Greetings @waax,
The spdx/SBOM files actually come from the Yocto build itself as documented here: SBOM | Toradex Developer Center
TorizonCore Builder only modifies the OS rather than add new software/packages, so you can just reference the SBOM from the base image you used here. Though unfortunately for the 6.4.0 release you’re using there was an issue at the time and we actually had to disable SBOM generation in this build. Meaning SBOM files are not available for this particular release.
Is this going to be an issue for your development? Or what exactly is your use-case here?
Best Regards,
Jeremias