SQUASH: SBOMs

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

releases/2.0/2.0.0/ip_compliance_note.rst

@@ -39,6 +39,27 @@ In the such dashboard, also CVE information (collected at the time of the
 commit) is shown and can be filtered based on target machines, images and
 single components.
 
+Last but not least, we provide reference SPDX SBoM of source packages used to
+build oniro-base-image and zephyr-philosophers images for a selection of
+supported target machines (qemu, raspberrypi4, arduino-nano-33ble), generated
+by continuous compliance pipelines. They are provided as a convenience only,
+with no express warranty or implied about the accuracy and completeness of the
+information contained therein (see the disclaimers below):
+
+============================= ====== ============ =================== ===================
+SBoM                          kernel toolchain(s) machine(s)          image
+============================= ====== ============ =================== ===================
+`linux-qemu`_                 linux  gcc,clang    qemu\*              oniro-image-base
+`linux-raspberrypi4`_         linux  gcc,clang    raspberrypi4-64     oniro-image-base
+`zephyr-qemu`_                zephyr gcc          qemu\*              zephyr-philosophers
+`zephyr-arduino-nano-33-ble`_ zephyr gcc          arduino-nano-33-ble zephyr-philosophers
+============================= ====== ============ =================== ===================
+
+.. _linux-qemu: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167524/artifacts/download
+.. _linux-raspberrypi4: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167525/artifacts/download
+.. _zephyr-qemu: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167526/artifacts/download
+.. _zephyr-arduino-nano-33-ble: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167527/artifacts/download
+
 *Disclaimer#1*: This is not legal advice. This note is provided just as a
 convenience for you, to suggest some critical areas in which you should seek
 legal advice if you want to develop real-world products based on Oniro. It is