Add documentation for SBOM by yogeshhegde · Pull Request #676 · TexasInstruments/processor-sdk-doc

yogeshhegde · 2026-04-16T10:18:56Z

feat(linux): Add how to guide for working with SBOMs
Add How to guide for working with SBOM's with sections

Generating SBOM in SPDX and CycloneDX format
Tools and references for Working with SBOM i.e visualizing, merging,
modifying SBOMs

feat(linux): Add SBOM section to release notes
Add release artefacts SBOM information for AM64X,AM62X,AM62PX and AM62LX
devices.

Doc Link - https://yogeshhegde.github.io/processor-sdk-doc/processor-sdk-linux-AM62LX/esd/docs/master/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.html

github-actions · 2026-04-16T10:19:53Z

New warnings found with rstcheck:

source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst:10: (ERROR/3) Unexpected indentation.

github-actions · 2026-04-16T10:32:19Z

New warnings found with rstcheck:

source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst:10: (ERROR/3) Unexpected indentation.

github-actions · 2026-04-16T10:53:28Z

New warnings found with rstcheck:

source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62PX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst:43: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM64X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_FULL_NAME".
source/devices/AM62X/linux/Release_Specific_Release_Notes.rst:41: (ERROR/3) Undefined substitution referenced: "SDK_DOWNLOAD_URL".

github-actions · 2026-04-16T11:16:33Z

New warnings found with rstcheck:

source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst:10: (ERROR/3) "list-table" widths do not match the number of columns in table (4).

Add release artefacts SBOM information for AM64X,AM62X,AM62PX and AM62LX devices. Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

cshilwant · 2026-04-16T15:12:57Z

@@ -0,0 +1,178 @@
+.. _how-to-work-with-sbom:


This newly added section doesn't seem to follow the guidelines of section headers

https://github.com/TexasInstruments/processor-sdk-doc?tab=contributing-ov-file#headings--sections

Fixed.

But few questions,

Why do we follow Python Developer's Guide for documenting , what benefits do we get by following this guide just for heading ?

rst does not put any limitations on the section headers, the doc says whatever we encounter 1st is h1 and so on.

Since for h1 and h2 the characters underlining are different why do we need an overline just for h1 and h2 ? Since it is just for aesthetic purposes why not overline for all or no overline for all? Why not simplify and use one format for headings?

I see alot of .rst files not following the format, is there a plan to fix those documents?

That's the one highlighted by sphinx in their documentation - https://www.sphinx-doc.org/en/master/usage/restructuredtext/basics.html#sections

Yeah, that's a known issue. Infact that inconsistency led to encorfing this under Contribution guidelines - https://github.com/TexasInstruments/processor-sdk-doc?tab=contributing-ov-file#headings--sections. There were internal jira tickets created for few of those inconsistent rst files but later most of them were fixed by @StaticRocket, @praneethbajjuri and myself in past. Feel free to submit a patch incase you happen to see any rst's still having inconsistent usage of section headers.

cshilwant · 2026-04-16T15:14:15Z

+SPDX 3.0 is generated by default when building |__SDK_FULL_NAME__| Yocto, no extra steps required.
+If you require additional vulnerability information, follow these steps:
+
+1. Add the following line to your ``local.conf``:


role file can be used to highlight the same

Suggested change

1. Add the following line to your ``local.conf``:

1. Add the following line to your :file:`local.conf`:

What is the difference between

``local.conf``

&

:file:`local.conf`

How is it rendered different to the user?

In Sphinx (& reStructuredText), these 2 syntaxes serve different semantic purposes, even if they sometimes look similar in the final output. Think of it as the difference between "just some code / variable" and "specifically a file."

:file: role specifically for filenames and paths. It tells Sphinx (& the reader) exactly what the data is.

In terms of rendering, both usually result in a monospaced (fixed-width) font but the way they appear can vary based on the theme you are using

cshilwant · 2026-04-16T15:25:39Z

+1. Start with the build instructions in :ref:`Processor SDK - Building the SDK with Yocto <building-the-sdk-with-yocto>`
+2. After cloning ``oe-layersetup``, uncomment the ``meta-cyclonedx`` line in
+   the layer configuration file, for example:
+


Any reasons we aren't pushing a new oe-config file to oe-layersetup dedicated for SBOMs?
We can avoid the following manual local changes & improve the user experience

Here are few reasons,

CycloneDX SBOM is not default format for SBOM, but there might be some users who want to use the format.

