On Wed Mar 11, 2026 at 5:39 PM CET, Joshua Watt wrote: > On Wed, Mar 11, 2026 at 7:55 AM Mathieu Dubois-Briand > <[email protected]> wrote: >> >> On Tue Mar 10, 2026 at 7:38 PM CET, Joshua Watt via lists.openembedded.org >> wrote: >> > Changes the SPDX 3 output to include a "recipe" package that describe >> > static information available at parse time (without building). This is >> > primarily useful for gathering SPDX 3 VEX information about some or all >> > recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and >> > vex.bbclass. >> > >> > Special thanks to Benjamin Robin <[email protected]> for >> > helping work through this. >> > >> > V2: Fixes a bug where do_populate_sysroot was running when it should not >> > be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is >> > incorrect (this is already handled by bitbake in the taskgraph, and >> > doesn't need to be manually removed). >> > >> > V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular >> > dependency. meta-world-recipe-sbom also no longer runs in world builds, >> > as there's no reason to this. Finally, fixes a bug where >> > NO_GENERIC_LICENSE files would fail to be found in do_create_spdx >> > (because do_unpack was not run). >> > >> > V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX >> > information is linked to binary packages, or just recipes. Defaults to >> > "0" to significantly reduce the size of the SPDX output. >> > >> > V5: Fixes dummy-sdk-packages to not generate SPDX output, since it >> > does funny things with its arch which prevents it from rebuilding SPDX >> > data properly, and no SPDX data is needed for it anyway >> > >> > V6: Fixes a bug where SPDX task would not correctly re-run when they >> > change, which would cause errors about missing SPDX document. Also >> > updates to the latest version of the SPDX bindings which improves >> > performance >> > >> >> Hi Joshua, >> >> Ok, we are almost there! >> >> I suspect it would work fine on master, but we have a fail on two tests >> that were recently added by Stefano, and were not merged so far. >> >> As both series might still evolve or get reviews, I will probably keep >> both in my branch, but some changes are needed if we want to merge both >> series. > > This is actually semi-intentional. I renamed the "recipe-" SPDX files > to "build-". The fix is simple, but it either needs to be applied to > my changes or Stephanos, depending on the order. Do you have a > preference? >
I do not have any particular preference, so please do as is easier for you. -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#232906): https://lists.openembedded.org/g/openembedded-core/message/232906 Mute This Topic: https://lists.openembedded.org/mt/118246384/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
