mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-19 00:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

dev-manual/sbom.rst: fix wrong build outputs

Browse Source 
This document was written with SPDX 3.0 in mind (create-spdx-3.0 class)
on OE-Core's master, but Scarthgap only supports SPDX 2.2
(create-spdx-2.2).

The create-spdx-2.2 class only generate a tar.zst output, so remove the
other outputs listed here.

Also, ancillary outputs are not only deployed in tmp/deploy/spdx/MACHINE
but tmp/deploy/spdx in general.

(From yocto-docs rev: deedc7395f565e9820d914de9ffc3b14f8b143eb)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Antonin Godard
2025-03-27 15:22:13 +01:00
committed by Steve Sakoman
parent 2a501e4f1b
commit 1f2eca0a8e
1 changed files with 4 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
documentation/dev-manual/sbom.rst
View File

@@ -30,16 +30,9 @@ To make this happen, you must inherit the
INHERIT += "create-spdx" INHERIT += "create-spdx"
Upon building an image, you will then get: Upon building an image, you will then get the compressed archive
``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single
- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in recipes.
``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`.
- This toplevel file is accompanied by an ``IMAGE-MACHINE.spdx.index.json``
containing an index of JSON :term:`SPDX` files for individual recipes.
- The compressed archive ``IMAGE-MACHINE.spdx.tar.zst`` contains the index
and the files for the single recipes.
The :ref:`ref-classes-create-spdx` class offers options to include The :ref:`ref-classes-create-spdx` class offers options to include
more information in the output :term:`SPDX` data: more information in the output :term:`SPDX` data:
@@ -56,7 +49,7 @@ more information in the output :term:`SPDX` data:
Though the toplevel :term:`SPDX` output is available in Though the toplevel :term:`SPDX` output is available in
``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary ``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary
generated files are available in ``tmp/deploy/spdx/MACHINE`` too, such as: generated files are available in ``tmp/deploy/spdx`` too, such as:
- The individual :term:`SPDX` JSON files in the ``IMAGE-MACHINE.spdx.tar.zst`` - The individual :term:`SPDX` JSON files in the ``IMAGE-MACHINE.spdx.tar.zst``
archive. archive.