Software Supply Chain with the Yocto Project
summary
Yocto/OpenEmbedded build flow uses BitBake to produce target images, SDKs and a build tools tarball; each recipe generates an SPDX archive and those are merged with links back to source, declared licenses and file lists. Reproducible-build testing runs across 34,000 packages (11,000 target packages) and publishes automatic diffoscope output showing byte-level differences; the presenter shows examples (40 MB SBOMs, a run with 12 nonreproducible packages) and explains CVE scanning and host-tool tracing.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:37Yocto Project and OpenEmbedded
- 2:17Why is the Software Supply Chain Important?
- 3:29Addressing The Supply Chain
- 4:02Build Images from Source Code
- 6:24Simplified Build Flow
- 11:01What is an SBOM?
- 11:48Recipe Metadata
- 13:20SBOM Relationships
- 19:09Enabling SPDX Generation
- 20:09Future Improvements
- 20:53Why do we need reproducible builds?
- 21:30Binary output should associate with recipe hashes
- 22:27Tracing target images back to recipe outputs
- 22:43Reproducibility Testing
- 25:26Extending Quality Assurance Test
- 25:47CVE Tracking from Yocto Project
- 26:06CVE Metrics
- 26:41Buildtools replaces Host tools
- 27:17Using Buildtools to extend the Supply Chain
related talks
41mSoftware Bill of Materials and Supply Chain with the Yocto Project
40mI heart the Yocto Project
40mWhy the Yocto Project for My IoT Project
39mBoF: The Yocto Project and OpenEmbedded
45mBuilding and Maintaining Binary Distributions with Yocto
41mHow to Combine Debian and Yocto/Bitbake?
30mYocto for open source embedded systems development- 39mBoF: The Yocto Project and OpenEmbedded