Add SBOM + support multiple machines #11

Merged

schwan merged 4 commits from WIP/l.anderweit@phytec.de/updates into scarthgap

2026-08-18 13:39:19 +02:00

anderweit commented

2026-08-18 13:25:55 +02:00

Member

Build CycloneDX SBOM
Add compiled kernel sources to SPDX SBOM
Include machine name in basename
Mask meta-imx wifi firmware bbappend

Build CycloneDX SBOM Add compiled kernel sources to SPDX SBOM Include machine name in basename Mask meta-imx wifi firmware bbappend

anderweit added 4 commits

2026-08-18 13:25:55 +02:00

conf: layer.conf: Build CycloneDX SBOM bba1642049

Build a CycloneDX SBOM with cyclonedx-export from meta-cyclonedx. Add
the layer to the layer dependencies.

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>

conf: layer.conf: Add compiled kernel sources to SPDX SBOM acb8f83c64

Enable SPDX_INCLUDE_COMPILED_SOURCES to add the name of all compiled
sources to the SPDX SBOM. This will be used to filter out kernel CVEs
that are in files which are not compiled.

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>

recipes-images: phytec-liot-image: Include machine name in basename d5bbc8955c

Include $MACHINE in $IMAGE_BASENAME as a workaround for phyhub which
doesn't accept the same image name for multiple machines.
Also, set IMAGE_MACHINE_SUFFIX empty so the machine name doesn't show up twice
in the final image name

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>

conf: layer.conf: Mask meta-imx wifi firmware bbappend a8c1ff9aa8

meta-freescale adds wifi firmware to PACKAGES that meta-imx adds as
well. This leads to an

<packagename> is listed in PACKAGES multiple times, this leads to
packaging errors

error. Ignore the bbappend in meta-imx.

This is already fixed for imx8mp in meta-phytec.

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>