Duplication of oe-config, there are 4 oe-config for 12.00.00 release, creating new oe-config just for cyclonedx would take that number to 8 since we have to give each oe-config with SPDX and CycloneDX SBOM generation.

8 oe-config will lead to more user confusion instead of improving user experience because for users who just want sane defaults they will be confused which oe-config to use.

oe-layersetup does not allow us to include files / config fragments, while kas (yaml) and repo (xml) both have include files feature where we can create fragments and user can include/exclude fragments enabling/disabling features. This would simplify both maintenance and improve user experience.

With these constraints, I believe this is the best course, since it is just uncommenting a line for the user and they also see less oe-configs.

I agree with this approach for the 12.0 release. Since we are still in the evaluation phase for SBOMs, it makes sense to avoid config bloat and keep the user experience simple for now.

However, SBOMs are the way to go in the future. Moving forward, we should look into how we can incorporate them into the default SDK build flow...

Add How to guide for working with SBOM's with sections * Generating SBOM in SPDX and CycloneDX format * Tools and references for Working with SBOM i.e visualizing, merging, modifying SBOMs Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

Add link to working with SBOM in release specific section Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

Add release artefacts SBOM information to release notes for AM62DX device. Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

StaticRocket · 2026-04-17T18:13:45Z

Could you use auto-numbered lists for this instead of manual numbering?

github-actions bot assigned bryanbrattlof, DhruvaG2000, jeevantelukula and sskartheekadivi Apr 16, 2026

yogeshhegde force-pushed the sbom branch from 60091de to dda4dca Compare April 16, 2026 10:52

yogeshhegde marked this pull request as ready for review April 16, 2026 10:56

yogeshhegde requested review from StaticRocket, VeeruPrudhvi, cshilwant, gehariprasath, jeevantelukula, praneethbajjuri and uditkumarti as code owners April 16, 2026 10:56

yogeshhegde force-pushed the sbom branch 2 times, most recently from 16bcbfe to 5732a1e Compare April 16, 2026 11:15

yogeshhegde force-pushed the sbom branch from 5732a1e to 18e5835 Compare April 16, 2026 11:18

jeevantelukula reviewed Apr 16, 2026

View reviewed changes

Comment thread source/devices/AM62LX/linux/Release_Specific_Release_Notes.rst

jeevantelukula reviewed Apr 16, 2026

View reviewed changes

Comment thread source/linux/How_to_Guides/FAQ/How_to_work_with_SBOM.rst

feat(linux): Add SBOM section to release notes

007d0df

Add release artefacts SBOM information for AM64X,AM62X,AM62PX and AM62LX devices. Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

yogeshhegde force-pushed the sbom branch 2 times, most recently from 9338c00 to b9ad5de Compare April 16, 2026 13:05

cshilwant requested changes Apr 16, 2026

View reviewed changes

cshilwant reviewed Apr 16, 2026

View reviewed changes

yogeshhegde added 3 commits April 17, 2026 09:57

feat(linux): Add how to guide for working with SBOMs

41da0b5

Add How to guide for working with SBOM's with sections * Generating SBOM in SPDX and CycloneDX format * Tools and references for Working with SBOM i.e visualizing, merging, modifying SBOMs Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

feat(linux): Add link to working with SBOM

e7f9c4b

Add link to working with SBOM in release specific section Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

feat(linux): Add SBOM section to release notes for AM62DX

89572e6

Add release artefacts SBOM information to release notes for AM62DX device. Signed-off-by: Yogesh Hegde <y-hegde@ti.com>

yogeshhegde force-pushed the sbom branch from b9ad5de to 89572e6 Compare April 17, 2026 04:34

github-actions bot assigned paresh-bhagat12 Apr 17, 2026

StaticRocket reviewed Apr 17, 2026

View reviewed changes

	1. Add the following line to your ``local.conf``:
	1. Add the following line to your :file:`local.conf`:

Conversation

yogeshhegde commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

github-actions bot commented Apr 16, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshhegde Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cshilwant Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

yogeshhegde commented Apr 16, 2026 •

edited

Loading

yogeshhegde Apr 17, 2026 •

edited

Loading

cshilwant Apr 16, 2026 •

edited

Loading