Add CycloneDX SBOM and VEX generation

aethernet · aethernet · commit 4d9faf9ad25e · 2025-07-04T16:04:55.000+02:00
https://balena.fibery.io/Work/Project/balenaos-SBOM-as-release-asset-1515 Changelog-entry: Generate SBOM and VEX (cycloneDX) Signed-off-by: Edwin Joassart <edwin.joassart@balena.io>
diff --git a/.gitmodules b/.gitmodules
@@ -27,3 +27,7 @@
 	path = layers/meta-db1
 	url = https://github.com/bluechiptechnology/meta-db1.git
 	branch = main
+[submodule "layers/meta-cyclonedx"]
+	path = layers/meta-cyclonedx
+	url = https://github.com/balena-os/meta-cyclonedx
+	branch = kirkstone
diff --git a/layers/meta-balena-db1/conf/samples/bblayers.conf.sample b/layers/meta-balena-db1/conf/samples/bblayers.conf.sample
@@ -20,4 +20,5 @@ BBLAYERS ?= " \
     ${TOPDIR}/../layers/meta-arm/meta-arm-toolchain \
     ${TOPDIR}/../layers/meta-arm/meta-arm \
     ${TOPDIR}/../layers/meta-db1 \
+    ${TOPDIR}/../layers/meta-cyclonedx  \
     "
diff --git a/layers/meta-balena-db1/conf/samples/local.conf.sample b/layers/meta-balena-db1/conf/samples/local.conf.sample
@@ -22,3 +22,6 @@ BB_DISKMON_DIRS = "\
 CONF_VERSION = "2"
 
 HOSTTOOLS += "docker iptables"
+
+# CycloneDX SBOM and VEX generation
+INHERIT += "cyclonedx-export"
diff --git a/layers/meta-cyclonedx b/layers/meta-cyclonedx
@@ -0,0 +1 @@
+Subproject commit 0f37766e9cdcf4919d5be85abc54a7219aaf36cb

Original file line number	Diff line number	Diff line change
`@@ -20,4 +20,5 @@ BBLAYERS ?= " \`
`20`	`20`	`${TOPDIR}/../layers/meta-arm/meta-arm-toolchain \`
`21`	`21`	`${TOPDIR}/../layers/meta-arm/meta-arm \`
`22`	`22`	`${TOPDIR}/../layers/meta-db1 \`
	`23`	`+ ${TOPDIR}/../layers/meta-cyclonedx \`
`23`	`24`	`"`