Currently the by-id and by-namespace SPDX files are created without reference
to PACKAGE_ARCH. This means that for two machines using a common package
architecture
(e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This
means
that the build of one can remove files from the other leading to build
failures. An
example would be:
MACHINE=qemux86-64 bitbake core-image-minimal
MACHINE=genericx86-64 bitbake core-image-minimal
MACHINE=qemux86-64 bitbake linux-yocto -c clean
MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
To fix this, add PACKAGE_ARCH to the path used for the files and use a search
path based upon PACKAGE_ARCHS to access them.
Signed-off-by: Richard Purdie <richard.pur...@linuxfoundation.org>
---
meta/classes/create-spdx-2.2.bbclass | 31 ++++++++++++++++++----------
meta/lib/oe/sbom.py | 20 ++++++++++++------
2 files changed, 34 insertions(+), 17 deletions(-)
v2 - Use reversed order of SSTATE_ARCHS
diff --git a/meta/classes/create-spdx-2.2.bbclass
b/meta/classes/create-spdx-2.2.bbclass
index 9b28d124c78..39110823c0c 100644
--- a/meta/classes/create-spdx-2.2.bbclass
+++ b/meta/classes/create-spdx-2.2.bbclass
@@ -349,6 +349,8 @@ def collect_dep_recipes(d, doc, spdx_recipe):
deploy_dir_spdx = Path(d.getVar("DEPLOY_DIR_SPDX"))
spdx_deps_file = Path(d.getVar("SPDXDEPS"))
+ package_archs = d.getVar("SSTATE_ARCHS").split()
+ package_archs.reverse()
dep_recipes = []
@@ -356,7 +358,7 @@ def collect_dep_recipes(d, doc, spdx_recipe):
deps = json.load(f)
for dep_pn, dep_hashfn in deps:
- dep_recipe_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
"recipe-" + dep_pn, dep_hashfn)
+ dep_recipe_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
package_archs, "recipe-" + dep_pn, dep_hashfn)
spdx_dep_doc, spdx_dep_sha1 = oe.sbom.read_doc(dep_recipe_path)
@@ -385,6 +387,7 @@ def collect_dep_recipes(d, doc, spdx_recipe):
return dep_recipes
+collect_dep_recipes[vardepsexclude] = "SSTATE_ARCHS"
def collect_dep_sources(d, dep_recipes):
import oe.sbom
@@ -533,6 +536,7 @@ python do_create_spdx() {
include_sources = d.getVar("SPDX_INCLUDE_SOURCES") == "1"
archive_sources = d.getVar("SPDX_ARCHIVE_SOURCES") == "1"
archive_packaged = d.getVar("SPDX_ARCHIVE_PACKAGED") == "1"
+ pkg_arch = d.getVar("SSTATE_PKGARCH")
creation_time =
datetime.now(tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
@@ -620,7 +624,7 @@ python do_create_spdx() {
dep_recipes = collect_dep_recipes(d, doc, recipe)
- doc_sha1 = oe.sbom.write_doc(d, doc, d.getVar("SSTATE_PKGARCH"),
"recipes", indent=get_json_indent(d))
+ doc_sha1 = oe.sbom.write_doc(d, doc, pkg_arch, "recipes",
indent=get_json_indent(d))
dep_recipes.append(oe.sbom.DepRecipe(doc, doc_sha1, recipe))
recipe_ref = oe.spdx.SPDXExternalDocumentRef()
@@ -685,7 +689,7 @@ python do_create_spdx() {
add_package_sources_from_debug(d, package_doc, spdx_package,
package, package_files, sources)
- oe.sbom.write_doc(d, package_doc, d.getVar("SSTATE_PKGARCH"),
"packages", indent=get_json_indent(d))
+ oe.sbom.write_doc(d, package_doc, pkg_arch, "packages",
indent=get_json_indent(d))
}
do_create_spdx[vardepsexclude] += "BB_NUMBER_THREADS"
# NOTE: depending on do_unpack is a hack that is necessary to get it's
dependencies for archive the source
@@ -756,6 +760,9 @@ python do_create_runtime_spdx() {
creation_time =
datetime.now(tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
providers = collect_package_providers(d)
+ pkg_arch = d.getVar("SSTATE_PKGARCH")
+ package_archs = d.getVar("SSTATE_ARCHS").split()
+ package_archs.reverse()
if not is_native:
bb.build.exec_func("read_subpackage_metadata", d)
@@ -772,7 +779,7 @@ python do_create_runtime_spdx() {
if not oe.packagedata.packaged(package, localdata):
continue
- pkg_spdx_path = oe.sbom.doc_path(deploy_dir_spdx, pkg_name,
d.getVar("SSTATE_PKGARCH"), "packages")
+ pkg_spdx_path = oe.sbom.doc_path(deploy_dir_spdx, pkg_name,
pkg_arch, "packages")
package_doc, package_doc_sha1 = oe.sbom.read_doc(pkg_spdx_path)
@@ -827,7 +834,7 @@ python do_create_runtime_spdx() {
if dep in dep_package_cache:
(dep_spdx_package, dep_package_ref) =
dep_package_cache[dep]
else:
- dep_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
dep_pkg, dep_hashfn)
+ dep_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
package_archs, dep_pkg, dep_hashfn)
spdx_dep_doc, spdx_dep_sha1 = oe.sbom.read_doc(dep_path)
@@ -855,10 +862,10 @@ python do_create_runtime_spdx() {
)
