Software Bill of Materials (SBOM)

Generated SBOM

The SBOM is generated automatically by Yocto. SPDX JSON files can be found under:

build/tmp/deploy/spdx/<spdx_version>/<MACHINE>

There is no single unified SBOM for all targets and images; the output varies depending on the Yocto configuration, the selected machine, and the selected image.

Note

There is a simple tool spdx2rst.py which can be used to quickly gather SBOM into .rst format.

CVEs from SBOM

CVE checking is disabled by default in Yocto. To enable it, add the following to a kas manifest (for example in base.yml under local_conf_header):

security_and_sbom: |
  SPDX_PRETTY = "1"
  INHERIT += "cve-check"

Then re-run the kas build. Yocto will generate CVE reports and assign severities based on the NVD database.