Hello, as discussed before here https://lists.openembedded.org/g/openembedded-core/message/226131 and here https://lists.openembedded.org/g/openembedded-core/message/225774
it would be good to include information about the layers used in a build in the generated spdx documents. My primary goal is to track where all the configuration files added via file protocol in `SRC_URI` originate from, but the approach could be extended to track recipes, classes, machine config etc. These patches are meant as a basis to discuss the approach and should be considered draft status. The approach is to generate a `layers.spdx.json` on each build invocation that lists each layer used in the build as a `softwarePackage` with version and source information as well as - if can be reasonably deducted - the downloadLocation. Each source file added via file protocol is then linked to the containing meta layer via a `contains` relationship. Open Questions: - is the overall architecture reasonable/correct? - referring to layers is inconsistent across tooling. E.g. the core layer is either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is the layer directory in the openembedded-core repository. I chose the latter since that is what the utility function `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL) implementation uses the other naming scheme though. Any thoughts on which should be chosen and why? - I do not understand the alias linking yet. With the current implementation I see many hash mismatches like WARNING: gcc-runtime-15.3.0-r0 do_create_spdx: Element http://spdx.org/spdxdocs/layers-7ad0d8d7-57f9-5c3c-9411-49227dd50610/layers/layer/meta has alias http://spdx.org/spdxdocs/UNIHASH-7ad0d8d7-57f9-5c3c-9411-49227dd50610/UNIHASH/layer/meta, but it should have prefix http://spdxdocs.org/openembedded-alias/by-doc-hash/e80f1d61f4749e663e80a4dfb25ebb1127b5f50600d3065de7ed91030942a1ef/ I've currently got some time available to work on this to get a proper solution integrated into openembedded-core. Best Wishes Daniel Wagenknecht Daniel Wagenknecht (2): spdx: add entries for meta-layers spdx: link files to the meta-layer providing them meta/classes/create-spdx-3.0.bbclass | 1 + meta/classes/spdx-common.bbclass | 3 + meta/lib/oe/sbom30.py | 12 +++ meta/lib/oe/spdx30_tasks.py | 118 ++++++++++++++++++++++++++- 4 files changed, 130 insertions(+), 4 deletions(-) -- 2.54.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245763): https://lists.openembedded.org/g/openembedded-core/message/245763 Mute This Topic: https://lists.openembedded.org/mt/121240836/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
