English is currently available.
Embedded Linux DISCUSSION
A Yocto build can generate a software bill of materials, but how can that document remain useful after image customization and field updates? Which identity should connect the component inventory to what is actually deployed?
Reference: Yocto Project: creating a software bill of materials (https://docs.yoctoproject.org/dev-manual/sbom.html).
Associate the inventory with the exact image build, machine configuration and release artifact. Preserve source revisions and build metadata alongside a cryptographic hash of the shipped image. A document from a similar development build may describe a different package set.
Check the SBOM capabilities and options in the Yocto release being used. The documentation describes SPDX output and optional details, but development documentation can differ from a stable branch. Confirm what the generated inventory includes instead of assuming every external binary is automatically represented.
Account for software added after the image build and for field-update changes. Use the inventory to support component and vulnerability analysis, while separately determining whether a reported issue affects the deployed configuration. The presence of an SBOM is evidence of an inventory process, not proof that an image has no vulnerabilities.
Back to Embedded Linux community
