updated Readme

Signed-off-by: Luis Augenstein <luis.augenstein@tngtech.com>

Author: augelu-tng

README.md

@@ -6,7 +6,7 @@ SPDX-FileCopyrightText: 2025 TNG Technology Consulting GmbH
 # KernelSbom
 
 A script to generate an SPDX-format Software Bill of Materials (SBOM) for the linux kernel build.
-The eventual goal is to integrate the `sbom/` directory into the `linux/scripts/` directory in the official [linux](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git) source tree.
+The eventual goal is to integrate the `sbom/` directory into the `linux/tools/` directory in the official [linux](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git) source tree.
 
 ## How to use
 1. Provide a linux source and object tree, e.g., by downloading precompiled test data from [KernelSbom-TestData](https://fileshare.tngtech.com/d/e69946da808b41f88047/files)
@@ -36,7 +36,8 @@ The eventual goal is to integrate the `sbom/` directory into the `linux/scripts/
       --roots arch/x86/boot/bzImage \
       --generate-spdx \
       --generate-used-files \
-      --prettify-json
+      --prettify-json \
+      --debug
     ```
 
 Starting from the provided root artifact (`bzImage`), the script constructs a **cmd graph**: a directed acyclic graph whose nodes are filenames and whose edges represent build dependencies extracted from the corresponding `.<filename>.cmd` files.
@@ -70,6 +71,22 @@ python3 sbom/sbom.py \
   --prettify-json
 ```
 
+### Reproducibility
+By default, SPDX documents are non-deterministic. The spdxIds are generated using random UUIDs, and the `CreationInfo.created` field is set to the current datetime. To produce deterministic outputs, the options `--spdxId-uuid` and `--created` must be provided:
+```bash
+export SRCARCH=x86
+python3 sbom/sbom.py \
+    --src-tree ../linux \
+    --obj-tree ../linux/kernel_build \
+    --roots arch/x86/boot/bzImage \
+    --generate-spdx \
+    --generate-used-files \
+    --prettify-json \
+    --spdxId-uuid bd3ab149-b4a7-4993-8fb4-5c99093c4f28 \
+    --created "2025-12-03 11:30:00" \
+    --debug
+```
+
 ## SPDX Graph Visualization
 
 The following diagrams illustrate the structure of the generated SPDX documents: `sbom-source.spdx.json`, `sbom-build.spdx.json`, and `sbom-output.spdx.json`.
@@ -225,7 +242,7 @@ flowchart TD
         VMLINUX_BIN -.->|Build| LOW_LEVEL_BUILD
         LOW_LEVEL_BUILD -->|hasInput| VMLINUX_BIN
         LOW_LEVEL_BUILD -->|hasOutput| BZIMAGE
-        LOW_LEVEL_BUILD -.->|BUILD| BZIMAGE
+        LOW_LEVEL_BUILD -.->|Build| BZIMAGE
         MAINC -->|hasDeclaredLicense| GPL2ONLY_LICENSEEXPRESSION
     end
 
@@ -276,7 +293,7 @@ flowchart TD
   - [sbom_analysis/cmd_graph_visualization/](sbom_analysis/cmd_graph_visualization/README.md) - Interactive visualization of the cmd graph
 - `testdata_generation/` - Describes how the precompiled kernel builds in [KernelSbom-TestData](https://fileshare.tngtech.com/library/98e7e6f8-bffe-4a55-a8d2-817d4f3e51e8/KernelSbom-TestData/) were generated.
 
-The main contribution of this repository is the content of the `sbom` directory which eventually should be moved into the `linux/scripts/` directory in the official [linux](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git) source tree.
+The main contribution of this repository is the content of the `sbom` directory which eventually should be moved into the `linux/tools/` directory in the official [linux](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git) source tree.
 
 ## Development
 

sbom/sbom.py

@@ -57,7 +57,7 @@ def main():
             logging.debug(f"Found {len(used_files)} source files in cmd graph")
         with open(os.path.join(config.output_directory, config.used_files_file_name), "w", encoding="utf-8") as f:
             f.write("\n".join(str(file_path) for file_path in used_files))
-        logging.debug(f"Successfully saved {config.used_files_file_name}")
+        logging.debug(f"Successfully saved {os.path.join(config.output_directory, config.used_files_file_name)}")
 
     if config.generate_spdx is False:
         return