On Mon, Aug 24, 2026 at 2:14 PM iwanicki92 via lists.openembedded.org <[email protected]> wrote:
> Sub-variables (_name, _type, _comment, _id_email) were being looked > up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER" > "SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF", > instead of the value of those variables, breaking the documented > ability to use a custom prefix (e.g. MY_COMPANY). > > Tested by setting in local.conf: > > ``` > MY_COMPANY_name = "CCCC" > MY_COMPANY_type = "organization" > SPDX_IMAGE_SUPPLIER = "MY_COMPANY" > SPDX_IMAGE_SUPPLIER_name = "AAAA" > SPDX_IMAGE_SUPPLIER_type = "organization" > SPDX_PACKAGE_SUPPLIER = "MY_COMPANY" > SPDX_PACKAGE_SUPPLIER_name = "BBBB" > SPDX_PACKAGE_SUPPLIER_type = "organization" > ``` > > And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json` > SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC, > after there was only CCCC. > This isn't how these variables are intended to work; I'm not sure where the documentation you found suggests this, but the values for any base variable are suffixes always appended to that base variable. For example: SPDX_IMAGE_SUPPLIER = "MY_COMPANY" SPDX_IMAGE_SUPPLIER_MY_COMPANY_name = "CCCC" SPDX_IMAGE_SUPPLIER_MY_COMPANY_type = "organization" > Signed-off-by: iwanicki92 <[email protected]> > --- > Changes in v2: > > Change the expand path to fallback to `varname` itself when lookup > doesn't find anything. This change allows for both old, undocumented `_ref` > indirection and documented indirection (`SPDX_* = "<PREFIX>"`) > --- > meta/lib/oe/sbom30.py | 6 +++++- > meta/lib/oe/spdx30_tasks.py | 10 +++++----- > 2 files changed, 10 insertions(+), 6 deletions(-) > > diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py > index e02382c3cc78..becf9e30d392 100644 > --- a/meta/lib/oe/sbom30.py > +++ b/meta/lib/oe/sbom30.py > @@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): > self.doc.import_.append(m) > return spdxid > > - def new_agent(self, varname, *, creation_info=None, add=True): > + def new_agent(self, varname, *, creation_info=None, add=True, > expand=False): > + if expand: > + varname = self.d.getVar(varname) or varname > + if not varname: > + return None > ref_varname = self.d.getVar(f"{varname}_ref") > if ref_varname: > if ref_varname == varname: > diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py > index dac02e378429..88c707476a65 100644 > --- a/meta/lib/oe/spdx30_tasks.py > +++ b/meta/lib/oe/spdx30_tasks.py > @@ -905,7 +905,7 @@ def create_spdx(d): > force_purposes=["install"], > ) > > - supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER") > + supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER", > expand=True) > if supplier is not None: > spdx_package.suppliedBy = ( > supplier if isinstance(supplier, str) else > supplier._id > @@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d): > objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False) > > host_import_key = d.getVar("SPDX_BUILD_HOST") > - invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False) > - on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False) > + invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False, > expand=True) > + on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False, > expand=True) > > if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1": > # Since the Build objects are unique, we may as well set the > creation > @@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d): > objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements) > > # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined > - supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False) > + supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False, > expand=True) > if supplier is not None: > supplier_id = supplier if isinstance(supplier, str) else > supplier._id > if not isinstance(supplier, str): > @@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, > toolchain_outputname): > ) > > # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined > - supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False) > + supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False, > expand=True) > if supplier is not None: > supplier_id = supplier if isinstance(supplier, str) else > supplier._id > if not isinstance(supplier, str): > -- > 2.55.0 > > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244155): https://lists.openembedded.org/g/openembedded-core/message/244155 Mute This Topic: https://lists.openembedded.org/mt/120910416/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
