).  The first attempt immediately resulted in several exceptions.  The second attempt got a bit further but still failed with the following message.

I rarely use python, so this is all a bit of a mystery to me.

How can I get to a 'clean' installation of the SBOM tool?

Thanks,

Scott

[Scott Grubb]

Update: I've tried installing the latest version of the scancode-toolkit, instead of the version 31.2.6 specified in the requirements file, but I end up with the same errors.

[Scott Grubb]

Update 2: I reverted to an earlier version of Python (v3.12 instead of v3.13) and that let me install the scancode-toolkit manually.

I'm now getting quite a few of these types of warnings when running the ncs-sbom tool but, I'm guessing, these are due to an issue with the scancode-toolkit?

[SwRa]

Hi Scott,

  Was this a mistake or unnecessary? 

This was a necessary step. The SDK’s bundled Python is not directly exposed for pip installs outside the managed environment.

The SBOM tool uses Scancode-Toolkit, which can have platform-specific requirements. The error about 'platform_machine == "x86_64"' suggests a mismatch between your Python environment and the expected platform. This is likely why you were getting errors after manually installing the scancode-toolkit. Make sure you are using a 64-bit version of Python on a 64-bit Windows system. 

Scott Grubb said:

I'm now getting quite a few of these types of warnings when running the ncs-sbom tool but, I'm guessing, these are due to an issue with the scancode-toolkit?

If these warnings are not blocking your workflow, you may continue using it..

Regards,

Swathy