MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-19 12:59:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

sbom.rst: how to disable SPDX generation

Browse Source 
Generating SPDX is enabled by default in poky but
it can take a lot of build time resources so document
how to disable it.

(From yocto-docs rev: d26a3f2ed8f24e1b72f58ecb8b7cdba7007ba77b)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit bcd58b7a9455fbb0ea5944089d663e327f0eb38f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Mikko Rapeli 2025-03-10 17:31:08 +02:00 committed by Steve Sakoman
parent 81d9f2c877
commit eed3e6c2c8
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
documentation/dev-manual/sbom.rst
View File

@ -24,12 +24,20 @@ users can read in standardized format.
:term:`SBOM` information is also critical to performing vulnerability exposure
assessments, as all the components used in the Software Supply Chain are listed.
The OpenEmbedded build system doesn't generate such information by default.
To make this happen, you must inherit the
:ref:`ref-classes-create-spdx` class from a configuration file::
The OpenEmbedded build system doesn't generate such information by default,
though the `:term:`Poky` reference distribution has it enabled out of the box.
To enable it, inherit the :ref:`ref-classes-create-spdx` class from a
configuration file::
INHERIT += "create-spdx"
In the `:term:`Poky` reference distribution, :term:`SPDX` generation does
consume some build time resources and thus if needed it can be disabled from a
:term:`configuration file`::
INHERIT:remove = "create-spdx"
Upon building an image, you will then get:
- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in