Software composition tooling is useful to have in an SDK for generating
or checking SPDX documents and scanning artifacts, but it is not needed
by every SDK and pulls in a Python dependency chain, so it should be
opt-in rather than always present.

Add an "sbom" SDK feature that pulls in the SPDX and SBOM/CVE tools
(nativesdk-python3-spdx-tools and nativesdk-python3-sbom-cve-check). It
is not enabled by default; a configuration that wants it adds the "sbom"
feature to SDK_FEATURES.

AI-Generated: codex/claude-opus 4.8 (xhigh)
Signed-off-by: Trevor Woerner <[email protected]>
---
changes in v4:
- reordered ahead of the default-on qemu and gdb features so the opt-in
  features are grouped together

changes in v3:
- new in v3
---
 .../packagegroups/nativesdk-packagegroup-sdk-host.bb             | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb 
b/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb
index c2974a57fe3e..31710a23969e 100644
--- a/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb
+++ b/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb
@@ -30,6 +30,7 @@ RDEPENDS:${PN} = "\
     nativesdk-flex \
     nativesdk-perl-module-integer \
     ${@bb.utils.contains('SDK_FEATURES', 'wic', 'nativesdk-wic', '', d)} \
+    ${@bb.utils.contains('SDK_FEATURES', 'sbom', 'nativesdk-python3-spdx-tools 
nativesdk-python3-sbom-cve-check', '', d)} \
     "
 
 RDEPENDS:${PN}:darwin = "\
-- 
2.50.0.173.g8b6f19ccfc3a

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#241917): 
https://lists.openembedded.org/g/openembedded-core/message/241917
Mute This Topic: https://lists.openembedded.org/mt/120422971/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to