On Tue, 2026-06-30 at 15:01 -0600, Joshua Watt via lists.openembedded.org wrote: > The SPDX use case for file system image has been well defined since SPDX > was first implemented, however there has always been a desire to also > express SPDX output for other non-image deliverables (primarily, those > that have a do_deploy task or similar). These types of tasks cannot > easily use the traditional method of having a separate SPDX task that > runs to create their SPDX output as this causes lots of problems with > the way dependencies are specified. Instead, it is desirable for these > tasks to directly produce SPDX output that can be consumed by other > tasks that depend on them. > > This patch series adds support for this. Any sstate task that starts > with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and it > will run a postfunc to generate SPDX output that describes what is being > deployed. For classical do_deploy tasks, this is setup to be easy by > automatically capturing all the deployed output files in the SPDX data, > but other tasks can be added as well. > > Finally, the do_create_image_spdx task is removed and replaced with a > SPDX deploy postfunc using this new system. This means that any task > that depends on do_image_complete will automatically also get the SPDX > output for the image, simplifying the dependency handling. > > V2: Fixed SPDX documents missing at SBoM creation time when the > documents were not a direct dependency of the SBoM, and were present in > a sstate object. Previously, these sstate objects were not restored > because they were "covered" by the later sstate tasks, but now they are > restored if they are depended on by a task that creates SPDX output. > > V3: Fixed a bug where dependencies that are not in the taskhash could be > missing when the final SBoM is created and added tests. > > V4: Fixed some testing errors that revealed that EFI providers have to > be MACHINE_ARCH (and consequently, wic-tools) > > Joshua Watt (10): > spdx: Skip dependencies that are not in the taskhash > spdx: Add ability for deploy tasks to create SPDX > oeqa: Add SPDX deploy SBoM test > classes-global/sstate: Keep SPDX generating setscene dependencies > Add SPDX deploy tasks to various recipes > spdx: Replace do_create_image_spdx with deploy task > grub-efi: Change to MACHINE_ARCH > systemd-boot: Change to MACHINE_ARCH > multilib: Add systemd-boot to NON_MULTILIB_RECIPES > wic-tools: Change to MACHINE_ARCH
There is something not quite right in here which I suspect, but havve't currently conclusively prove caused: https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4276 https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4216 Cheers, Richard
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240143): https://lists.openembedded.org/g/openembedded-core/message/240143 Mute This Topic: https://lists.openembedded.org/mt/120054245/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
