When FDA Section 524B Meets a Yocto Build: Reconciling an SBOM for a Linux Medical Device Prototype
Two people will read the SPDX file your Yocto build just emitted, and they will ask it different questions. The premarket cybersecurity reviewer wants to know what is in the device and whether you can track it after shipment. The open-source license reviewer wants to know what obligations attach to each component and whether you can produce the corresponding source. The file is the same. The reconciliation work is not. This article is about that reconciliation: what the OpenEmbedded build system actually emits, what it does not, and how to close the gap between a generated IMAGE-MACHINE.spdx.json and an artifact that supports both a regulatory submission and a GPL compliance position. I am writing from the build-engineering side. Where I cannot confirm a regulatory detail from a primary source, I…