summaryrefslogtreecommitdiffstats
path: root/documentation/dev-manual/sbom.rst
diff options
context:
space:
mode:
Diffstat (limited to 'documentation/dev-manual/sbom.rst')
-rw-r--r--documentation/dev-manual/sbom.rst9
1 files changed, 5 insertions, 4 deletions
diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst
index f80e81279a..d155b4775f 100644
--- a/documentation/dev-manual/sbom.rst
+++ b/documentation/dev-manual/sbom.rst
@@ -9,7 +9,8 @@ each software component are all identified (see
9fixes are applied (see ":ref:`dev-manual/vulnerabilities:checking 9fixes are applied (see ":ref:`dev-manual/vulnerabilities:checking
10for vulnerabilities`"), the OpenEmbedded build system can generate 10for vulnerabilities`"), the OpenEmbedded build system can generate
11a description of all the components you used, their licenses, their dependencies, 11a description of all the components you used, their licenses, their dependencies,
12the changes that were applied and the known vulnerabilities that were fixed. 12their sources, the changes that were applied to them and the known
13vulnerabilities that were fixed.
13 14
14This description is generated in the form of a *Software Bill of Materials* 15This description is generated in the form of a *Software Bill of Materials*
15(:term:`SBOM`), using the :term:`SPDX` standard. 16(:term:`SBOM`), using the :term:`SPDX` standard.
@@ -42,9 +43,9 @@ The :ref:`create-spdx <ref-classes-create-spdx>` class offers options to include
42more information in the output :term:`SPDX` data, such as making the generated 43more information in the output :term:`SPDX` data, such as making the generated
43files more human readable (:term:`SPDX_PRETTY`), adding compressed archives of 44files more human readable (:term:`SPDX_PRETTY`), adding compressed archives of
44the files in the generated target packages (:term:`SPDX_ARCHIVE_PACKAGED`), 45the files in the generated target packages (:term:`SPDX_ARCHIVE_PACKAGED`),
45adding a description of the source files handled by the target recipes 46adding a description of the source files used to generate host tools and target
46(:term:`SPDX_INCLUDE_SOURCES`) and adding archives of these source files 47packages (:term:`SPDX_INCLUDE_SOURCES`) and adding archives of these source
47themselves (:term:`SPDX_ARCHIVE_SOURCES`). 48files themselves (:term:`SPDX_ARCHIVE_SOURCES`).
48 49
49Though the toplevel :term:`SPDX` output is available in 50Though the toplevel :term:`SPDX` output is available in
50``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary 51``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary