percona · EvgeniyPatlan · Jul 21, 2026
diff --git a/build-ps/build-binary.sh b/build-ps/build-binary.sh
@@ -818,9 +818,31 @@ fi
     mkdir -p "$TARGETDIR/usr/local/minimal"
     cp -r "$TARGETDIR/usr/local/$PRODUCT_FULL_NAME" "$TARGETDIR/usr/local/minimal/$PRODUCT_FULL_NAME-minimal"
 
+    # Emitted after link so lib/private holds every bundled host library.
+    # A copy is staged in TARGETDIR so the caller can collect it.
+    gen_tarball_sbom() {
+        local dest=$1
+        local label=$2
+        [ "${SBOM:-0}" = "1" ] || return 0
+        sh "$SOURCEDIR/build-ps/sbom/gen-sbom.sh" \
+            --pkg "percona-xtradb-cluster" \
+            --version "${MYSQL_VERSION}-${PERCONA_SERVER_EXTENSION}" \
+            --root "$SOURCEDIR" \
+            --pins "$SOURCEDIR/build-ps/sbom/submodule-pins.txt" \
+            --artifact tarball \
+            --scan-libs "${dest}/lib/private" \
+            --dest "${dest}/sbom"
+        mkdir -p "${TARGETDIR}/sbom"
+        for _sf in "${dest}"/sbom/*; do
+            [ -f "$_sf" ] || continue
+            cp "$_sf" "${TARGETDIR}/sbom/${label}.$(basename "$_sf")"
+        done
+    }
+
     # NORMAL TARBALL
     cd "$TARGETDIR/usr/local/$PRODUCT_FULL_NAME"
     link
+    gen_tarball_sbom "$TARGETDIR/usr/local/$PRODUCT_FULL_NAME" "$PRODUCT_FULL_NAME"
 
     # MIN TARBALL
     if [[ $CMAKE_BUILD_TYPE != "Debug" ]]; then
@@ -829,6 +851,7 @@ fi
         rm -rf percona-xtradb-cluster-tests 2> /dev/null
         find . -type f -exec file '{}' \; | grep ': ELF ' | cut -d':' -f1 | xargs strip --strip-unneeded
         link
+        gen_tarball_sbom "$TARGETDIR/usr/local/minimal/$PRODUCT_FULL_NAME-minimal" "$PRODUCT_FULL_NAME-minimal"
     fi
 )
 

diff --git a/build-ps/debian/rules b/build-ps/debian/rules
@@ -39,6 +39,7 @@ DEB_UPSTREAM_VERSION_MAJOR_MINOR := $(shell echo $(DEB_UPSTREAM_VERSION) | sed -
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
 
 EXPORTED_SOURCE_TARBALL = debian/percona-xtradb-cluster-source-8.0.tar.gz
+SBOM_UTILS = build-ps/sbom
 
 DISTRIBUTION = $(shell lsb_release -i -s)
 DISTRELEASE = $(shell lsb_release -c -s)
@@ -258,6 +259,21 @@ override_dh_install:
 	mkdir -p debian/percona-xtradb-cluster-server-debug/usr/lib/mysql/private/debug
 	cp ./builddir/library_output_directory/libprotobuf-lite.so* debian/percona-xtradb-cluster-server-debug/usr/lib/mysql/private/debug
 	patchelf --debug --set-rpath $(rpathdebug) debian/percona-xtradb-cluster-server-debug/usr/lib/mysql/plugin/debug/group_replication.so
+ifneq (,$(filter pkg.pxc.sbom,$(DEB_BUILD_PROFILES)))
+	@test -n "$(DEB_VERSION)" || \
+		{ echo "SBOM: dpkg-parsechangelog produced no Version" >&2; exit 1; }
+	@test -d debian/percona-xtradb-cluster-server || \
+		{ echo "SBOM: debian/percona-xtradb-cluster-server is not a staging dir" >&2; exit 1; }
+	sh $(SBOM_UTILS)/check-components.sh --root .
+	install -d -m 0755 debian/percona-xtradb-cluster-server/usr/share/percona-xtradb-cluster/sbom
+	sh $(SBOM_UTILS)/gen-sbom.sh \
+		--pkg percona-xtradb-cluster \
+		--version $(DEB_VERSION) \
+		--root . \
+		--pins $(SBOM_UTILS)/submodule-pins.txt \
+		--artifact package \
+		--dest debian/percona-xtradb-cluster-server/usr/share/percona-xtradb-cluster/sbom
+endif
 	@echo "RULES.$@"
 
