rajamesandClaude Opus 5.5
fcb89b0695
make boot_image now ends by writing build/boards/<board>/<image>.spdx(.json): the image and every file copied off it, each with its SHA-256 -- the SBOM of what is on the medium. It also refreshes sbom.spdx(.json), the source SBOM: the tracked files the product is built from (kernel, v3, v4, capsules, boards, tooling, proofs), staged to build/sbom/src so nothing untracked in the working directory is swept in. Versioned as the kernel version and git describe. mk/syft.yaml turns on file cataloging with SHA-256 (a C tree has almost no packages for syft to find: the old SBOM held one file with a zero checksum). No syft: the build stops. syft 1.52.0 installed in ~/.local/bin from its GitHub release, checked against the release's published SHA-256. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
10 lines
368 B
YAML
10 lines
368 B
YAML
# syft configuration for this repository's SBOMs (make sbom, make boot_image).
|
|
# A C kernel has almost no "packages" for syft's catalogers to find, so the
|
|
# SBOM's substance is the file list: every file in scope, with its SHA-256
|
|
# (2026-10-14; until then the SBOM held one file, with a zero checksum).
|
|
file:
|
|
metadata:
|
|
selection: all
|
|
digests:
|
|
- sha256
|