Software Bill of Materials and Supply Chain with the Yocto Project
Talkat Embedded Linux Conference @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 16:55· Griffin Hall (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Yocto produces machine‑authored SPDX SBOMs as spdx.json by adding inherit create_spdx and running bitbake so images, native tools, cross compilers and even the Linux kernel get per‑package documents bundled into a compressed tarball plus an index. Debug info traces static libraries back to original recipes. A buildtools-tarball-extended lets SBOMs and traceability reach host tools. Reproducibility testing runs across about 11,000 packages on multiple distros with diffoscope output for failures. Rust and Go crate harvesting remain under construction.
AI-written summary · about
chapters (23)
- 0:00Start
- 1:27Brief Outline
- 2:36The Open Embedded Build Flow
- 4:22Oci Compliant Container Images
- 5:22Extensible Sdk
- 6:32Native Tools
- 9:52Software Bill of Materials
- 10:07Ingredient Labels
- 12:23Build Time Dependencies
- 12:49Cve Tracking
- 15:31What Features Do We Have in the Spdx
- 16:35Package File Generated from Using the Debug Data
- 17:52What Can We Generate Spdx for
- 18:31Target Images
- 21:45Spdx File
- 22:39Json Index
- 25:37External Document Reference Relationships
- 26:44Runtime Documents
- 27:34Runtime Dependencies
- 29:52Reproducible Builds
- 31:41Ensuring that Builds Are Reproducible
- 33:39Build Tools Tarball
- 39:06Translate the Json to Spreadsheets
related talks
32mSoftware Supply Chain with the Yocto Project
29mAuto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
34mSo, SBOMs Matter…Now What?
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
27mSBOM: The Rest Of the Story
39mBoF: The Yocto Project and OpenEmbedded