diff options
| -rw-r--r-- | documentation/dev-manual/sbom.rst | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst index 7c4b5804fb..9157cbba5d 100644 --- a/documentation/dev-manual/sbom.rst +++ b/documentation/dev-manual/sbom.rst | |||
| @@ -24,11 +24,12 @@ users can read in standardized format. | |||
| 24 | :term:`SBOM` information is also critical to performing vulnerability exposure | 24 | :term:`SBOM` information is also critical to performing vulnerability exposure |
| 25 | assessments, as all the components used in the Software Supply Chain are listed. | 25 | assessments, as all the components used in the Software Supply Chain are listed. |
| 26 | 26 | ||
| 27 | The OpenEmbedded build system doesn't generate such information by default. | 27 | The OpenEmbedded build system generates such information by default (by |
| 28 | To make this happen, you must inherit the | 28 | inheriting the :ref:`ref-classes-create-spdx` class in :term:`INHERIT_DISTRO`). |
| 29 | :ref:`ref-classes-create-spdx` class from a configuration file:: | ||
| 30 | 29 | ||
| 31 | INHERIT += "create-spdx" | 30 | If needed, it can be disabled from a :term:`configuration file`:: |
| 31 | |||
| 32 | INHERIT_DISTRO:remove = "create-spdx" | ||
| 32 | 33 | ||
| 33 | Upon building an image, you will then get the compressed archive | 34 | Upon building an image, you will then get the compressed archive |
| 34 | ``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single | 35 | ``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single |