Yocto SBOM Generation

The meta-runsafe-sbom layer generates a CycloneDX v1.6 compatible Software Bill of Materials for a yocto build.

Installation

NOTE: This layer currently requires RunSafe Identify to be setup for the repository generating the SBOM. If you have not setup the RunSafe Platform or do not plan to use the RunSafe Platform, please contact [email protected] for instructions.

1. Download the latest meta-runsafe-sbom layer to the proper directory in your Yocto project, such as the top level of the poky directory.

$ git clone -b master https://gitlab.com/runsafe-foss/meta-runsafe-sbom.git

2. Add the meta-runsafe-sbom layer to your bblayers.conf file.

$ bitbake-layers add-layer meta-runsafe-sbom

SBOM File Location

The SBOM is generated in build/tmp/deploy/runsafe-sbom/target_sbom.cdx.json.

Configuration

The metadata component at the top of the CycloneDX SBOM can be configured by setting the following environment variables:

Veriable	Description
RUNSAFE_SBOM_METADATA_COMPONENT_NAME	Name of the software or firmware being built. Defaults to yocto-image
RUNSAFE_SBOM_METADATA_COMPONENT_VERSION	Version of the software or firmware being built. Defaults to 1.0.0
RUNSAFE_SBOM_METADATA_COMPONENT_SUPPLIER	Name of the supplier. Defaults to Organization: OpenEmbedded ()
RUNSAFE_SBOM_METADATA_COMPONENT_PREVIOUS_VERSION	Previous version of the software or firmware being built

Recipe variables

Per-recipe BitBake variables control how each package appears in the SBOM. Set them in the recipe (.bb) or a .bbappend. Native recipes are skipped and do not appear in the SBOM.

Component identity and CPE

These variables determine each component's name, version, and CPE identifiers used for vulnerability matching.

Variable	Default	Description
CVE_PRODUCT	${BPN}	Product name(s) used for the component name and CPE. Space-separated values create one SBOM component (and CPE) per product. Use vendor:product to set the CPE vendor; otherwise the vendor is *. Example: tiff.bb sets CVE_PRODUCT = "libtiff".
CVE_VERSION	${PV}	Version embedded in each CPE. Defaults to the recipe's package version.
PV	(recipe)	Component version written into the SBOM. Usually identical to CVE_VERSION, but may differ with some recipes.
LICENSE	(recipe)	License recorded on the component. SPDX expressions are stored as CycloneDX license expressions; values containing PD (Public Domain) are stored as a named license.
SPDX_SUPPLIER	Organization: ${SPDX_ORG}	Supplier name written on each collected component.

Example .bbappend overriding product identity for accurate CPE matching:

# recipes-support/curl/curl_%.bbappend
CVE_PRODUCT = "haxx:curl"
CVE_VERSION = "${PV}"
SPDX_SUPPLIER = "Organization: curl"

Multiple products from one recipe:

CVE_PRODUCT = "flex_project:flex westes:flex"

License

This layer is licensed under the MIT license. See LICENSE for more information. The layer was forked and modified from the bgnetworks/meta-dependency-track repo.