Sub-variables (_name, _type, _comment, _id_email) were being looked up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER" "SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF", instead of the value of those variables, breaking the documented ability to use a custom prefix (e.g. MY_COMPANY).
Tested by setting in local.conf: ``` MY_COMPANY_name = "CCCC" MY_COMPANY_type = "organization" SPDX_IMAGE_SUPPLIER = "MY_COMPANY" SPDX_IMAGE_SUPPLIER_name = "AAAA" SPDX_IMAGE_SUPPLIER_type = "organization" SPDX_PACKAGE_SUPPLIER = "MY_COMPANY" SPDX_PACKAGE_SUPPLIER_name = "BBBB" SPDX_PACKAGE_SUPPLIER_type = "organization" ``` And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json` SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC, after there was only CCCC. Signed-off-by: iwanicki92 <[email protected]> --- meta/lib/oe/sbom30.py | 6 +++++- meta/lib/oe/spdx30_tasks.py | 10 +++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py index e02382c3cc78..5af2e4ff1c0c 100644 --- a/meta/lib/oe/sbom30.py +++ b/meta/lib/oe/sbom30.py @@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): self.doc.import_.append(m) return spdxid - def new_agent(self, varname, *, creation_info=None, add=True): + def new_agent(self, varname, *, creation_info=None, add=True, expand=False): + if expand: + varname = self.d.getVar(f"{varname}") + if not varname: + return None ref_varname = self.d.getVar(f"{varname}_ref") if ref_varname: if ref_varname == varname: diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index dac02e378429..88c707476a65 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -905,7 +905,7 @@ def create_spdx(d): force_purposes=["install"], ) - supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER") + supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER", expand=True) if supplier is not None: spdx_package.suppliedBy = ( supplier if isinstance(supplier, str) else supplier._id @@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d): objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False) host_import_key = d.getVar("SPDX_BUILD_HOST") - invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False) - on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False) + invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False, expand=True) + on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False, expand=True) if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1": # Since the Build objects are unique, we may as well set the creation @@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d): objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements) # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined - supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False) + supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False, expand=True) if supplier is not None: supplier_id = supplier if isinstance(supplier, str) else supplier._id if not isinstance(supplier, str): @@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname): ) # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined - supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False) + supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False, expand=True) if supplier is not None: supplier_id = supplier if isinstance(supplier, str) else supplier._id if not isinstance(supplier, str): -- 2.55.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244005): https://lists.openembedded.org/g/openembedded-core/message/244005 Mute This Topic: https://lists.openembedded.org/mt/120881435/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