 ifeq ($(OS_VERSION), 18.04)

diff --git a/build-ps/percona-xtradb-cluster.spec b/build-ps/percona-xtradb-cluster.spec
@@ -1109,6 +1109,18 @@ install -d $RBR%{_libdir}/mysql
 
 find $RBR -name 'core.[0-9]*' -type f -delete || true
 
+%if 0%{?with_sbom}
+sh $MBD/build-ps/sbom/check-components.sh --root $MBD
+install -d -m 0755 $RBR%{_datadir}/percona-xtradb-cluster/sbom
+sh $MBD/build-ps/sbom/gen-sbom.sh \
+  --pkg percona-xtradb-cluster \
+  --version %{mysql_version}-%{percona_server_version} \
+  --root $MBD \
+  --pins $MBD/build-ps/sbom/submodule-pins.txt \
+  --artifact package \
+  --dest $RBR%{_datadir}/percona-xtradb-cluster/sbom
+%endif
+
 ##############################################################################
 #  Post processing actions, i.e. when installed
 ##############################################################################
@@ -1607,6 +1619,10 @@ fi
 %files -n percona-xtradb-cluster-server
 %defattr(-,root,root,0755)
 
+%if 0%{?with_sbom}
+%{_datadir}/percona-xtradb-cluster/sbom
+%endif
+
 %if %{defined license_files_server}
 %doc %{license_files_server}
 %endif

diff --git a/build-ps/pxc_builder.sh b/build-ps/pxc_builder.sh
@@ -23,6 +23,7 @@ Usage: $0 [OPTIONS]
         --bin_release       BIN version( default = 1)
         --debug             Build debug tarball
         --enable_pgo        PGO (Profile-Guided Optimization) build (default = 1, set to 0 to disable)
+        --sbom              If it is 1 SBOMs are generated and shipped (default = 0)
         --help) usage ;;
 Example $0 --builddir=/tmp/PXC9x --get_sources=1 --build_src_rpm=1 --build_rpm=1
 EOF
@@ -61,7 +62,8 @@ parse_arguments() {
             --no_clone=*) NO_CLONE="$val" ;;
             --debug=*) DEBUG="$val" ;;
             --enable_pgo=*) ENABLE_PGO="$val" ;;
-            --help) usage ;;      
+            --sbom=*) SBOM="$val" ;;
+            --help) usage ;;
             *)
               if test -n "$pick_args"
               then
@@ -237,6 +239,19 @@ get_sources(){
     rsync -av ${WORKDIR}/percona-xtradb-cluster/extra/coredumper/ ${PXCDIR}/extra/coredumper --exclude .git
     rsync -av ${WORKDIR}/percona-xtradb-cluster/extra/libkmip/ ${PXCDIR}/extra/libkmip --exclude .git
 
