summaryrefslogtreecommitdiffstats
path: root/documentation/dev-manual/sbom.rst
diff options
context:
space:
mode:
Diffstat (limited to 'documentation/dev-manual/sbom.rst')
-rw-r--r--documentation/dev-manual/sbom.rst14
1 files changed, 11 insertions, 3 deletions
diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst
index b72bad1554..e6806ce929 100644
--- a/documentation/dev-manual/sbom.rst
+++ b/documentation/dev-manual/sbom.rst
@@ -24,12 +24,20 @@ users can read in standardized format.
24:term:`SBOM` information is also critical to performing vulnerability exposure 24:term:`SBOM` information is also critical to performing vulnerability exposure
25assessments, as all the components used in the Software Supply Chain are listed. 25assessments, as all the components used in the Software Supply Chain are listed.
26 26
27The OpenEmbedded build system doesn't generate such information by default. 27The OpenEmbedded build system doesn't generate such information by default,
28To make this happen, you must inherit the 28though the :term:`Poky` reference distribution has it enabled out of the box.
29:ref:`ref-classes-create-spdx` class from a configuration file:: 29
30To enable it, inherit the :ref:`ref-classes-create-spdx` class from a
31configuration file::
30 32
31 INHERIT += "create-spdx" 33 INHERIT += "create-spdx"
32 34
35In the :term:`Poky` reference distribution, :term:`SPDX` generation does
36consume some build time resources and thus if needed it can be disabled from a
37:term:`configuration file`::
38
39 INHERIT:remove = "create-spdx"
40
33Upon building an image, you will then get: 41Upon building an image, you will then get:
34 42
35- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in 43- :term:`SPDX` output in JSON format as an ``IMAGE-MACHINE.spdx.json`` file in