| Message ID | 20260401170126.2869064-1-ross.burton@arm.com |
|---|---|
| State | New |
| Headers | show |
| Series | fragments/sbom-cve-check: inherit create-spdx | expand |
diff --git a/meta/conf/fragments/yocto/sbom-cve-check.conf b/meta/conf/fragments/yocto/sbom-cve-check.conf index a3f229acf28..73ed35be270 100644 --- a/meta/conf/fragments/yocto/sbom-cve-check.conf +++ b/meta/conf/fragments/yocto/sbom-cve-check.conf @@ -7,8 +7,12 @@ BB_CONF_FRAGMENT_DESCRIPTION = "Enables sbom-cve-check and applies the following allowing CVEs to be excluded if the source is not compiled. \ " +INHERIT += "create-spdx" + IMAGE_CLASSES:append = " sbom-cve-check" + SRCREV:pn-sbom-cve-check-update-nvd-native = "${AUTOREV}" SRCREV:pn-sbom-cve-check-update-cvelist-native = "${AUTOREV}" + SPDX_INCLUDE_VEX = "all" SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"
The sbom-cve-check integration is dependent on SPDX being generated, so add it to INHERIT in this fragment to ensure that it has been. Signed-off-by: Ross Burton <ross.burton@arm.com> --- meta/conf/fragments/yocto/sbom-cve-check.conf | 4 ++++ 1 file changed, 4 insertions(+)