Yocto SBOM生成とCVE管理の実践ガイド

bitbake-getvar -r core-image-minimal INHERIT

# conf/local.conf — create-spdxを手動で有効化（通常は不要）
INHERIT += "create-spdx"

# conf/local.conf — SBOM生成の推奨設定
SPDX_PRETTY = "1"

# conf/local.conf — ソース情報をSBOMに含める（オプション）
SPDX_INCLUDE_SOURCES = "1"
SPDX_ARCHIVE_SOURCES = "1"

bitbake core-image-minimal

tmp/deploy/images/<MACHINE>/core-image-minimal-<MACHINE>.spdx.tar.zst

cd tmp/deploy/images/qemux86-64/
mkdir spdx-output && cd spdx-output
tar -I zstd -xf ../core-image-minimal-qemux86-64.spdx.tar.zst
ls *.spdx.json | head -10

spdx-output/
├── recipe-core-image-minimal.spdx.json    ← イメージ全体
├── recipe-busybox.spdx.json               ← 個別レシピ
├── recipe-glibc.spdx.json
├── recipe-openssl.spdx.json
└── ...

{
  "spdxVersion": "SPDX-2.2",
  "dataLicense": "CC0-1.0",
  "name": "recipe-openssl",
  "packages": [
    {
      "name": "openssl",
      "versionInfo": "3.2.1",
      "supplier": "Organization: OpenSSL",
      "downloadLocation": "https://www.openssl.org/source/openssl-3.2.1.tar.gz",
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0"
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-Recipe",
      "relationshipType": "GENERATES",
      "relatedSpdxElement": "SPDXRef-Package-openssl"
    }
  ]
}

# conf/local.conf — CVEチェックを有効化
INHERIT += "cve-check"

bitbake -c cve_check openssl

bitbake core-image-minimal

tmp/deploy/cve/
├── openssl                    ← レシピ単位テキスト
├── openssl_cve.json           ← レシピ単位JSON
└── ...

tmp/deploy/images/<MACHINE>/
├── core-image-minimal-<MACHINE>.cve        ← イメージ全体テキスト
└── core-image-minimal-<MACHINE>.cve.json   ← イメージ全体JSON

PACKAGE NAME: openssl
PACKAGE VERSION: 3.2.1
CVE: CVE-2024-XXXXX
CVE STATUS: Patched
CVE SUMMARY: ...

CVE: CVE-2024-YYYYY
CVE STATUS: Unpatched
CVE SUMMARY: ...

# レシピ内またはbbappendで設定
CVE_STATUS[CVE-2024-12345] = "not-applicable-platform: Only affects Windows"
CVE_STATUS[CVE-2024-67890] = "not-applicable-config: Feature disabled in our config"

# conf/local.conf またはカスタムincファイル
CVE_STATUS_GROUPS = "CVE_STATUS_WIN CVE_STATUS_ARM32"

CVE_STATUS_WIN = "CVE-2024-11111 CVE-2024-22222 CVE-2024-33333"
CVE_STATUS_WIN[status] = "not-applicable-platform: Windows-only vulnerability"

CVE_STATUS_ARM32 = "CVE-2024-44444 CVE-2024-55555"
CVE_STATUS_ARM32[status] = "not-applicable-platform: ARM32-only, we target ARM64"

# conf/local.conf — 自社レイヤーのみチェック
CVE_CHECK_LAYER_INCLUDELIST = "meta-mylayer"

# または特定レイヤーを除外
CVE_CHECK_LAYER_EXCLUDELIST = "meta-poky"

# conf/local.conf
include conf/distro/include/cve-extra-exclusions.inc

# conf/local.conf — SBOM + CVEの推奨設定

# SBOM生成（デフォルト有効だが明示しておく）
INHERIT += "create-spdx"
SPDX_PRETTY = "1"

# CVEチェック
INHERIT += "cve-check"

# 公式CVE除外リスト
include conf/distro/include/cve-extra-exclusions.inc

1. bitbake <image>
   ↓ 自動
2. SBOM生成 → tmp/deploy/images/MACHINE/IMAGE.spdx.tar.zst
   ↓ 自動
3. CVEレポート生成 → tmp/deploy/images/MACHINE/IMAGE.cve
   ↓
4. Unpatched CVEの確認・対応
   ↓
5. SBOM + CVEレポートをバージョン管理に保存

# テキスト形式でUnpatchedを抽出
grep -B 3 "CVE STATUS: Unpatched" \
  tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.cve