On Mon, 2026-07-27 at 10:34 +0200, Benjamin Robin wrote:
> The overall goal of this series is to fix SPDX SBoM generation in such a way
> that it correctly includes the kernel compiled sources for all cases.
>
> Currently the SPDX is only generated properly for the following case: A kernel
> recipe using git sources with kernel-yocto class.
> With this series, if a kernel recipe only inherit the kernel class and use a
> tar file for the kernel sources, the SPDX file now contains the proper list
> of compiled files.
>
> But while testing this series, I found out that SPDX_INCLUDE_COMPILED_SOURCES
> for something else that a kernel recipe is broken (and never worked?).
I think it worked with busybox and spdx2. But since the kernel was the only
project at that time
that had CVE information at the file level I did not follow up.
>
> In save_debugsources_info() this `src.replace(f"{debugsrcdir}/{pn}/", "")`
> is never executed since `KERNEL_SRC_PATH` is always defined globally.
> But even if this part is going to be executed, this is still not going to
> work.
>
> Am I missing something here?
probably not. my focus was on the kernel
>
> I also found out that if PACKAGE_DEBUG_STATIC_SPLIT is defined (which is not
> documented, introduced in commit 17fa66c8199d73f0b59b2b3e609075933bf1e74b)
> then the `results` variable is overridden instead of being extended.
>
> Signed-off-by: Benjamin Robin <[email protected]>
> ---
> Benjamin Robin (3):
> spdx_common: simplify get_patched_src() implementation
> spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
> spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
>
> meta/lib/oe/spdx30_tasks.py | 1 -
> meta/lib/oe/spdx_common.py | 83
> ++++++++++++++++++++++-----------------------
> 2 files changed, 40 insertions(+), 44 deletions(-)
> ---
> base-commit: 9a25b3e72051a30794e147564028487a598ce82d
> change-id: 20260726-fix-get-patched-src-989695c1541d
>
> Best regards,
> --
> Benjamin Robin <[email protected]>
Cheers,
Daniel
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#242172):
https://lists.openembedded.org/g/openembedded-core/message/242172
Mute This Topic: https://lists.openembedded.org/mt/120463981/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
