diff mbox series

[scarthgap,RESEND] dev-manual/sbom.rst: refresh for SPDX3

Message ID 20260730-backport-spdx3-scarthgap-v1-1-b7ffb55a6604@bootlin.com
State New
Headers show
Series [scarthgap,RESEND] dev-manual/sbom.rst: refresh for SPDX3 | expand

Commit Message

Antonin Godard July 30, 2026, 9:34 a.m. UTC 
SPDX3 support was backported to scarthgap with 9c9b9545049a ("backport:
SPDX 3.0 fixes and tasks from upstream version Walnascar") in OE-Core,
but the Scarthgap documentation doesn't reflect it. Update the
documentation to show how to enable and remove SPDX2 statements.

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
---
 documentation/dev-manual/sbom.rst | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)


---
base-commit: 5f708a1bc31ae94dd3513615b0ce079aa7897628
change-id: 20260730-backport-spdx3-scarthgap-97088b9e930a
--
diff mbox series

Patch

diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst
index 9157cbba5..1be4239c7 100644
--- a/documentation/dev-manual/sbom.rst
+++ b/documentation/dev-manual/sbom.rst
@@ -31,9 +31,18 @@  If needed, it can be disabled from a :term:`configuration file`::
 
    INHERIT_DISTRO:remove = "create-spdx"
 
+SPDX version 3 support is available on Yocto &DISTRO_NAME;, but disabled by
+default. To enable it, add the following statements from a :term:`configuration
+file`::
+
+   INHERIT_DISTRO:remove = "create-spdx"
+   INHERIT_DISTRO:append = " create-spdx-3.0"
+
+The following documentation will make the assumption that SPDX3 is used.
+
 Upon building an image, you will then get the compressed archive
-``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single
-recipes.
+``IMAGE-MACHINE.spdx.json`` file in ``tmp/deploy/images/MACHINE/`` inside
+the :term:`Build Directory`.
 
 The :ref:`ref-classes-create-spdx` class offers options to include
 more information in the output :term:`SPDX` data:
@@ -50,19 +59,7 @@  more information in the output :term:`SPDX` data:
 
 Though the toplevel :term:`SPDX` output is available in
 ``tmp/deploy/images/MACHINE/`` inside the :term:`Build Directory`, ancillary
-generated files are available in ``tmp/deploy/spdx`` too, such as:
-
--  The individual :term:`SPDX` JSON files in the ``IMAGE-MACHINE.spdx.tar.zst``
-   archive.
-
--  Compressed archives of the files in the generated target packages,
-   in ``packages/packagename.tar.zst`` (when :term:`SPDX_ARCHIVE_PACKAGED`
-   is set).
-
--  Compressed archives of the source files used to build the host tools
-   and the target packages in ``recipes/recipe-packagename.tar.zst``
-   (when :term:`SPDX_ARCHIVE_SOURCES` is set). Those are needed to fulfill
-   "source code access" license requirements.
+generated files are available in ``tmp/deploy/spdx`` too.
 
 See also the :term:`SPDX_CUSTOM_ANNOTATION_VARS` variable which allows
 to associate custom notes to a recipe.