Skip to content

Commit 2f63bb0

Browse files
committed
Cleanup sbom page
Addressed style, grammar, and phrasing to improve readability. Built docs and checked html output, no issues found. This commit addresses issue FFTK-4731, "Improve wording around SBOM info" Signed-off-by: Katrina Prosise <katrina.prosise@foundries.io>
1 parent f0595b8 commit 2f63bb0

1 file changed

Lines changed: 22 additions & 25 deletions

File tree

source/reference-manual/factory/sboms.rst

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,62 +6,59 @@ Software Bill of Materials
66
A Software Bill of Materials(SBOM) declares *the list of software packages used to build a Target*.
77
SBOMs are foundational to understanding:
88

9-
* Inventory management—the packages a Target uses.
10-
* License compliance—the software licenses of the packages.
11-
* Vulnerability management—the package versions.
9+
* Inventory management—the packages a Target uses.
10+
* License compliance—the software licenses of the packages.
11+
* Vulnerability management—the package versions.
1212

1313
The FoundriesFactory™ Platform's SBOM feature extracts the SBOM data and analyzes it according to your needs.
1414

1515
.. important::
1616
`Per our terms and conditions <https://foundries.io/company/terms/>`_:
17-
FoundriesFactory build SBOMs (“the SBOM data”) are provided for your use and are generated from SPDX metadata in all project source code files.
18-
Responsibility for open source license compliance rests with you.
19-
In no event shall Foundries.io Limited be liable for any claim, damages or other liability,
20-
whether in an action of contract, tort or other legal theory, arising from, out of, or in connection with the use of the SBOM data.
17+
FoundriesFactory build SBOMs (“the SBOM data”) are provided for your use and are generated from SPDX metadata in all project source code files.
18+
Responsibility for open source license compliance rests with you.
19+
In no event shall Foundries.io Limited be liable for any claim, damages or other liability,
20+
whether in an action of contract, tort or other legal theory, arising from, out of, or in connection with the use of the SBOM data.
2121

2222
SBOMs and Builds
2323
----------------
2424

25-
The FoundriesFactory CI generates SBOM artifacts whenever there a change happens in a Factory build.
25+
Whenever a Factory build changes, The FoundriesFactory CI generates SBOM artifacts.
2626
This happens for two kinds of builds:
2727

28-
* Yocto Project: `Software Package Data Exchange`_ (SPDX) artifacts using built-in tooling.
29-
* Container: produce SDPX artifacts using Syft_.
28+
* Yocto Project: `Software Package Data Exchange`_ (SPDX) artifacts using built-in tooling.
29+
* Container: produces SDPX artifacts using Syft_.
3030

3131
You can download them from the web UI when viewing a Target.
3232
Both artifacts go into the ``sboms`` directory.
3333

3434
Yocto Project Artifacts
3535
^^^^^^^^^^^^^^^^^^^^^^^
3636

37-
Yocto builds a comprehensive SPDX per image type.
38-
For example, ``lmp-factory-image-intel-corei7-64.spdx.tar.zst``.
39-
This includes an SPDX file for every package included in the build.
37+
The Yocto Project builds a comprehensive SPDX per image type.
38+
For example, ``lmp-factory-image-intel-corei7-64.spdx.tar.zst`` includes an SPDX file for every package included in the build.
4039

4140
Syft Artifacts
4241
^^^^^^^^^^^^^^
4342

4443
Container builds produce an SPDX file for each container/architecture.
4544
This will look like ``hub.foundries.io/<FACTORY>/shellhttpd/arm64.sdpx.json``.
4645

47-
Customers may disable generating SBOMs for containers by setting the environment variable ``DISABLE_SBOM=1`` in their :ref:`ref-factory-definition`.
46+
You may disable generating SBOMs for containers by setting the environment variable ``DISABLE_SBOM=1`` in your :ref:`ref-factory-definition`.
4847

4948
Working With SBOMs
5049
------------------
5150

5251
While you can access SBOM information in its raw form by browsing your CI build,
53-
APIs exist that allow Fioctl® to work with Factory SBOMs.
52+
APIs exist that allow the Fioctl® tool to work with Factory SBOMs.
5453

5554

5655
Like other Factory concepts, SBOMs revolve around :ref:`Targets <tutorial-what-is-a-target>`.
57-
You can find out available SBOMs for a Target by running:
56+
You can list the available SBOMs for a Target by running:
5857

5958
.. code-block:: console
6059
6160
$ fioctl targets show sboms <target name or version>
6261
63-
For example
64-
6562
.. code-block:: console
6663
6764
$ fioctl targets show sboms 262
@@ -84,13 +81,13 @@ Notice how:
8481
* ``initramfs-...``; runtime packages
8582
* ``lmp-factory-image-...``; packages required for boot.
8683

87-
* Several containers for two architectures were built.
88-
In this case, the platform is Intel, so the aarch64 builds are experimental or for debug and not production.
84+
* There is containers for two architectures.
85+
In this case, the platform is Intel, so the aarch64 builds are experimental or for debugging—not production.
8986

90-
* The nginx and Alpine containers come from a ``hub.docker.io``.
91-
* The shellhttpd container comes from the Factory ``hub.foundries.io``.
87+
* The nginx and Alpine containers come from ``hub.docker.io``.
88+
* The shellhttpd container comes from the Factory's ``hub.foundries.io``.
9289

93-
You can then query each SBOM for more details
90+
You can query each SBOM for more details:
9491

9592
.. code-block:: console
9693
@@ -111,10 +108,10 @@ These tend to work with two competing SBOM formats:
111108
* SPDX_
112109
* CycloneDX_
113110

114-
You may want to just export their SBOM data into spreadsheets for quick, custom processing.
111+
You may want to export their SBOM data into spreadsheets for quick, custom processing.
115112
While the native storage format for Factory SBOMs is SPDX,
116113
the Foundries.io™ API provides a best-effort conversion to both CycloneDX and CSV.
117-
This allows users to export data from their Factory and into their tool of choice.
114+
This allows you to export data from your Factory and into your tool of choice.
118115

119116
To view an SBOM in a given format:
120117

0 commit comments

Comments
 (0)