Your first audit

After a successful build, from the build directory:

yocman audit

The audit runs the configuration, layer, account, permission, service, secret, kernel, license, CVE and SBOM analyses on the most recent image, and gives a score per category. Every finding has a rule id, the evidence (file and line) and a recommendation.

Missing data

Some analyses need data the build only writes when a class is enabled (cve-check or vex, create-spdx, buildhistory). Run:

yocman doctor

It lists the data sources it found and the exact local.conf lines to enable the missing ones.

Fully local, or with an AI summary

Analyses are deterministic and run offline with --no-ai. Without it, the masked findings are sent for a prioritised summary; facts always come from your files.

In CI

yocman audit --no-ai --format json -o audit.json --fail-on high

The command exits with code 1 when a finding reaches high.

Next: start a project.