summaryrefslogtreecommitdiffstats
path: root/documentation/dev-manual
diff options
context:
space:
mode:
Diffstat (limited to 'documentation/dev-manual')
-rw-r--r--documentation/dev-manual/sbom.rst40
1 files changed, 24 insertions, 16 deletions
diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst
index f51d08f84d..b72bad1554 100644
--- a/documentation/dev-manual/sbom.rst
+++ b/documentation/dev-manual/sbom.rst
@@ -30,22 +30,29 @@ To make this happen, you must inherit the
30 30
31 INHERIT += "create-spdx" 31 INHERIT += "create-spdx"
32 32
33You then get :term:`SPDX` output in JSON format as an 33Upon building an image, you will then get:
34``IMAGE-MACHINE.spdx.json`` file in ``tmp/deploy/images/MACHINE/`` inside the
35:term:`Build Directory`.
36 34
37This is a toplevel file accompanied by an ``IMAGE-MACHINE.spdx.index.json`` 35- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in
38containing an index of JSON :term:`SPDX` files for individual recipes, together 36 ``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`.
39with an ``IMAGE-MACHINE.spdx.tar.zst`` compressed archive containing all such 37
40files. 38- This toplevel file is accompanied by an ``IMAGE-MACHINE.spdx.index.json``
39 containing an index of JSON :term:`SPDX` files for individual recipes.
40
41- The compressed archive ``IMAGE-MACHINE.spdx.tar.zst`` contains the index
42 and the files for the single recipes.
41 43
42The :ref:`ref-classes-create-spdx` class offers options to include 44The :ref:`ref-classes-create-spdx` class offers options to include
43more information in the output :term:`SPDX` data, such as making the generated 45more information in the output :term:`SPDX` data:
44files more human readable (:term:`SPDX_PRETTY`), adding compressed archives of 46
45the files in the generated target packages (:term:`SPDX_ARCHIVE_PACKAGED`), 47- Make the json files more human readable by setting (:term:`SPDX_PRETTY`).
46adding a description of the source files used to generate host tools and target 48
47packages (:term:`SPDX_INCLUDE_SOURCES`) and adding archives of these source 49- Add compressed archives of the files in the generated target packages by
48files themselves (:term:`SPDX_ARCHIVE_SOURCES`). 50 setting (:term:`SPDX_ARCHIVE_PACKAGED`).
51
52- Add a description of the source files used to generate host tools and target
53 packages (:term:`SPDX_INCLUDE_SOURCES`)
54
55- Add archives of these source files themselves (:term:`SPDX_ARCHIVE_SOURCES`).
49 56
50Though the toplevel :term:`SPDX` output is available in 57Though the toplevel :term:`SPDX` output is available in
51``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary 58``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary
@@ -65,11 +72,12 @@ generated files are available in ``tmp/deploy/spdx/MACHINE`` too, such as:
65 72
66See also the :term:`SPDX_CUSTOM_ANNOTATION_VARS` variable which allows 73See also the :term:`SPDX_CUSTOM_ANNOTATION_VARS` variable which allows
67to associate custom notes to a recipe. 74to associate custom notes to a recipe.
68
69See the `tools page <https://spdx.dev/resources/tools/>`__ on the :term:`SPDX` 75See the `tools page <https://spdx.dev/resources/tools/>`__ on the :term:`SPDX`
70project website for a list of tools to consume and transform the :term:`SPDX` 76project website for a list of tools to consume and transform the :term:`SPDX`
71data generated by the OpenEmbedded build system. 77data generated by the OpenEmbedded build system.
72 78
73See also Joshua Watt's 79See also Joshua Watt's presentations
74`Automated SBoM generation with OpenEmbedded and the Yocto Project <https://youtu.be/Q5UQUM6zxVU>`__ 80`Automated SBoM generation with OpenEmbedded and the Yocto Project <https://youtu.be/Q5UQUM6zxVU>`__
75presentation at FOSDEM 2023. 81at FOSDEM 2023 and
82`SPDX in the Yocto Project <https://fosdem.org/2024/schedule/event/fosdem-2024-3318-spdx-in-the-yocto-project/>`__
83at FOSDEM 2024.