Mathieu, Here is my latest SPDX patch set (finally!). I'm sorry for the delay and the mix up with Stefano's patches. I believe that you can now stack Stefanos patches on top of mine and everything should be OK
Thank you, Joshua On Wed, Mar 18, 2026 at 7:46 AM Joshua Watt <[email protected]> wrote: > > Changes the SPDX 3 output to include a "recipe" package that describe > static information available at parse time (without building). This is > primarily useful for gathering SPDX 3 VEX information about some or all > recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and > vex.bbclass. > > Special thanks to Benjamin Robin <[email protected]> for > helping work through this. > > V2: Fixes a bug where do_populate_sysroot was running when it should not > be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is > incorrect (this is already handled by bitbake in the taskgraph, and > doesn't need to be manually removed). > > V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular > dependency. meta-world-recipe-sbom also no longer runs in world builds, > as there's no reason to this. Finally, fixes a bug where > NO_GENERIC_LICENSE files would fail to be found in do_create_spdx > (because do_unpack was not run). > > V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX > information is linked to binary packages, or just recipes. Defaults to > "0" to significantly reduce the size of the SPDX output. > > V5: Fixes dummy-sdk-packages to not generate SPDX output, since it > does funny things with its arch which prevents it from rebuilding SPDX > data properly, and no SPDX data is needed for it anyway > > V6: Fixes a bug where SPDX task would not correctly re-run when they > change, which would cause errors about missing SPDX document. Also > updates to the latest version of the SPDX bindings which improves > performance > > V7: Makes meta-world-recipe-sbom create the world SBoM when run with a > task (e.g. as part of do_build). Drops the removal of SPDX from > dummy-sdk-packages as these have been fixed to work properly. > > Joshua Watt (12): > spdx3: Add recipe SPDX data > spdx3: Add recipe SBoM task > spdx3: Add is-native property > spdx30: Include patch file information in VEX > spdx: De-duplicate CreationInfo > spdx_common: Check for dependent task in task flags > spdx30: Remove package VEX > spdx: Remove fatal errors for missing providers > spdx3: Use common variable for vardeps > glibc-testsuite: Do not generate SPDX > spdx: Remove do_collect_spdx_deps task > spdx: Update to latest bindings > > meta/classes-global/sstate.bbclass | 4 +- > .../create-spdx-image-3.0.bbclass | 4 +- > .../create-spdx-sdk-3.0.bbclass | 4 +- > meta/classes-recipe/kernel.bbclass | 2 +- > meta/classes-recipe/nospdx.bbclass | 2 +- > meta/classes/create-spdx-2.2.bbclass | 33 +- > meta/classes/create-spdx-3.0.bbclass | 81 +- > meta/classes/spdx-common.bbclass | 34 +- > meta/conf/distro/include/maintainers.inc | 1 + > meta/lib/oe/sbom30.py | 239 +- > meta/lib/oe/spdx30/__init__.py | 8 + > meta/lib/oe/spdx30/__main__.py | 12 + > meta/lib/oe/spdx30/cmd.py | 75 + > meta/lib/oe/{spdx30.py => spdx30/model.py} | 5935 ++++++++++------- > meta/lib/oe/spdx30/stub.pyi | 2544 +++++++ > meta/lib/oe/spdx30_tasks.py | 459 +- > meta/lib/oe/spdx_common.py | 78 +- > meta/lib/oeqa/selftest/cases/spdx.py | 28 +- > .../glibc/glibc-testsuite_2.43.bb | 1 + > .../meta/meta-world-recipe-sbom.bb | 38 + > scripts/contrib/make-spdx-bindings.sh | 3 +- > 21 files changed, 6837 insertions(+), 2748 deletions(-) > create mode 100644 meta/lib/oe/spdx30/__init__.py > create mode 100644 meta/lib/oe/spdx30/__main__.py > create mode 100644 meta/lib/oe/spdx30/cmd.py > rename meta/lib/oe/{spdx30.py => spdx30/model.py} (52%) > create mode 100644 meta/lib/oe/spdx30/stub.pyi > create mode 100644 meta/recipes-core/meta/meta-world-recipe-sbom.bb > > -- > 2.53.0 >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#233403): https://lists.openembedded.org/g/openembedded-core/message/233403 Mute This Topic: https://lists.openembedded.org/mt/118382774/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
