mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-03 13:49:49 +00:00
Code Issues Projects Releases Wiki Activity

backport SPDX documentation and vulnerability improvements

Browse Source 
(From yocto-docs rev: c87d0388caba56490c32e27911b10c926ca02ea9)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Michael Opdenacker
2022-11-24 19:04:56 +01:00
committed by Richard Purdie
parent 658a991de2
commit 2253020842
4 changed files with 330 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/ref-manual/terms.rst
+28
View File
@@ -323,6 +323,23 @@ universal, the list includes them just in case:
:term:`build host<Build Host>` and other components, that can
work on specific hardware.
:term:`SBOM`
This term means *Software Bill of Materials*. When you distribute
software, it offers a description of all the components you used,
their corresponding licenses, their dependencies, the changes that were
applied and the known vulnerabilities that were fixed.
This can be used by the recipients of the software to assess
their exposure to license compliance and security vulnerability issues.
See the :wikipedia:`Software Supply Chain <Software_supply_chain>`
article on Wikipedia for more details.
The OpenEmbedded Build System can generate such documentation for your
project, in :term:`SPDX` format, based on all the metadata it used to
build the software images. See the ":ref:`dev-manual/common-tasks:creating
a software bill of materials`" section of the Development Tasks manual.
:term:`Source Directory`
This term refers to the directory structure
created as a result of creating a local copy of the ``poky`` Git
@@ -383,6 +400,17 @@ universal, the list includes them just in case:
":ref:`overview-manual/development-environment:repositories, tags, and branches`"
section in the Yocto Project Overview and Concepts Manual.
:term:`SPDX`
This term means *Software Package Data Exchange*, and is used as a open
standard for providing a *Software Bill of Materials* (:term:`SBOM`).
This standard is developed through a `Linux Foundation project
<https://spdx.dev/>`__ and is used by the OpenEmbedded Build System to
provide an :term:`SBOM` associated to each a software image.
For details, see Wikipedia's :wikipedia:`SPDX page <Software_Package_Data_Exchange>`
and the ":ref:`dev-manual/common-tasks:creating a software bill of materials`"
section of the Development Tasks manual.
:term:`Sysroot`
When cross-compiling, the target file system may be differently laid
out and contain different things compared to the host system. The concept
documentation/ref-manual/variables.rst
+94
View File
@@ -1508,6 +1508,18 @@ system and gives an overview of their function and contents.
CVE_PRODUCT = "vendor:package"
:term:`CVE_VERSION`
In a recipe, defines the version used to match the recipe version
against the version in the `NIST CVE database <https://nvd.nist.gov/>`__
when usign :ref:`cve-check <ref-classes-cve-check>`.
The default is ${:term:`PV`} but if recipes use custom version numbers
which do not map to upstream software component release versions and the versions
used in the CVE database, then this variable can be used to set the
version number for :ref:`cve-check <ref-classes-cve-check>`. Example::
CVE_VERSION = "2.39"
:term:`CVSDIR`
The directory in which files checked out under the CVS system are
stored.
@@ -7278,6 +7290,88 @@ system and gives an overview of their function and contents.
You can specify only a single URL in :term:`SOURCE_MIRROR_URL`.
:term:`SPDX_ARCHIVE_PACKAGED`
This option allows to add to :term:`SPDX` output compressed archives
of the files in the generated target packages.
Such archives are available in
``tmp/deploy/spdx/MACHINE/packages/packagename.tar.zst``
under the :term:`Build Directory`.
Enable this option as follows::
SPDX_ARCHIVE_PACKAGED = "1"
According to our tests on release 4.1 "langdale", building
``core-image-minimal`` for the ``qemux86-64`` machine, enabling this
option multiplied the size of the ``tmp/deploy/spdx`` directory by a
factor of 13 (+1.6 GiB for this image), compared to just using the
:ref:`create-spdx <ref-classes-create-spdx>` class with no option.
Note that this option doesn't increase the size of :term:`SPDX`
files in ``tmp/deploy/images/MACHINE``.
:term:`SPDX_ARCHIVE_SOURCES`
This option allows to add to :term:`SPDX` output compressed archives
of the sources for packages installed on the target. It currently
only works when :term:`SPDX_INCLUDE_SOURCES` is set.
This is one way of fulfilling "source code access" license
requirements.
Such source archives are available in
``tmp/deploy/spdx/MACHINE/recipes/recipe-packagename.tar.zst``
under the :term:`Build Directory`.
Enable this option as follows::
SPDX_INCLUDE_SOURCES = "1"
SPDX_ARCHIVE_SOURCES = "1"
According to our tests on release 4.1 "langdale", building
``core-image-minimal`` for the ``qemux86-64`` machine, enabling
these options multiplied the size of the ``tmp/deploy/spdx``
directory by a factor of 11 (+1.4 GiB for this image),
compared to just using the :ref:`create-spdx <ref-classes-create-spdx>`
class with no option.
Note that using this option only marginally increases the size
of the :term:`SPDX` output in ``tmp/deploy/images/MACHINE/``
(+ 0.07\% with the tested image), compared to just enabling
:term:`SPDX_INCLUDE_SOURCES`.
:term:`SPDX_INCLUDE_SOURCES`
This option allows to add a description of the source files used to build
the host tools and the target packages, to the ``spdx.json`` files in
``tmp/deploy/spdx/MACHINE/recipes/`` under the :term:`Build Directory`.
As a consequence, the ``spdx.json`` files under the ``by-namespace`` and
``packages`` subdirectories in ``tmp/deploy/spdx/MACHINE`` are also
modified to include references to such source file descriptions.
Enable this option as follows::
SPDX_INCLUDE_SOURCES = "1"
According to our tests on release 4.1 "langdale", building
``core-image-minimal`` for the ``qemux86-64`` machine, enabling
this option multiplied the total size of the ``tmp/deploy/spdx``
directory by a factor of 3 (+291 MiB for this image),
and the size of the ``IMAGE-MACHINE.spdx.tar.zst`` in
``tmp/deploy/images/MACHINE`` by a factor of 130 (+15 MiB for this
image), compared to just using the
:ref:`create-spdx <ref-classes-create-spdx>` class with no option.
:term:`SPDX_PRETTY`
This option makes the SPDX output more human-readable, using
identation and newlines, instead of the default output in a
single line::
SPDX_PRETTY = "1"
The generated SPDX files are approximately 20% bigger, but
this option is recommended if you want to inspect the SPDX
output files with a text editor.
:term:`SPDXLICENSEMAP`
Maps commonly used license names to their SPDX counterparts found in
``meta/files/common-licenses/``. For the default :term:`SPDXLICENSEMAP`