Joshua Watt

[Joshua Watt @JPEW_dev]

Lean how to track your Software Bill of Materials with #SPDX using the Yocto Project and OpenEmbedded in my latest talk from the Embedded Linux Conference: https://t.co/BrxQCxhH4q

@linuxfoundation @OpenEmbeddedOrg @yoctoproject @SPDXTeam

[Joshua Watt @JPEW_dev]

The video from my talk at #fosdem2024 is now live. See the exciting changes that @yoctoproject and @OpenEmbeddedOrg have coming soon with the migration from @SPDX_SBOM version 2.2 to 3.0 https://t.co/wDaUfDEalU via @YouTube

[Joshua Watt @JPEW_dev]

@stacktrust @balister One goal of the transition to SPDX 3.0 is to make it possible to associate a build with the SBoM of the machine that did the build. Potentially we might even be able to do this across sstate someday

[Joshua Watt @JPEW_dev]

@OpenEmbeddedOrg @yoctoproject

[Joshua Watt @JPEW_dev]

My talk from #fosdem23 on SBoM generation at build time using #openembedded and #yocto as a case study is now available
https://t.co/XphctBIBqZ
Or
https://t.co/Po4Cf7XEgg

[Joshua Watt @JPEW_dev]

@interlynkrcn The example SBoM from my presentation can be downloaded here: https://t.co/VKIsW2mnv0

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject But, yes it does link your relationships to the document they live in, which is not ideal

[Joshua Watt @JPEW_dev]

Lean how to track your Software Bill of Materials with #SPDX using the Yocto Project and OpenEmbedded in my latest talk from the Embedded Linux Conference: https://t.co/BrxQCxhH4q

@linuxfoundation @OpenEmbeddedOrg @yoctoproject @SPDXTeam

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject I took the description of relationship fields in https://t.co/dOLqBWkxJu to mean that External Document References are allowed in relationships; the document creation information gives a local "shorthand" name for the external document you want to reference.

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject Right. External references are allowed by the spec, but as you point out hard to deal with. Combining all packages into a single document would work better (and eliminate our tar archive), however this is difficult with SPDX 2 because it has to be a contextual merge.

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject See: https://t.co/1T6neHZx8L

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject Not quite. It is a relationship between a package in the current document and a package in another document. The ":" splits the ID between the External Document Reference (defined in this document) and the package name in that external document

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject Ah yes. That's a question for @SPDXTeam :)

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject The @yoctoproject and @OpenEmbeddedOrg have been around for quite a while, and there are many examples of large companies using it to build complex products

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject The recipe metadata is designed to be simple to maintain correctly, and easy to share. For example, you wouldn't need to write the recipe to compile zlib because we already have one.

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject The QA checks provided by the project are mostly automatic

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject I'm also working with @SPDXTeam to develop SPDX 3.0 so it should have better support for our uses from the first release, and I hope to be an early adopter

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject Consuming the SPDX we generate is not currently easy. It is valid SPDX, but I haven't seen any tools that can deal with the complexity. However, is providing a concrete example should help the tooling evolve more quickly.

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject e.g. a poorly written recipe may produce poor SPDX

[Joshua Watt @JPEW_dev]

@YevTheDev @SPDXTeam @linuxfoundation @OpenEmbeddedOrg @yoctoproject There is recipe metadata that describes the software. It's "authoritative" in that we only put in the SPDX what is described in the recipe metadata or the source itself. You are at the mercy of the quality of the recipe, but we have QA checks to help with that