Skip to content

Commit aac30ce

Browse files
yogeshhegdeyogeshhegde
committed
feat(linux): Add how to guide for working with SBOMs
Add How to guide for working with SBOM's with sections * Generating SBOM in SPDX and CycloneDX format * Tools and references for Working with SBOM i.e visualizing, merging, modifying SBOMs Signed-off-by: Yogesh Hegde <y-hegde@ti.com>
1 parent 28e24cc commit aac30ce

5 files changed

Lines changed: 114 additions & 0 deletions

File tree

‎configs/AM62LX/AM62LX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ linux/How_to_Guides/Target/How_To_Enable_M2CC3301_in_linux
127127
linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
128128
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
129129
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
130+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
130131
linux/How_to_Guides_Hardware_Setup_with_CCS
131132
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62Lx_EVM_Hardware_Setup
132133
linux/Demo_User_Guides/index_Demos

‎configs/AM62PX/AM62PX_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
172172
linux/How_to_Guides/Target/How_to_Tune_Real_Time_Linux
173173
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
174174
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
175+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
175176
linux/How_to_Guides_Hardware_Setup_with_CCS
176177
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62Px_EVM_Hardware_Setup
177178
linux/How_to_Guides/Target/How_To_Carve_Out_CMA

‎configs/AM62X/AM62X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,7 @@ linux/How_to_Guides/Target/Runtime_debug_unlock_on_secure_device
176176
linux/How_to_Guides/Target/How_to_Tune_Real_Time_Linux
177177
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
178178
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
179+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
179180
linux/How_to_Guides_Hardware_Setup_with_CCS
180181
linux/How_to_Guides/Hardware_Setup_with_CCS/AM62x_EVM_Hardware_Setup
181182

‎configs/AM64X/AM64X_linux_toc.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ linux/How_to_Guides/Hardware_Setup_with_CCS/AM64x_EVM_Hardware_Setup
153153
linux/How_to_Guides/FAQ/How_to_Verify_Ipc_Linux_R5
154154
linux/How_to_Guides/FAQ/How_to_Check_Device_Tree_Info
155155
linux/How_to_Guides/FAQ/How_to_Integrate_Open_Source_Software
156+
linux/How_to_Guides/FAQ/How_to_work_with_SBOM
156157
linux/How_to_Guides/Target/Processor_SDK_Linux_File_System_Optimization_Customization
157158

158159
devices/AM64X/index_RTOS

‎source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
***************************************************************
2+
How to Guide for working with Software Bill of Materials (SBOM)
3+
***************************************************************
4+
5+
Generating an Software Bill of Materials (SBOM)
6+
===============================================
7+
8+
|__SDK_FULL_NAME__| generates SBOMs in the following formats and versions:
9+
.. list-table::
10+
:header-rows: 1
11+
:widths: 50 50
12+
13+
* - Format
14+
- Version
15+
* - SPDX
16+
- 3.0
17+
* - CycloneDX
18+
- 1.6
19+
20+
Follow the steps below based on your required format.
21+
22+
Generating an SBOM in SPDX 3.0 Format
23+
-------------------------------------
24+
25+
SPDX 3.0 is generated by default when building Yocto no extra steps required.
26+
If you require additional vulnerability information, follow these steps:
27+
28+
1. Add the following line to your ``local.conf``:
29+
30+
.. code-block:: text
31+
32+
INHERIT += "vex"
33+
34+
2. Build Yocto as per the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`.
35+
36+
The following artifacts will be generated in the Yocto deploy directory:
37+
38+
.. list-table::
39+
:header-rows: 1
40+
:widths: 50 50
41+
42+
* - File
43+
- Description
44+
* - ``${IMAGE_NAME}.rootfs.spdx.json``
45+
- The SPDX v3.0 SBOM file
46+
* - ``${IMAGE_NAME}.rootfs.json``
47+
- Vulnerability information file generated by ``vex.bbclass``
48+
49+
50+
Generating an SBOM in CycloneDX Format
51+
--------------------------------------
52+
53+
To generate an SBOM in CycloneDX format, follow these steps:
54+
55+
1. Start with the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`
56+
2. After cloning ``oe-layersetup``, uncomment the ``meta-cyclonedx`` line in
57+
the layer configuration file, for example:
58+
59+
.. code-block:: text
60+
61+
meta-cyclonedx,https://github.com/iris-GmbH/meta-cyclonedx.git,main,0170751b487162f8e476fd32d441ddfcf24ca78a,layers=
62+
63+
3. Add the following line to your ``local.conf``:
64+
65+
.. code-block:: text
66+
67+
INHERIT += "cyclonedx-export"
68+
69+
4. Continue to build Yocto as per the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`.
70+
71+
The following artifacts will be generated in the Yocto deploy directory:
72+
73+
.. list-table::
74+
:header-rows: 1
75+
:widths: 50 50
76+
77+
* - File
78+
- Description
79+
* - ``${IMAGE_NAME}.rootfs.cyclonedx.bom.json``
80+
- The CycloneDX SBOM file
81+
* - ``${IMAGE_NAME}.rootfs.cyclonedx.vex.json``
82+
- The CycloneDX VEX file
83+
84+
Working with Software Bill of Materials (SBOM)
85+
==============================================
86+
87+
It is recommended to use open-source tools for working with SBOMs.
88+
The following open-source tools are recommended for working with SBOMs:
89+
90+
.. list-table::
91+
:header-rows: 1
92+
:widths: 20 40 40
93+
94+
* - Format
95+
- Tool
96+
- Description
97+
* - CycloneDX
98+
- `CycloneDX Sunshine <https://github.com/CycloneDX/Sunshine/>`_
99+
- Visualize CycloneDX SBOMs in a human-readable format
100+
* - CycloneDX
101+
- `CycloneDX CLI <https://github.com/CycloneDX/cyclonedx-cli>`_
102+
- BOM analysis, modification, diffing, merging, format conversion, signing and verification.
103+
* - SPDX
104+
- `SPDX Open Source Tools <https://spdx.dev/tools/open-source-tools/>`_
105+
- A collection of open-source tools for working with SPDX SBOMs
106+
107+
.. note::
108+
109+
SPDX 3.0 is not yet widely supported by SPDX tools. Using such tools with
110+
SPDX 3.0 files may give varied or unexpected results.

0 commit comments

Comments
 (0)