Software composition tooling is useful to have in an SDK for generating or checking SPDX documents and scanning artifacts, but it is not needed by every SDK and pulls in a Python dependency chain, so it should be opt-in rather than always present.
Add an "sbom" SDK feature that pulls in the SPDX and SBOM/CVE tools (nativesdk-python3-spdx-tools and nativesdk-python3-sbom-cve-check). It is not enabled by default; a configuration that wants it adds the "sbom" feature to SDK_FEATURES. AI-Generated: codex/claude-opus 4.8 (xhigh) Signed-off-by: Trevor Woerner <[email protected]> --- changes in v4: - reordered ahead of the default-on qemu and gdb features so the opt-in features are grouped together changes in v3: - new in v3 --- .../packagegroups/nativesdk-packagegroup-sdk-host.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb b/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb index c2974a57fe3e..31710a23969e 100644 --- a/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb +++ b/meta/recipes-core/packagegroups/nativesdk-packagegroup-sdk-host.bb @@ -30,6 +30,7 @@ RDEPENDS:${PN} = "\ nativesdk-flex \ nativesdk-perl-module-integer \ ${@bb.utils.contains('SDK_FEATURES', 'wic', 'nativesdk-wic', '', d)} \ + ${@bb.utils.contains('SDK_FEATURES', 'sbom', 'nativesdk-python3-spdx-tools nativesdk-python3-sbom-cve-check', '', d)} \ " RDEPENDS:${PN}:darwin = "\ -- 2.50.0.173.g8b6f19ccfc3a
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241917): https://lists.openembedded.org/g/openembedded-core/message/241917 Mute This Topic: https://lists.openembedded.org/mt/120422971/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
