diff --git a/releases/2.0/2.0.0/ip_compliance_note.rst b/releases/2.0/2.0.0/ip_compliance_note.rst index 77c4e8da7762b275791ced6e02a192c97bfed2be..d0a19cfab8b8a94a6e324f8b669c75deef5a9461 100644 --- a/releases/2.0/2.0.0/ip_compliance_note.rst +++ b/releases/2.0/2.0.0/ip_compliance_note.rst @@ -39,6 +39,27 @@ In the such dashboard, also CVE information (collected at the time of the commit) is shown and can be filtered based on target machines, images and single components. +Last but not least, we provide reference SPDX SBoM of source packages used to +build oniro-base-image and zephyr-philosophers images for a selection of +supported target machines (qemu, raspberrypi4, arduino-nano-33ble), generated +by continuous compliance pipelines. They are provided as a convenience only, +with no express warranty or implied about the accuracy and completeness of the +information contained therein (see the disclaimers below): + +============================= ====== ============ =================== =================== +SBoM kernel toolchain(s) machine(s) image +============================= ====== ============ =================== =================== +`linux-qemu`_ linux gcc,clang qemu\* oniro-image-base +`linux-raspberrypi4`_ linux gcc,clang raspberrypi4-64 oniro-image-base +`zephyr-qemu`_ zephyr gcc qemu\* zephyr-philosophers +`zephyr-arduino-nano-33-ble`_ zephyr gcc arduino-nano-33-ble zephyr-philosophers +============================= ====== ============ =================== =================== + +.. _linux-qemu: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167524/artifacts/download +.. _linux-raspberrypi4: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167525/artifacts/download +.. _zephyr-qemu: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167526/artifacts/download +.. _zephyr-arduino-nano-33-ble: https://gitlab.eclipse.org/eclipse/oniro-compliancetoolchain/mirrors/oniro-goofy/-/jobs/167527/artifacts/download + *Disclaimer#1*: This is not legal advice. This note is provided just as a convenience for you, to suggest some critical areas in which you should seek legal advice if you want to develop real-world products based on Oniro. It is