+    # the rsync above drops .git, so record the submodule pins while they are
+    # still resolvable; the SBOM tooling reads this file instead of git
+    if [ ${SBOM} = 1 ]; then
+        mkdir -p ${PXCDIR}/build-ps/sbom
+        git -C ${WORKDIR}/percona-xtradb-cluster submodule status --recursive \
+            | awk '{ sub(/^[-+U]/, "", $1); print $2 "|" $1 }' \
+            > ${PXCDIR}/build-ps/sbom/submodule-pins.txt
+        if [ ! -s ${PXCDIR}/build-ps/sbom/submodule-pins.txt ]; then
+            echo "ERROR: --sbom=1 but no submodule pins could be recorded"
+            exit 1
+        fi
+    fi
+
     sed -i 's:ROUTER_RUNTIMEDIR:/var/run/mysqlrouter/:g' ${PXCDIR}/packaging/rpm-common/*
     cd ${PXCDIR}/packaging/rpm-common || exit
         if [ ! -f mysqlrouter.service ]; then
@@ -274,6 +289,27 @@ get_sources(){
         sed -i 's:boostorg\.jfrog\.io/artifactory/main/release/.*/source:downloads.percona.com/downloads/packaging/boost:g' cmake/boost.cmake
     popd
     #
+    if [ ${SBOM} = 1 ]; then
+        if ! sh ${PXCDIR}/build-ps/sbom/check-components.sh --root ${PXCDIR}; then
+            echo "ERROR: --sbom=1 but the component registry does not match the tree"
+            exit 1
+        fi
+        if ! sh ${PXCDIR}/build-ps/sbom/gen-sbom.sh \
+            --pkg percona-xtradb-cluster \
+            --version ${MYSQL_VERSION}-${MYSQL_RELEASE} \
+            --root ${PXCDIR} \
+            --pins ${PXCDIR}/build-ps/sbom/submodule-pins.txt \
+            --artifact source \
+            --dest ${PXCDIR}/sbom; then
+            echo "ERROR: --sbom=1 but SBOM generation failed"
+            exit 1
+        fi
+        if [ -z "$(ls -A ${PXCDIR}/sbom 2>/dev/null)" ]; then
+            echo "ERROR: --sbom=1 but no SBOM was produced for the source tarball"
+            exit 1
+        fi
+    fi
+    #
     tar --owner=0 --group=0 --exclude=.bzr --exclude=.git -czf ${PXCDIR}.tar.gz ${PXCDIR}
     rm -fr ${PXCDIR}
     cat pxc-9x.properties
@@ -829,10 +865,14 @@ build_rpm(){
     if [ "${ENABLE_PGO}" = "0" ]; then
         PGO_DEFINE="--define \"without_pgo 1\""
     fi
+    SBOM_DEFINE=""
+    if [ "${SBOM}" = "1" ]; then
+        SBOM_DEFINE="--define \"with_sbom 1\""
+    fi
     if [ ${ARCH} = x86_64 ]; then
-        rpmbuild --define '"_topdir ${WORKDIR}/rpmbuild"' --define '"dist ${OS_NAME}"' --define '"rpm_version $MYSQL_RELEASE.$RPM_RELEASE"' --define '"rel $RPM_RELEASE"' --define '"galera_revision ${GALERA_REVNO}"' --define '"with_mecab ${MECAB_INSTALL_DIR}/usr"' ${PGO_DEFINE} --rebuild rpmbuild/SRPMS/${SRCRPM}
+        rpmbuild --define '"_topdir ${WORKDIR}/rpmbuild"' --define '"dist ${OS_NAME}"' --define '"rpm_version $MYSQL_RELEASE.$RPM_RELEASE"' --define '"rel $RPM_RELEASE"' --define '"galera_revision ${GALERA_REVNO}"' --define '"with_mecab ${MECAB_INSTALL_DIR}/usr"' ${PGO_DEFINE} ${SBOM_DEFINE} --rebuild rpmbuild/SRPMS/${SRCRPM}
