From: Daniel Turull <[email protected]> We have a requirements to include release time of open source components in the SBOM. There is a field specific for that in spdx 3 spec.
https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Properties/releaseTime/ This can also be used to evaluate how old are some of the core components and decide if they need replacement. The previous 2 versions did not have cover letter. Tested with oe-selftest -r spdx Daniel Turull (3): classes/base: exclude __CACHED_SOURCE_DATE_EPOCH from task hash create-spdx-3.0: record component release date in SPDX output scripts/contrib: add spdx-release-date-report.py meta/classes-global/base.bbclass | 4 + meta/classes/create-spdx-3.0.bbclass | 2 +- meta/lib/oe/spdx30_tasks.py | 19 ++ meta/lib/oeqa/selftest/cases/spdx.py | 39 ++++ scripts/contrib/spdx-release-date-report.py | 193 ++++++++++++++++++++ 5 files changed, 256 insertions(+), 1 deletion(-) create mode 100755 scripts/contrib/spdx-release-date-report.py
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246788): https://lists.openembedded.org/g/openembedded-core/message/246788 Mute This Topic: https://lists.openembedded.org/mt/121478114/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
