Software Bill of Material (SBOM)¶

This page focuses on debsbom, which can generate a Software Bill of Materials for a Debian image. See the debsbom documentation for more details.

debsbom works with a root filesystem. You can run it:

after the build process has finished, directly with the build output
on the running target

debsbom uses metadata installed by the Debian package management system.

Install debsbom¶

Install debsbom in a Python virtual environment:

python3 -m venv --system-site-packages debsbom
source debsbom/bin/activate
pip3 install debsbom[cdx,spdx,download]

Run debsbom¶

When running from the build output inside the Docker container:

source debsbom/bin/activate
debsbom --progress generate -t spdx -o sbom \
  --distro-arch=arm \
  --root build_lsdk2412/rfs/rootfs_lsdk2412_debian_desktop_arm32

Replace _desktop_ with _server_ if you built the server image.

When running directly from the target:

source debsbom/bin/activate
debsbom --progress generate -t spdx -o sbom \
  --distro-arch=arm

Limitations¶

debsbom can only track packages installed with Debian package management tools. Components compiled during build time are not part of the generated SBOM.

The build output directory contains these components:

ls build_lsdk2412/
apps  bsp  firmware  images  linux  rfs

The following folders contain artifacts that are not covered by the generated SBOM:

apps: application data installed to the root filesystem.
bsp: BSP-specific firmware and components.
firmware: extra firmware items.
linux: the Linux kernel and kernel-related artifacts.

To get a complete SBOM, manually add and track the components in apps, bsp, firmware, and linux.