     else
-        rpmbuild --define '"_topdir ${WORKDIR}/rpmbuild"' --define '"dist ${OS_NAME}"' --define '"rpm_version $MYSQL_RELEASE.$RPM_RELEASE"' --define '"rel $RPM_RELEASE"' --define '"galera_revision ${GALERA_REVNO}"' --define '"with_tokudb 0"' --define '"with_rocksdb 0"' --define '"with_mecab ${MECAB_INSTALL_DIR}/usr"' ${PGO_DEFINE} --rebuild rpmbuild/SRPMS/${SRCRPM}
+        rpmbuild --define '"_topdir ${WORKDIR}/rpmbuild"' --define '"dist ${OS_NAME}"' --define '"rpm_version $MYSQL_RELEASE.$RPM_RELEASE"' --define '"rel $RPM_RELEASE"' --define '"galera_revision ${GALERA_REVNO}"' --define '"with_tokudb 0"' --define '"with_rocksdb 0"' --define '"with_mecab ${MECAB_INSTALL_DIR}/usr"' ${PGO_DEFINE} ${SBOM_DEFINE} --rebuild rpmbuild/SRPMS/${SRCRPM}
     fi
     return_code=$?
     if [ $return_code != 0 ]; then
@@ -1029,7 +1069,16 @@ build_deb(){
     if [ "${ENABLE_PGO}" = "0" ]; then
         export DEB_NO_PGO=1
     fi
-    GALERA_REVNO="${GALERA_REVNO}" SCONS_ARGS=' strict_build_flags=0'  MAKE_JFLAG=-j4  dpkg-buildpackage -rfakeroot -uc -us -b
+    if [ "${SBOM}" = "1" ]; then
+        DEB_BUILD_PROFILES="${DEB_BUILD_PROFILES:+${DEB_BUILD_PROFILES} }pkg.pxc.sbom" \
+            GALERA_REVNO="${GALERA_REVNO}" SCONS_ARGS=' strict_build_flags=0'  MAKE_JFLAG=-j4  dpkg-buildpackage -rfakeroot -uc -us -b
+    else
+        GALERA_REVNO="${GALERA_REVNO}" SCONS_ARGS=' strict_build_flags=0'  MAKE_JFLAG=-j4  dpkg-buildpackage -rfakeroot -uc -us -b
+    fi
+    if [ $? != 0 ]; then
+        echo "ERROR: dpkg-buildpackage failed"
+        exit 1
+    fi
     #
     cd ${WORKSPACE} || exit
     rm -fv *.dsc *.orig.tar.gz *.debian.tar.gz *.changes
@@ -1215,10 +1264,26 @@ build_tarball(){
     mkdir -p ${WORKDIR}/${DIRNAME}
     mkdir -p ${CURDIR}/${DIRNAME}
     rm -f $BUILD_NUMBER/percona-xtrabackup* || true
+    if [ -z "$(ls -A $BUILD_NUMBER/*.tar.gz 2>/dev/null)" ]; then
+        echo "ERROR: build-binary.sh produced no tarballs"
+        exit 1
+    fi
     cp  $BUILD_NUMBER/*.tar.gz ${WORKDIR}/../${DIRNAME}
     cp  $BUILD_NUMBER/*.tar.gz ${WORKDIR}/${DIRNAME}
     cp  $BUILD_NUMBER/*.tar.gz ${CURDIR}/${DIRNAME}
 
+    if [ ${SBOM} = 1 ]; then
+        mkdir -p ${WORKDIR}/sbom
+        mkdir -p ${CURDIR}/sbom
+        if [ -n "$(ls -A $BUILD_NUMBER/sbom 2>/dev/null)" ]; then
+            cp $BUILD_NUMBER/sbom/* ${WORKDIR}/sbom/
+            cp $BUILD_NUMBER/sbom/* ${CURDIR}/sbom/
+        else
+            echo "ERROR: --sbom=1 but build-binary.sh produced no SBOMs"
+            exit 1
+        fi
+    fi
+
 }
 
 #main
@@ -1253,7 +1318,9 @@ MYSQL_RELEASE=1
 WSREP_VERSION=31.33
 PRODUCT_FULL=Percona-XtraDB-Cluster-9.1.0-31.33
 BOOST_PACKAGE_NAME=boost_1_59_0
+SBOM=0
 parse_arguments PICK-ARGS-FROM-ARGV "$@"
+export SBOM
 
 check_workdir
 get_system