mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-19 00:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

dev-manual/sbom.rst: refresh for SPDX3

Browse Source 
SPDX3 support was backported to scarthgap with 9c9b9545049a ("backport:
SPDX 3.0 fixes and tasks from upstream version Walnascar") in OE-Core,
but the Scarthgap documentation doesn't reflect it. Update the
documentation to show how to enable and remove SPDX2 statements.

(From yocto-docs rev: 365377da1b810c456f1d966ae8ffeed1cd534c10)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Antonin Godard
2026-07-30 11:34:52 +02:00
committed by Paul Barker
parent 077627338a
commit c72ed1013c
1 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
documentation/dev-manual/sbom.rst
View File

@@ -31,9 +31,18 @@ If needed, it can be disabled from a :term:`configuration file`::
INHERIT_DISTRO:remove = "create-spdx"
SPDX version 3 support is available on Yocto &DISTRO_NAME;, but disabled by
default. To enable it, add the following statements from a :term:`configuration
file`::
INHERIT_DISTRO:remove = "create-spdx"
INHERIT_DISTRO:append = " create-spdx-3.0"
The following documentation will make the assumption that SPDX3 is used.
Upon building an image, you will then get the compressed archive
``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single
recipes.
``IMAGE-MACHINE.spdx.json`` file in ``tmp/deploy/images/MACHINE/`` inside
the :term:`Build Directory`.
The :ref:`ref-classes-create-spdx` class offers options to include
more information in the output :term:`SPDX` data:
@@ -50,19 +59,7 @@ more information in the output :term:`SPDX` data:
Though the toplevel :term:`SPDX` output is available in
``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary
generated files are available in ``tmp/deploy/spdx`` too, such as:
- The individual :term:`SPDX` JSON files in the ``IMAGE-MACHINE.spdx.tar.zst``
archive.
- Compressed archives of the files in the generated target packages,
in ``packages/packagename.tar.zst`` (when :term:`SPDX_ARCHIVE_PACKAGED`
is set).
- Compressed archives of the source files used to build the host tools
and the target packages in ``recipes/recipe-packagename.tar.zst``
(when :term:`SPDX_ARCHIVE_SOURCES` is set). Those are needed to fulfill
"source code access" license requirements.
generated files are available in ``tmp/deploy/spdx`` too.
See also the :term:`SPDX_CUSTOM_ANNOTATION_VARS` variable which allows
to associate custom notes to a recipe.