Skip to content

Commit 16bcbfe

Browse files
yogeshhegdeyogeshhegde
committed
feat(linux): Add how to guide for working with SBOMs
Add How to guide for working with SBOM's with sections * Generating SBOM in SPDX and CycloneDX format * Tools and references for Working with SBOM i.e visualizing, merging, modifying SBOMs Signed-off-by: Yogesh Hegde <y-hegde@ti.com>
1 parent 28e24cc commit 16bcbfe

10 files changed

Lines changed: 124 additions & 8 deletions

File tree

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ linux/How_to_Guides/Target/How_To_Enable_M2CC3301_in_linux
127127
linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
128128
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
129129
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
130+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
130131
linux/How_to_Guides_Hardware_Setup_with_CCS
131132
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62Lx_EVM_Hardware_Setup
132133
linux/Demo_User_Guides/index_Demos

‎configs/AM62PX/AM62PX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
172172
linux/How_to_Guides/Target/How_to_Tune_Real_Time_Linux
173173
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
174174
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
175+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
175176
linux/How_to_Guides_Hardware_Setup_with_CCS
176177
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62Px_EVM_Hardware_Setup
177178
linux/How_to_Guides/Target/How_To_Carve_Out_CMA

‎configs/AM62X/AM62X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,7 @@ linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
176176
linux/How_to_Guides/Target/How_to_Tune_Real_Time_Linux
177177
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
178178
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
179+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
179180
linux/How_to_Guides_Hardware_Setup_with_CCS
180181
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62x_EVM_Hardware_Setup
181182

‎configs/AM64X/AM64X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ linux/How_to_Guides/Hardware_Setup_with_CCS/AM64x_EVM_Hardware_Setup
153153
linux/How_to_Guides/FAQ/How_to_Verify_Ipc_Linux_R5
154154
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
155155
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
156+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
156157
linux/How_to_Guides/Target/Processor_SDK_Linux_File_System_Optimization_Customization
157158

158159
devices/AM64X/index_RTOS

‎source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ found on the SDK download page or in the installed directory as indicated below.
4040
Software Bill of Materials (SBOM)
4141
=================================
4242

43-
|SDK_FULL_NAME| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
43+
|__SDK_FULL_NAME__| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
4444
format by default. SBOMs for all released artifacts are bundled into a single
45-
archive and can be found on the |SDK_DOWNLOAD_URL|.
45+
archive and can be found on the |__SDK_DOWNLOAD_URL__|
4646

4747
Release 12.00.00.07.04
4848
======================

‎source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ found on the SDK download page or in the installed directory as indicated below.
4040
Software Bill of Materials (SBOM)
4141
=================================
4242

43-
|SDK_FULL_NAME| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
43+
|__SDK_FULL_NAME__| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
4444
format by default. SBOMs for all released artifacts are bundled into a single
45-
archive and can be found on the |SDK_DOWNLOAD_URL|.
45+
archive and can be found on the |__SDK_DOWNLOAD_URL__|.
4646
Release 12.00.00.07.04
4747
======================
4848

‎source/devices/AM62X/linux/Release_Specific_Release_Notes.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ found on the SDK download page or in the installed directory as indicated below.
3838
Software Bill of Materials (SBOM)
3939
=================================
4040

41-
|SDK_FULL_NAME| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
41+
|__SDK_FULL_NAME__| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
4242
format by default. SBOMs for all released artifacts are bundled into a single
43-
archive and can be found on the |SDK_DOWNLOAD_URL|.
43+
archive and can be found on the |__SDK_DOWNLOAD_URL__|.
4444

4545
Release 12.00.00.07.04
4646
======================

‎source/devices/AM64X/linux/Release_Specific_Release_Notes.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ found on the SDK download page or in the installed directory as indicated below.
3838
Software Bill of Materials (SBOM)
3939
=================================
4040

41-
|SDK_FULL_NAME| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
41+
|__SDK_FULL_NAME__| releases include Software Bill of Materials (SBOM) files in SPDX 3.0
4242
format by default. SBOMs for all released artifacts are bundled into a single
43-
archive and can be found on the |SDK_DOWNLOAD_URL|.
43+
archive and can be found on the |__SDK_DOWNLOAD_URL__|.
4444

