# Yocto Security Sbom

> Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.

- Skill: `higangssh/yocto-security-sbom` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add higangssh/yocto-security-sbom`
- Raw SKILL.md: https://api.skillmd.com/api/skills/higangssh/yocto-security-sbom/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Higangssh (https://skillmd.com/u/higangssh)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/higangssh/yocto-security-sbom

---


# Yocto Security SBOM

Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.

## Evidence

Ask for or inspect:

```text
target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policy
```

Useful commands:

```bash
bitbake -e <recipe> | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic <recipe>
bitbake <image>
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'
```

## Review Rules

- `LIC_FILES_CHKSUM` is mandatory unless `LICENSE = "CLOSED"`.
- License checksum mismatch means upstream license text changed; inspect before updating the checksum.
- Keep commercial license acceptance explicit and narrow.
- Verify current release SBOM/CVE class names before recommending `create-spdx`, CVE classes, or output paths.
- Use archiver/copyleft flows when source offer obligations matter.
- Do not confuse build-time `DEPENDS` with packages included in final image license manifests.

## References

- Read [references/security-sbom.md](references/security-sbom.md).
- Read [references/classes-core.md](references/classes-core.md) for `license`, `archiver`, `create-spdx`, and release-sensitive security classes.
- Read [references/migration.md](references/migration.md) for SBOM/CVE release changes.

## Output

Answer with:

1. license/security artifact being debugged
2. release-sensitive class or variable to verify
3. exact metadata or policy fix
4. validation command and expected artifact
5. compliance caveat if legal interpretation is required