sbom_cve_check: add support to kernel scripts/sbom

[gastmaier]

For Linux kernel release v7.2 (released on v7.2-rc2), a sbom generator will be included:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/sbom

Add support to its format. Detect 'KernelSbom' tool:

  {
    "type": "SoftwareAgent",
    "spdxId": "p:0",
    "creationInfo": "_:creationinfo",
    "name": "KernelSbom"
  },

to differentiate between the yocto target
https://git.openembedded.org/openembedded-core/tree/meta/lib/oe/sbom30.py and the kernel's scripts/sbom
The kernel sbom genrates 3 files:

• sbom-build.spdx.json
• sbom-output.spdx.json
• sbom-source.spdx.json

The source.spdx contains the list of files:

  { "type": "software_File", "name": "arch/arm/boot/compressed/misc.c", [ ... ] },

That is used to filter-out CVEs using the --export-filter-vulnerable flag.

Verification

$ ruff check
All checks passed!
$ python3 -m pytest tests/ -x -q
.......            [100%]
124 passed, 2 skipped in 748.45s (0:12:28)

End-to-end test

# at some linux kernel stable tag
export CROSS_COMPILE=arm-none-linux-gnueabihf-
export ARCH=arm
export KBUILD_OUTPUT=build
make defconfig
make -j20
RELEASE=$(cat $KBUILD_OUTPUT/include/config/kernel.release)
SRCARCH=$ARCH python3 ../v7.2-rc1/scripts/sbom/sbom.py \
  --src-tree . \
  --obj-tree build \
  --roots arch/arm/boot/zImage \
  --generate-spdx --package-version "$RELEASE"
$ time sbom-cve-check \
  --sbom-path sbom-output.spdx.json \
  --export-type yocto-cve-check-manifest \
  --export-path out-vuln.json \
  --export-filter-vulnerable
  --verbose

@augelu-tng

BTW 1

Android seems to have its own thingy, too:
https://cs.android.com/android/platform/superproject/+/android-latest-release:build/make/tools/sbom/gen_sbom.py

BTW 2

I have a quick checker based on 'strak' to query linux vulns

$ cd $(mktemp -d)
$ curl -sLO https://github.com/analogdevicesinc/linux-security-vulns/releases/download/latest/grondig ; chmod +x      grondig
$ curl -sLO https://github.com/analogdevicesinc/linux-security-vulns/releases/download/latest/post.db.xz ;  xz -d
post.db.xz
$ time echo '{"my-defconfig": {"stable-tag": "6.12", "compiled-files": ["net/bluetooth/af_bluetooth.c"]}}' | ./
grondig --post-db post.db
{
  "my-defconfig": {
    "cves": [
      "CVE-2026-52918",
      "CVE-2026-53357"
    ]
  }
}
real    0m0.817s
user    0m0.408s
sys     0m0.408s

[benjarobin]

Hello, thanks for working on this. I think the right way to implement it is to add support for ExternalMap and allow multiple SBOM files to be specified as input.
I am very busy right now, so I might not be very responsive.