On Tue, 2026-08-04 at 13:24 +0200, [email protected] wrote:
> do_sbom_cve_check builds its input path from ${IMAGE_NAME}, which carries
> ${IMAGE_VERSION_SUFFIX} and so ${DATETIME}. That value is excluded from task
> hashes but changes on every bitbake invocation, so the path is only correct
> when
> do_create_image_sbom_spdx ran in the same invocation.
>
> It does not when the class is newly enabled on an existing build tree: the
> image
> SBOM is already deployed and stamped from an earlier build, do_sbom_cve_check
> has
> never run, so bitbake executes only the latter and it looks for a file whose
> timestamp belongs to the current invocation. The same happens on any forced
> re-run
> of just this task:
>
> $ bitbake -f -c sbom_cve_check core-image-minimal
> ERROR: core-image-minimal-1.0-r0 do_sbom_cve_check: sbom-cve-check failed:
> [...]
> sbom-cve-check: error: [Errno 2] No such file or directory:
> '.../core-image-minimal-qemux86-64.rootfs-20260804101106.spdx.json'
>
> $ ls tmp/deploy/images/qemux86-64/*.spdx.json
> core-image-minimal-qemux86-64.rootfs-20260804095834.spdx.json
> core-image-minimal-qemux86-64.rootfs.spdx.json ->
> ...-20260804095834.spdx.json
>
> The file is there under ${IMAGE_LINK_NAME}, the symlink
> do_create_image_sbom_spdx
> maintains. Keep preferring the timestamped name, so behaviour is unchanged
> whenever
> it exists, and fall back to the symlink rather than failing. Guarded on
> link_name
> being set, since IMAGE_LINK_NAME can be empty.
>
> Signed-off-by: Thomas Roos <[email protected]>
Hi Thomas,
This code has already changed recently in commit 2a80840a4fe0
("sbom-cve-check: Fix breakage with empty IMAGE_LINK_NAME"). Perhaps we
should have just added a fallback to IMAGE_NAME if IMAGE_LINK_NAME is
unset.
A quick scan of the code shows that there are other places where it is
assumed that IMAGE_LINK_NAME is valid, such as vex.bbclass.
Best regards,
--
Paul Barker
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#243636):
https://lists.openembedded.org/g/openembedded-core/message/243636
Mute This Topic: https://lists.openembedded.org/mt/120591845/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
