coin: CMake: Add instructions to generate JSON and verify the SBOMHEADdev

If the VerifySBOM feature is enabled, pass additional options to
CMake configuration:
- runs syntactic verification of the SBOM
- so it converts the generated SBOM files into JSON files (and
  installs them). This does additional useful validations.
- runs the NTIA SBOM verifier
- shows some of the content in the SBOM in a more user-friendly table
  format via the sbom2doc python app
- runs sbomaudit to show things like packages without a license
  expression, doesn't exit with errors if issues are found.

To ensure the tables are wide enough in the log on the CI, we set
an explicit value for COLUMNS env var, which is used by sbom2doc
to determine the table size.

To ensure the sbom2doc and sbomaudit python applications are found,
we supply additional locations where they can be found, via the
env vars that coin python provisioning sets.

We also make sure to pass the found application paths when executing
the python apps, because they might not be in PATH by default.

Pick-to: 6.8
Task-number: QTBUG-122899
Change-Id: I0baef8b9c949209b15ab304e1e840b4dcdf5a61c
Reviewed-by: Toni Saario <toni.saario@qt.io>
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>

0 files changed, 0 insertions, 0 deletions