On Sun, 2026-07-05 at 09:29 +0100, Richard Purdie via lists.openembedded.org wrote: > On Tue, 2026-06-30 at 15:01 -0600, Joshua Watt via > lists.openembedded.org wrote: > > The SPDX use case for file system image has been well defined since > > SPDX > > was first implemented, however there has always been a desire to > > also > > express SPDX output for other non-image deliverables (primarily, > > those > > that have a do_deploy task or similar). These types of tasks cannot > > easily use the traditional method of having a separate SPDX task > > that > > runs to create their SPDX output as this causes lots of problems > > with > > the way dependencies are specified. Instead, it is desirable for > > these > > tasks to directly produce SPDX output that can be consumed by other > > tasks that depend on them. > > > > This patch series adds support for this. Any sstate task that > > starts > > with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and > > it > > will run a postfunc to generate SPDX output that describes what is > > being > > deployed. For classical do_deploy tasks, this is setup to be easy > > by > > automatically capturing all the deployed output files in the SPDX > > data, > > but other tasks can be added as well. > > > > Finally, the do_create_image_spdx task is removed and replaced with > > a > > SPDX deploy postfunc using this new system. This means that any > > task > > that depends on do_image_complete will automatically also get the > > SPDX > > output for the image, simplifying the dependency handling. > > > > V2: Fixed SPDX documents missing at SBoM creation time when the > > documents were not a direct dependency of the SBoM, and were > > present in > > a sstate object. Previously, these sstate objects were not restored > > because they were "covered" by the later sstate tasks, but now they > > are > > restored if they are depended on by a task that creates SPDX > > output. > > > > V3: Fixed a bug where dependencies that are not in the taskhash > > could be > > missing when the final SBoM is created and added tests. > > > > V4: Fixed some testing errors that revealed that EFI providers have > > to > > be MACHINE_ARCH (and consequently, wic-tools) > > > > Joshua Watt (10): > > spdx: Skip dependencies that are not in the taskhash > > spdx: Add ability for deploy tasks to create SPDX > > oeqa: Add SPDX deploy SBoM test > > classes-global/sstate: Keep SPDX generating setscene dependencies > > Add SPDX deploy tasks to various recipes > > spdx: Replace do_create_image_spdx with deploy task > > grub-efi: Change to MACHINE_ARCH > > systemd-boot: Change to MACHINE_ARCH > > multilib: Add systemd-boot to NON_MULTILIB_RECIPES > > wic-tools: Change to MACHINE_ARCH > > There is something not quite right in here which I suspect, but > havve't > currently conclusively prove caused: > > https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4276 > https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4216
Those failures were not related to this series... Cheers, Richard
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240276): https://lists.openembedded.org/g/openembedded-core/message/240276 Mute This Topic: https://lists.openembedded.org/mt/120054245/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
