MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 12:59:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

sbom.rst: how to disable SPDX generation

Browse Source 
Generating SPDX is enabled by default in poky but
it can take a lot of build time resources so document
how to disable it.

(From yocto-docs rev: bcd58b7a9455fbb0ea5944089d663e327f0eb38f)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Mikko Rapeli 2025-03-10 17:31:08 +02:00 committed by Richard Purdie
parent e216e39c7e
commit dd3507f6d3
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
documentation/dev-manual/sbom.rst
View File

@ -24,12 +24,20 @@ users can read in standardized format.
:term:`SBOM` information is also critical to performing vulnerability exposure
assessments, as all the components used in the Software Supply Chain are listed.
The OpenEmbedded build system doesn't generate such information by default.
To make this happen, you must inherit the
:ref:`ref-classes-create-spdx` class from a configuration file::
The OpenEmbedded build system doesn't generate such information by default,
though the `:term:`Poky` reference distribution has it enabled out of the box.
To enable it, inherit the :ref:`ref-classes-create-spdx` class from a
configuration file::
INHERIT += "create-spdx"
In the `:term:`Poky` reference distribution, :term:`SPDX` generation does
consume some build time resources and thus if needed it can be disabled from a
:term:`configuration file`::
INHERIT:remove = "create-spdx"
Upon building an image, you will then get:
- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in