@@ -6,62 +6,59 @@ Software Bill of Materials
66A Software Bill of Materials(SBOM) declares *the list of software packages used to build a Target *.
77SBOMs are foundational to understanding:
88
9- * Inventory management—the packages a Target uses.
10- * License compliance—the software licenses of the packages.
11- * Vulnerability management—the package versions.
9+ * Inventory management—the packages a Target uses.
10+ * License compliance—the software licenses of the packages.
11+ * Vulnerability management—the package versions.
1212
1313The FoundriesFactory™ Platform's SBOM feature extracts the SBOM data and analyzes it according to your needs.
1414
1515.. important ::
1616 `Per our terms and conditions <https://foundries.io/company/terms/ >`_:
17- FoundriesFactory build SBOMs (“the SBOM data”) are provided for your use and are generated from SPDX metadata in all project source code files.
18- Responsibility for open source license compliance rests with you.
19- In no event shall Foundries.io Limited be liable for any claim, damages or other liability,
20- whether in an action of contract, tort or other legal theory, arising from, out of, or in connection with the use of the SBOM data.
17+ FoundriesFactory build SBOMs (“the SBOM data”) are provided for your use and are generated from SPDX metadata in all project source code files.
18+ Responsibility for open source license compliance rests with you.
19+ In no event shall Foundries.io Limited be liable for any claim, damages or other liability,
20+ whether in an action of contract, tort or other legal theory, arising from, out of, or in connection with the use of the SBOM data.
2121
2222SBOMs and Builds
2323----------------
2424
25- The FoundriesFactory CI generates SBOM artifacts whenever there a change happens in a Factory build .
25+ Whenever a Factory build changes, The FoundriesFactory CI generates SBOM artifacts.
2626This happens for two kinds of builds:
2727
28- * Yocto Project: `Software Package Data Exchange `_ (SPDX) artifacts using built-in tooling.
29- * Container: produce SDPX artifacts using Syft _.
28+ * Yocto Project: `Software Package Data Exchange `_ (SPDX) artifacts using built-in tooling.
29+ * Container: produces SDPX artifacts using Syft _.
3030
3131You can download them from the web UI when viewing a Target.
3232Both artifacts go into the ``sboms `` directory.
3333
3434Yocto Project Artifacts
3535^^^^^^^^^^^^^^^^^^^^^^^
3636
37- Yocto builds a comprehensive SPDX per image type.
38- For example, ``lmp-factory-image-intel-corei7-64.spdx.tar.zst ``.
39- This includes an SPDX file for every package included in the build.
37+ The Yocto Project builds a comprehensive SPDX per image type.
38+ For example, ``lmp-factory-image-intel-corei7-64.spdx.tar.zst `` includes an SPDX file for every package included in the build.
4039
4140Syft Artifacts
4241^^^^^^^^^^^^^^
4342
4443Container builds produce an SPDX file for each container/architecture.
4544This will look like ``hub.foundries.io/<FACTORY>/shellhttpd/arm64.sdpx.json ``.
4645
47- Customers may disable generating SBOMs for containers by setting the environment variable ``DISABLE_SBOM=1 `` in their :ref: `ref-factory-definition `.
46+ You may disable generating SBOMs for containers by setting the environment variable ``DISABLE_SBOM=1 `` in your :ref: `ref-factory-definition `.
4847
4948Working With SBOMs
5049------------------
5150
5251While you can access SBOM information in its raw form by browsing your CI build,
53- APIs exist that allow Fioctl® to work with Factory SBOMs.
52+ APIs exist that allow the Fioctl® tool to work with Factory SBOMs.
5453
5554
5655Like other Factory concepts, SBOMs revolve around :ref: `Targets <tutorial-what-is-a-target >`.
57- You can find out available SBOMs for a Target by running:
56+ You can list the available SBOMs for a Target by running:
5857
5958.. code-block :: console
6059
6160 $ fioctl targets show sboms <target name or version>
6261
63- For example
64-
6562 .. code-block :: console
6663
6764 $ fioctl targets show sboms 262
@@ -84,13 +81,13 @@ Notice how:
8481 * ``initramfs-... ``; runtime packages
8582 * ``lmp-factory-image-... ``; packages required for boot.
8683
87- * Several containers for two architectures were built .
88- In this case, the platform is Intel, so the aarch64 builds are experimental or for debug and not production.
84+ * There is containers for two architectures.
85+ In this case, the platform is Intel, so the aarch64 builds are experimental or for debugging— not production.
8986
90- * The nginx and Alpine containers come from a ``hub.docker.io ``.
91- * The shellhttpd container comes from the Factory ``hub.foundries.io ``.
87+ * The nginx and Alpine containers come from ``hub.docker.io ``.
88+ * The shellhttpd container comes from the Factory's ``hub.foundries.io ``.
9289
93- You can then query each SBOM for more details
90+ You can query each SBOM for more details:
9491
9592.. code-block :: console
9693
@@ -111,10 +108,10 @@ These tend to work with two competing SBOM formats:
111108 * SPDX _
112109 * CycloneDX _
113110
114- You may want to just export their SBOM data into spreadsheets for quick, custom processing.
111+ You may want to export their SBOM data into spreadsheets for quick, custom processing.
115112While the native storage format for Factory SBOMs is SPDX,
116113the Foundries.io™ API provides a best-effort conversion to both CycloneDX and CSV.
117- This allows users to export data from their Factory and into their tool of choice.
114+ This allows you to export data from your Factory and into your tool of choice.
118115
119116To view an SBOM in a given format:
120117
0 commit comments