On Tue Jun 30, 2026 at 11:01 PM CEST, Joshua Watt via lists.openembedded.org wrote: > The SPDX use case for file system image has been well defined since SPDX > was first implemented, however there has always been a desire to also > express SPDX output for other non-image deliverables (primarily, those > that have a do_deploy task or similar). These types of tasks cannot > easily use the traditional method of having a separate SPDX task that > runs to create their SPDX output as this causes lots of problems with > the way dependencies are specified. Instead, it is desirable for these > tasks to directly produce SPDX output that can be consumed by other > tasks that depend on them. > > This patch series adds support for this. Any sstate task that starts > with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and it > will run a postfunc to generate SPDX output that describes what is being > deployed. For classical do_deploy tasks, this is setup to be easy by > automatically capturing all the deployed output files in the SPDX data, > but other tasks can be added as well. > > Finally, the do_create_image_spdx task is removed and replaced with a > SPDX deploy postfunc using this new system. This means that any task > that depends on do_image_complete will automatically also get the SPDX > output for the image, simplifying the dependency handling. > > V2: Fixed SPDX documents missing at SBoM creation time when the > documents were not a direct dependency of the SBoM, and were present in > a sstate object. Previously, these sstate objects were not restored > because they were "covered" by the later sstate tasks, but now they are > restored if they are depended on by a task that creates SPDX output. > > V3: Fixed a bug where dependencies that are not in the taskhash could be > missing when the final SBoM is created and added tests. > > V4: Fixed some testing errors that revealed that EFI providers have to > be MACHINE_ARCH (and consequently, wic-tools) >
Hi Joshua, Thanks for the new version. We now have just one warning remaining: WARNING: core-image-full-cmdline-1.0-r0 do_create_image_sbom_spdx: The following SPDX IDs were unable to be resolved: http://spdxdocs.org/openembedded-alias/by-doc-hash/6e0461f8d0ebcd6cab741ff4175cb1256279c1657d809f71c257fb2a0991e7ca/eudev/UNIHASH/package/eudev ... WARNING: core-image-sato-1.0-r0 do_create_image_sbom_spdx: The following SPDX IDs were unable to be resolved: http://spdxdocs.org/openembedded-alias/by-doc-hash/6e0461f8d0ebcd6cab741ff4175cb1256279c1657d809f71c257fb2a0991e7ca/eudev/UNIHASH/package/eudev https://autobuilder.yoctoproject.org/valkyrie/#/builders/22/builds/4059 Thanks, Mathieu -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240022): https://lists.openembedded.org/g/openembedded-core/message/240022 Mute This Topic: https://lists.openembedded.org/mt/120054245/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
