We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

A complete compliance toolchain for Yocto projects

Formal Metadata

Title
A complete compliance toolchain for Yocto projects
Subtitle
(even very large ones, yes)
Title of Series
Number of Parts
542
Author
License
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
Language

Content Metadata

Subject Area
Genre
Abstract
Presenting the toolchain that we have created for Eclipse Oniro, we believe the single largest compliance effort by many metrics ever attempted for Yocto projects, featuring besides than the usual suspects (Fossology, Scancode, SPDX, BANG, Gitlab CI) some specifically developed tools, including a dashboard, aliens4friends, a graph database to map dependencies and license incompatibilities, a license resolver and way more. Yocto has (as a recent addition) its own facilities to create a SBOM. We worked on some complements that need to be added to consume it for all bells and whistles of a full OpenChain conformant software composition analysis. We have created a way to preserve this information throughout the entire process of creating a build and can demonstrate how it is possible to uniquely identify each and every file that goes into the final image, resolve each binary file license from a large mix of diversely licensed source files, find the dependencies, find potential incompatibilities and reuse this information by sharing it publicly. This for a project whose base of data and number of vetted licenses,files and packages is very large (one would say "huge"). Therefore, what we regard as an unprecedented amount of automation had to be put to work.