MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 12:59:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

dev-manual/sbom.rst: fix wrong build outputs

Browse Source 
This document was written with SPDX 3.0 in mind (create-spdx-3.0 class)
on OE-Core's master, but Kirkstone only supports SPDX 2.2 (named simply
create-spdx).

The create-spdx class only generate a tar.zst output, so remove the
other outputs listed here.

Also, ancillary outputs are not only deployed in tmp/deploy/spdx/MACHINE
but tmp/deploy/spdx in general.

(From yocto-docs rev: 25b5ec4c71c97228f8386f5b6c4fbe272c207ed6)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Antonin Godard 2025-03-27 15:22:13 +01:00 committed by Steve Sakoman
parent c6cd61f1a2
commit ce1cefc347
1 changed files with 4 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
documentation/dev-manual/sbom.rst
View File

@ -30,16 +30,9 @@ To make this happen, you must inherit the
INHERIT += "create-spdx"
Upon building an image, you will then get:
- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in
``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`.
- This toplevel file is accompanied by an ``IMAGE-MACHINE.spdx.index.json``
containing an index of JSON :term:`SPDX` files for individual recipes.
- The compressed archive ``IMAGE-MACHINE.spdx.tar.zst`` contains the index
and the files for the single recipes.
Upon building an image, you will then get the compressed archive
``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single
recipes.
The :ref:`ref-classes-create-spdx` class offers options to include
more information in the output :term:`SPDX` data:
@ -56,7 +49,7 @@ more information in the output :term:`SPDX` data:
Though the toplevel :term:`SPDX` output is available in
``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary
generated files are available in ``tmp/deploy/spdx/MACHINE`` too, such as:
generated files are available in ``tmp/deploy/spdx`` too, such as:
- The individual :term:`SPDX` JSON files in the ``IMAGE-MACHINE.spdx.tar.zst``
archive.