4.1.11. How to Guide for working with Software Bill of Materials (SBOM)

4.1.11.1. Glossary

SBOM: Software Bill of Materials - is a comprehensive list of all the software components, dependencies, and metadata associated with an application.
SPDX: Software Package Data Exchange - is an open standard (or format) for communicating Software Bill of Materials (SBOM) information including components, licenses, copyrights, and security references.
CycloneDX: CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction.
VEX: Vulnerability Exploitability eXchange - is a standardized format for sharing information about vulnerabilities and their exploitability.

4.1.11.2. Generating SBOM

AM62L-Linux-SDK Yocto build generates SBOMs in the following formats and versions:

Format	Version
SPDX	3.0
CycloneDX	1.6

Follow the steps below based on your required format.

4.1.11.2.1. Generating SBOM in SPDX 3.0 Format

SPDX 3.0 is generated by default when building AM62L-Linux-SDK Yocto, no extra steps required. If you require additional vulnerability information, follow these steps:

Add the following line to your local.conf:
```
INHERIT += "vex"
```
Build Yocto according to the build instructions in Processor SDK - Building the SDK with Yocto.

The following artifacts will be generated in the Yocto deploy directory:

File	Description
`$IMAGE_NAME.rootfs.spdx.json`	The SPDX v3.0 SBOM file
`$IMAGE_NAME.rootfs.json`	Vulnerability information file generated by `vex.bbclass`

4.1.11.2.2. Generating SBOM in CycloneDX Format

To generate SBOM in CycloneDX format, follow these steps:

Start with the build instructions in Processor SDK - Building the SDK with Yocto

After cloning oe-layersetup, uncomment the meta-cyclonedx line in the layer configuration file, for example:

meta-cyclonedx,https://github.com/iris-GmbH/meta-cyclonedx.git,main,0170751b487162f8e476fd32d441ddfcf24ca78a,layers=

Add the following line to your local.conf:
```
INHERIT += "cyclonedx-export"
```
Continue to build Yocto according to the build instructions in Processor SDK - Building the SDK with Yocto.

The following artifacts will be generated in the Yocto deploy directory:

File	Description
`$IMAGE_NAME.rootfs.cyclonedx.bom.json`	The CycloneDX SBOM file
`$IMAGE_NAME.rootfs.cyclonedx.vex.json`	The CycloneDX VEX file

4.1.11.3. Working with SBOM

It is recommended to use open-source tools for working with SBOMs. The following open-source tools are recommended for working with SBOMs:

Format	Tool	Description
CycloneDX	CycloneDX Sunshine	Visualize CycloneDX SBOMs in a human-readable format
CycloneDX	CycloneDX CLI	BOM analysis, modification, diffing, merging, format conversion, signing and verification.
SPDX	SPDX Open Source Tools	A collection of open-source tools for working with SPDX SBOMs

Note

SPDX 3.0 is not yet widely supported by SPDX tools. Using such tools with SPDX 3.0 files may give varied or unexpected results.

4.1.11.4. CVE Analysis

The sbom-cve-check tool can be used to perform CVE analysis on the generated SPDX SBOM.

Install the tool:
```
pip install sbom-cve-check
```
Note

It is recommended to install this tool in a Python virtual environment.
Retrieve the following artifacts from the Yocto deploy directory:

File

Description

$IMAGE_NAME.rootfs.spdx.json

The SPDX v3.0 SBOM file

$IMAGE_NAME.rootfs.json

Vulnerability information file generated by vex.bbclass

Run the CVE analysis:

sbom-cve-check --sbom-path ${IMAGE_NAME}.rootfs.spdx.json \
               --yocto-vex-manifest ${IMAGE_NAME}.rootfs.json \
               --export-type yocto-cve-check-manifest \
               --export-path cve-check.json

Note

sbom-cve-check only supports SPDX format and does not support CycloneDX.