.. _os-sbom:

#################################
Software Bill of Materials (SBOM)
#################################

Generated SBOM
==============

The SBOM is generated automatically by Yocto. SPDX JSON files can be found under:

``build/tmp/deploy/spdx/<spdx_version>/<MACHINE>``

There is no single unified SBOM for all targets and images; the output varies depending on the Yocto configuration, the selected machine, and the selected image.

.. note::

   There is a simple tool ``spdx2rst.py`` which can be used to quickly gather SBOM into ``.rst`` format.

CVEs from SBOM
==============

CVE checking is disabled by default in Yocto. To enable it, add the following to a kas manifest (for example in ``base.yml`` under ``local_conf_header``):

.. code-block::

   security_and_sbom: |
     SPDX_PRETTY = "1"
     INHERIT += "cve-check"

Then re-run the kas build. Yocto will generate CVE reports and assign severities based on the NVD database.