On Thu Oct 8, 2026 at 3:50 PM CEST, Yoann Congal wrote:
> On Thu Sep 17, 2026 at 6:24 AM CEST, KAZUYOSHI AKIYAMA via
> lists.openembedded.org wrote:
>> SPDX_INCLUDE_COMPILED_SOURCES is meant to filter all source files down to
>> only the ones that were compiled before adding them to the SBOM,
>> but on wrynose it doesn't work.
>> add_package_files() is what picks which files go into the SBOM.
>> It walks ${SPDXWORK} itself to get file paths,
>> then keeps only the ones that match the list of compiled sources
>> returned by get_compiled_sources().
>> get_compiled_sources() just returns what save_debugsources_info() stored,
>> and that data uses paths rooted at ${TARGET_DBGSRC_DIR}
>> (= /usr/src/debug/${PN}/${PV}), not the ${SPDXWORK}-rooted paths
>> add_package_files() compares against.
>> So the list get_compiled_sources() returns never matches
>> what add_package_files() is comparing,
>> and almost every file ends up marked as not compiled.
>> This happens for every recipe except the kernel,
>> which has its own special-cased path.
>>
>> This isn't just a matter of the SBOM missing the right files.
>> sbom-cve-check uses the same match result to decide whether
>> a vulnerable file was actually built, for its vulnerability triage.
>> If the match count is always zero, that triage doesn't work either.
>> On yocto-6.0.2 we confirmed the misjudgment affects cpio and perl.
>>
>> master already has this fixed,
>> and this backport brings that fix to wrynose.
>> b567c2f0d9 is the commit that fixes it.
>> Everything else in the series is a prerequisite for that patch.
>> Backporting b567c2f0d9 along with its prerequisites
>> brings wrynose's behavior in line with master.
>> With this, compiled sources get counted correctly,
>> and sbom-cve-check's triage works correctly too.
>>
>> On wrynose (genericx86-64, core-image-full-cmdline),
>> the match rate goes from effectively zero to 93.9%.
>>
>> One thing changes.
>> What the SBOM records as a source file name changes too.
>> aa44a0f0eb re-unpacks under UNPACKDIR instead of WORKDIR,
>> so a recorded source file name changes
>> (e.g. sources/acl-2.3.2/... becomes acl-2.3.2/...).
>> This is a change to SBOM metadata only.
>> The actual build output is unaffected.
>> Anyone diffing SBOMs across LTS point releases will see it.
>>
>> Signed-off-by: Kazuyoshi Akiyama <[email protected]>
>> ---
>> Benjamin Robin (4):
>> spdx_common: simplify get_patched_src() implementation
>> spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
>> spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
>> package: no longer modify paths in save_debugsources_info()
>>
>> meta/lib/oe/package.py | 54 +++++++++----------
>> meta/lib/oe/spdx30_tasks.py | 1 -
>> meta/lib/oe/spdx_common.py | 125
>> +++++++++++++++++++++++++++-----------------
>> 3 files changed, 101 insertions(+), 79 deletions(-)
>> ---
>> base-commit: 9da814ca3685ada3fce46b8987f04ed3d57247b7
>> change-id: 20260917-backport-wrynose-8fa831054074
>>
>> Best regards,
>> --
>> Kazuyoshi Akiyama <[email protected]>
>
> Independently of the "stable-worthyness" in the sibling thread. I tested
> this and got a failure that I think is related to this series:
> oe-selftest-fedora rocky8-vk-1 wrynose completed at 2026-10-05 18:01:07+00:00
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/48/builds/4820
>
> oe-selftest-debian debian12-vk-9 wrynose completed at 2026-10-08
> 11:44:05+00:00
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/5026
> Re-run as:
> oe-selftest-debian debian12-vk-9 wrynose completed at 2026-10-08
> 11:44:05+00:00
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/5026
>
> oe-selftest-fedora opensuse160-vk-2 wrynose completed at 2026-10-08
> 11:45:38+00:00
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/48/builds/4840
> Re-run as:
> oe-selftest-fedora opensuse160-vk-2 wrynose completed at 2026-10-08
> 11:45:38+00:00
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/48/builds/4840
>
> I started a build without this series:
> oe-selftest-debian debian12-vk-6 wrynose still running
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/5027
That build (5027) also failed like those before but did not have this
series. I conclude that this series does not cause these failures.
Sorry for the noise.
--
Yoann Congal
Smile ECS
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#247436):
https://lists.openembedded.org/g/openembedded-core/message/247436
Mute This Topic: https://lists.openembedded.org/mt/121291546/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