4545
Release 12.00.00.07.04
4646
======================

‎source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
***************************************************************
2+
How to Guide for working with Software Bill of Materials (SBOM)
3+
***************************************************************
4+
5+
Generating an Software Bill of Materials (SBOM)
6+
===============================================
7+
8+
|__SDK_FULL_NAME__| generates SBOMs in the following formats and versions:
9+
10+
.. list-table::
11+
:header-rows: 1
12+
:widths: 50 50
13+
14+
* - Format
15+
- Version
16+
* - SPDX
17+
- 3.0
18+
* - CycloneDX
19+
- 1.6
20+
21+
Follow the steps below based on your required format.
22+
23+
Generating an SBOM in SPDX 3.0 Format
24+
-------------------------------------
25+
26+
SPDX 3.0 is generated by default when building Yocto no extra steps required.
27+
If you require additional vulnerability information, follow these steps:
28+
29+
1. Add the following line to your ``local.conf``:
30+
31+
.. code-block:: text
32+
33+
INHERIT += "vex"
34+
35+
2. Build Yocto according to the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`.
36+
37+
The following artifacts will be generated in the Yocto deploy directory:
38+
39+
.. list-table::
40+
:header-rows: 1
41+
:widths: 50 50
42+
43+
* - File
44+
- Description
45+
* - ``${IMAGE_NAME}.rootfs.spdx.json``
46+
- The SPDX v3.0 SBOM file
47+
* - ``${IMAGE_NAME}.rootfs.json``
48+
- Vulnerability information file generated by ``vex.bbclass``
49+
50+
51+
Generating an SBOM in CycloneDX Format
52+
--------------------------------------
53+
54+
To generate an SBOM in CycloneDX format, follow these steps:
55+
56+
1. Start with the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`
57+
2. After cloning ``oe-layersetup``, uncomment the ``meta-cyclonedx`` line in
58+
the layer configuration file, for example:
59+
60+
.. code-block:: text
61+
62+
meta-cyclonedx,https://github.com/iris-GmbH/meta-cyclonedx.git,main,0170751b487162f8e476fd32d441ddfcf24ca78a,layers=
63+
64+
3. Add the following line to your ``local.conf``:
65+
66+
.. code-block:: text
67+
68+
INHERIT += "cyclonedx-export"
69+
70+
4. Continue to build Yocto according to the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`.
71+
72+
The following artifacts will be generated in the Yocto deploy directory:
73+
74+
.. list-table::
75+
:header-rows: 1
76+
:widths: 50 50
77+
78+
* - File
79+
- Description
80+
* - ``${IMAGE_NAME}.rootfs.cyclonedx.bom.json``
81+
- The CycloneDX SBOM file
82+
* - ``${IMAGE_NAME}.rootfs.cyclonedx.vex.json``
83+
- The CycloneDX VEX file
84+
85+
Working with Software Bill of Materials (SBOM)
86+
==============================================
87+
88+
It is recommended to use open-source tools for working with SBOMs.
89+
The following open-source tools are recommended for working with SBOMs:
90+
91+
.. list-table::
92+
:header-rows: 1
93+
:widths: 20 40 40
94+
95+
* - Format
96+
- Tool
97+
- Description
98+
* - CycloneDX
99+
- `CycloneDX Sunshine <https://github.com/CycloneDX/Sunshine/>`_
100+
- Visualize CycloneDX SBOMs in a human-readable format
101+
* - CycloneDX
102+
- `CycloneDX CLI <https://github.com/CycloneDX/cyclonedx-cli>`_
103+
- BOM analysis, modification, diffing, merging, format conversion, signing and verification.
104+
* - SPDX
105+
- `SPDX Open Source Tools <https://spdx.dev/tools/open-source-tools/>`_
106+
- A collection of open-source tools for working with SPDX SBOMs
107+
108+
.. note::
109+
110+
SPDX 3.0 is not yet widely supported by SPDX tools. Using such tools with
111+
SPDX 3.0 files may give varied or unexpected results.

‎source/linux/How_to_Guides_Developer_Notes.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ Developer Notes
3838
How_to_Guides/FAQ/How_to_Configure_MSMC_memory
3939
How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
4040
How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
41+
How_to_Guides/FAQ/How_to_work_with_SBOM
4142
How_to_Guides/Host/How_to_Build_a_Ubuntu_Linux_host_under_VMware
4243
How_to_Guides/Host/K3_Resource_Partitioning_Tool
4344
How_to_Guides/Host/How_to_Setup_and_Debug_using_Lauterbach

0 commit comments

Comments
 (0)