On Thu, Dec 12, 2024 at 4:09 AM Hongxu Jia <[email protected]> wrote: > > After commit [spdx 3.0: Rework how SPDX aliases are linked] applied, it set > license_text_map with alias other than actual spdxId > > The property of simplelicensing_customIdToUri is > ListProp(ObjectProp(DictionaryEntry))), > and class DictionaryEntry has key and value, the property of value is > StringProp other > than ObjectProp in which could not support to decode/extract alias with > actual spdxId in > image jsonld file > > $ bitbake core-image-minimal > $ vim > tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.rootfs.spdx.json > ... > "simplelicensing_customIdToUri": [ > { > "type": "DictionaryEntry", > "key": "LicenseRef-PD", > "value": > "http://spdxdocs.org/openembedded-alias/by-doc-hash/d53e90e23b12c4ad640809a74a810e86f31c76cdbdf36487712d22a33d53362a/sqlite3-native/UNIHASH/license-text/PD"; > } > ], > ... > > After applying this commit, revert [spdx 3.0: Rework how SPDX aliases are > linked] > to set actual spdxId other than alias to dictionary license_text_map > ... > "simplelicensing_customIdToUri": [ > { > "type": "DictionaryEntry", > "key": "LicenseRef-PD", > "value": > "http://spdx.org/spdxdocs/sqlite3-native-e5cc0672-d8dd-57e8-a2df-fe4615831fda/162c62b5b011cd3f82f413b3dae4d6d1542201552c964d5ce69fe170e0720b85/license-text/PD"; > } > ] > ... > > Signed-off-by: Hongxu Jia <[email protected]> > --- > meta/lib/oe/spdx30_tasks.py | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py > index 036c58bf4b..82fcfe7a63 100644 > --- a/meta/lib/oe/spdx30_tasks.py > +++ b/meta/lib/oe/spdx30_tasks.py > @@ -107,9 +107,7 @@ def add_license_expression(d, objset, license_expression, > license_data): > > spdx_license = "LicenseRef-" + l > if spdx_license not in license_text_map: > - license_text_map[spdx_license] = oe.sbom30.get_element_link_id( > - add_license_text(l) > - ) > + license_text_map[spdx_license] = add_license_text(l)._id
Ah, sorry, this will not work because the SPDX IDs can be wrong anytime that documents are referenced across sstate objects. This is why we have aliases in the first place so that they can be "looked up" independently of their actual SPDX ID, until they are all linked together in the final SPDX document. This works for normal object references just fine because the alias SPDX IDs are "missing" when the document is merged, and our code knows how to pull in those SPDX IDs by the "missing" alias to resolve them. Unfortunately, since a DictionaryEntry holds a free form string for the value, that doesn't work here. Instead, we will need to add special code in the linking to manually go through all of the simplelicensing_customIdToUri DictionaryEntry items and resolve any aliases to actual objects. I think that needs to go in expand_collection() in sbom30.py > > return spdx_license > > -- > 2.25.1 >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#208699): https://lists.openembedded.org/g/openembedded-core/message/208699 Mute This Topic: https://lists.openembedded.org/mt/110077885/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
