Skip to content

ci: build: archive SBOM and VEX information for every build #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jluebbe merged 3 commits into from
Mar 6, 2026
Merged

ci: build: archive SBOM and VEX information for every build #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
81f80d9
meta-lxatac-software: distro: tacos: generate vex data
hnez Feb 16, 2026
d371b1a
meta-lxatac-bsp: linux-lxatac: enable SPDX_INCLUDE_COMPILED_SOURCES
hnez Feb 25, 2026
633ebfb
ci: build: archive sbom information for use with sbom-cve-check
hnez Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,3 +93,11 @@ jobs:
with:
name: images
path: images/*.desktop

- name: Upload Software Bill of Materials to GitHub
uses: actions/upload-artifact@v7
with:
name: sbom
path: |
images/lxatac-core-image-base-lxatac.rootfs.json
images/lxatac-core-image-base-lxatac.rootfs.spdx.json
4 changes: 4 additions & 0 deletions meta-lxatac-bsp/recipes-kernel/linux/linux-lxatac.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ S = "${UNPACKDIR}/linux-${LINUX_VERSION}"

COMPATIBLE_MACHINE = "lxatac"

# Track which files are compiled in so we can ignore CVEs that only
# affect files we do not build.
SPDX_INCLUDE_COMPILED_SOURCES = "1"

# The coreutils-native dependency is required since kernel 6.11,
# which uses the `truncate` tool in a script.
# It can likely be removed again once the kernel.bbclass is updated.
Expand Down
7 changes: 5 additions & 2 deletions meta-lxatac-software/conf/distro/tacos.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,11 @@ require conf/distro/include/yocto-uninative.inc
require conf/distro/include/security_flags.inc
INHERIT += "uninative"

# Enable creation of SPDX manifests
INHERIT += "create-spdx"
# Enable creation of SPDX manifests and vulnerability exploitability
# exchange files.
# Exclude CVEs that are known to not affect yocto.
require conf/distro/include/cve-extra-exclusions.inc
INHERIT += "create-spdx vex"

# Create a directory for each package in `/usr/share/licenses`
# and place licensing information there.
Expand Down