From f8c15a660a04374d36363f770a16c65f3398268e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20St=C3=BCrz?= <simon.stuerz@chargebyte.com>
Date: Mon, 6 Jul 2026 09:46:05 +0200
Subject: [PATCH] Enable spdx SBoM creation and cve report by default for the
 entire system.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Simon Stürz <simon.stuerz@chargebyte.com>
---
 conf/local.conf | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/conf/local.conf b/conf/local.conf
index 48e4f88..7728711 100644
--- a/conf/local.conf
+++ b/conf/local.conf
@@ -270,6 +270,19 @@ DISTRO_FEATURES_BACKFILL_CONSIDERED += " sysvinit pulseaudio bluez5 gobject-intr
 VIRTUAL-RUNTIME_init_manager = "systemd"
 VIRTUAL-RUNTIME_update-alternatives = ""
 
+# Enable SPDX SBOM generation
+INHERIT += "create-spdx"
+
+# Optional: nicer JSON formatting
+SPDX_PRETTY = "1"
+
+# Optional: include source descriptions / archives (useful for compliance)
+SPDX_INCLUDE_SOURCES = "1"
+SPDX_ARCHIVE_SOURCES = "1"
+
+# Enable security report generation at build time
+INHERIT += "cve-check"
+
 # /var/log should be persistent
 VOLATILE_LOG_DIR = "no"