seen_deps.add(dep)
- oe.sbom.write_doc(d, runtime_doc, d.getVar("SSTATE_PKGARCH"),
"runtime", spdx_deploy, indent=get_json_indent(d))
+ oe.sbom.write_doc(d, runtime_doc, pkg_arch, "runtime",
spdx_deploy, indent=get_json_indent(d))
}
-do_create_runtime_spdx[vardepsexclude] += "OVERRIDES"
+do_create_runtime_spdx[vardepsexclude] += "OVERRIDES SSTATE_ARCHS"
addtask do_create_runtime_spdx after do_create_spdx before do_build do_rm_work
SSTATETASKS += "do_create_runtime_spdx"
@@ -993,6 +1000,8 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir,
rootfs_spdxid, packages, spdx
import bb.compress.zstd
providers = collect_package_providers(d)
+ package_archs = d.getVar("SSTATE_ARCHS").split()
+ package_archs.reverse()
creation_time =
datetime.now(tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
deploy_dir_spdx = Path(d.getVar("DEPLOY_DIR_SPDX"))
@@ -1022,7 +1031,7 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir,
rootfs_spdxid, packages, spdx
pkg_name, pkg_hashfn = providers[name]
- pkg_spdx_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx, pkg_name,
pkg_hashfn)
+ pkg_spdx_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
package_archs, pkg_name, pkg_hashfn)
pkg_doc, pkg_doc_sha1 = oe.sbom.read_doc(pkg_spdx_path)
for p in pkg_doc.packages:
@@ -1039,7 +1048,7 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir,
rootfs_spdxid, packages, spdx
else:
bb.fatal("Unable to find package with name '%s' in SPDX file %s" %
(name, pkg_spdx_path))
- runtime_spdx_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
"runtime-" + name, pkg_hashfn)
+ runtime_spdx_path = oe.sbom.doc_path_by_hashfn(deploy_dir_spdx,
package_archs, "runtime-" + name, pkg_hashfn)
runtime_doc, runtime_doc_sha1 = oe.sbom.read_doc(runtime_spdx_path)
runtime_ref = oe.spdx.SPDXExternalDocumentRef()
@@ -1111,7 +1120,7 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir,
rootfs_spdxid, packages, spdx
})
for ref in doc.externalDocumentRefs:
- ref_path = oe.sbom.doc_path_by_namespace(deploy_dir_spdx,
ref.spdxDocument)
+ ref_path = oe.sbom.doc_path_by_namespace(deploy_dir_spdx,
package_archs, ref.spdxDocument)
collect_spdx_document(ref_path)
collect_spdx_document(image_spdx_path)
@@ -1134,4 +1143,4 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir,
rootfs_spdxid, packages, spdx
tar.addfile(info, fileobj=index_str)
-combine_spdx[vardepsexclude] += "BB_NUMBER_THREADS"
+combine_spdx[vardepsexclude] += "BB_NUMBER_THREADS SSTATE_ARCHS"
diff --git a/meta/lib/oe/sbom.py b/meta/lib/oe/sbom.py
index 1130fa668bd..cddbf3cc51c 100644
--- a/meta/lib/oe/sbom.py
+++ b/meta/lib/oe/sbom.py
@@ -38,12 +38,20 @@ def get_sdk_spdxid(sdk):
return "SPDXRef-SDK-%s" % sdk
-def doc_path_by_namespace(spdx_deploy, doc_namespace):
- return spdx_deploy / "by-namespace" / doc_namespace.replace("/", "_")
+def doc_path_by_namespace(spdx_deploy, archs, doc_namespace):
+ for pkgarch in archs:
+ filename = spdx_deploy / "by-namespace" / pkgarch /
doc_namespace.replace("/", "_")
+ if os.path.exists(filename):
+ break
+ return filename
-def doc_path_by_hashfn(spdx_deploy, doc_name, hashfn):
- return spdx_deploy / "by-hash" / hashfn.split()[1] / (doc_name +
".spdx.json")
+def doc_path_by_hashfn(spdx_deploy, archs, doc_name, hashfn):
+ for pkgarch in archs:
+ filename = spdx_deploy / "by-hash" / pkgarch / hashfn.split()[1] /
(doc_name + ".spdx.json")
+ if os.path.exists(filename):
+ break
+ return filename
def doc_path(spdx_deploy, doc_name, arch, subdir):
@@ -61,11 +69,11 @@ def write_doc(d, spdx_doc, arch, subdir, spdx_deploy=None,
indent=None):
with dest.open("wb") as f:
doc_sha1 = spdx_doc.to_json(f, sort_keys=True, indent=indent)
- l = doc_path_by_namespace(spdx_deploy, spdx_doc.documentNamespace)
+ l = doc_path_by_namespace(spdx_deploy, [arch], spdx_doc.documentNamespace)
l.parent.mkdir(exist_ok=True, parents=True)
l.symlink_to(os.path.relpath(dest, l.parent))
- l = doc_path_by_hashfn(spdx_deploy, spdx_doc.name,
d.getVar("BB_HASHFILENAME"))
+ l = doc_path_by_hashfn(spdx_deploy, [arch], spdx_doc.name,
d.getVar("BB_HASHFILENAME"))
l.parent.mkdir(exist_ok=True, parents=True)
l.symlink_to(os.path.relpath(dest, l.parent))
--
2.39.2
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#187918):
https://lists.openembedded.org/g/openembedded-core/message/187918
Mute This Topic: https://lists.openembedded.org/mt/101475772/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
