Projetos/rpi-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs/manual: add information on CycloneDX

Browse Source 
This patch adds information on how to generate a CycloneDX SBOM in
Buildroot. It also mentions how to track CVEs with that given SBOM.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: reword slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e09bf9e951)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-11-19 22:34:20 +01:00
parent ef962fc4f6
commit ac0a735d99
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/manual/common-usage.adoc
View File

@@ -180,6 +180,34 @@ a newer upstream version for those packages.
make pkg-stats
----
=== Generating CycloneDX SBOM
Based on the output of +show-info+ Buildroot can generate a SBOM in
the CycloneDX format. While it doesn't offer any additional
information, CycloneDX is a format specification that can be consumed
by other projects.
----
make show-info | utils/generate-cyclonedx
----
For more information check the help of the +generate-cyclonedx+ script, the
script call can be tailored to your project.
----
utils/generate-cyclonedx --help
----
Similarly to +pkg-stats+, CycloneDX SBOM's can be enriched with vulnerability
analysis from the NVD database.
----
make show | utils/generate-cyclonedx > sbom.cdx.json
cat sbom.cdx.json | support/scripts/cve-check --nvd-path dl/buildroot-nvd/
----
For more information about CycloneDX see https://cyclonedx.org/[].
=== Graphing the dependencies between packages
[[graph-depends]]