summaryrefslogtreecommitdiffstats
path: root/meta/classes/create-spdx-2.2.bbclass
Commit message (Collapse)AuthorAgeFilesLines
* create-spdx-2.2: support to override the version of a package in SPDX 2Hongxu Jia2025-07-011-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default, still use ${PV} as the the version of a package in SPDX 2 $ echo 'INHERIT:remove = "create-spdx"' >> conf/local.conf $ echo 'INHERIT += "create-spdx-2.2"' >> conf/local.conf $ bitbake acl $ jq . tmp/deploy/spdx/2.2/core2-64/recipes/recipe-acl.spdx.json ... "name": "acl", "summary": "Utilities for managing POSIX Access Control Lists", "supplier": "Organization: OpenEmbedded ()", "versionInfo": "2.3.2" }, ... Support to override it by setting SPDX_PACKAGE_VERSION, such as set SPDX_PACKAGE_VERSION = "${EXTENDPKGV}" in local.conf to append PR to versionInfo in SBOM 2 $ echo 'SPDX_PACKAGE_VERSION = "${EXTENDPKGV}"' >> conf/local.conf $ bitbake acl $ jq . tmp/deploy/spdx/2.2/core2-64/recipes/recipe-acl.spdx.json ... "name": "acl", "summary": "Utilities for managing POSIX Access Control Lists", "supplier": "Organization: OpenEmbedded ()", "versionInfo": "2.3.2-r0" }, ... (From OE-Core rev: 0bd069f526ee0d535477b75a4aa825b4cb589423) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx: add option to include only compiled sourcesDaniel Turull2025-06-171-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. Tested with bitbake world on oe-core. CC: Quentin Schulz <quentin.schulz@cherry.de> CC: Joshua Watt <JPEWhacker@gmail.com> CC: Peter Marko <peter.marko@siemens.com> (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/spdx-*.bbclass: move spdx2 specific variables out of spdx-common classAntonin Godard2025-03-281-0/+2
| | | | | | | | | | | Setting SPDX_ARCHIVE_SOURCES and SPDX_ARCHIVE_PACKAGED makes no difference when using the spdx-3.0 class. Move these two in the spdx-2.0 class since they are only used there. (From OE-Core rev: 8ce06538c9cde0f09909a5a2e61ec10b0d35df49) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: create-spdx-2.2: Fix dependency handlingJoshua Watt2025-03-241-5/+5
| | | | | | | | | | | | The common SPDX code was changed to return a dataclass for dependency information instead of a namedtuple, but the SPDX 2.2 was missed to account for this. Correct the SPDX 2.2 code to correctly handle the new datatype (From OE-Core rev: 79a03abd37839973996efc957d44614edcbd6b87) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx: Update for bitbake changesRichard Purdie2025-03-201-26/+25
| | | | | | | | | Bitbake is dropping the need for fetcher name iteration and multiple revisions per url. Update the code to match (removal of the for loop). (From OE-Core rev: 4859cdf97fd9a260036e148e25f0b78eb393df1e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: support line numbersDenis OSTERLAND-HEIM2025-01-231-2/+8
| | | | | | | | | | | | LIC_FILES_CHKSUM supports begin-/endline for licenses included in for instance header files. This patch adds support for line numbers to NO_GENERIC_LICENSE, too. (From OE-Core rev: 8e7ee19fc9e74cf042880f4bc317782482ba6f66) Signed-off-by: Denis Osterland-Heim <denis.osterland@diehl.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com>
* create-spdx-{2.2,3.0}: fix do_create_spdx dependency while spdx include sourcesHongxu Jia2024-11-011-1/+4
| | | | | | | | | | | | | | | | Call function ${@create_spdx_source_deps(d)} or ${create_spdx_source_deps(d)} along with addtask not working, use task do_create_spdx flag 'depends' to instead Move function create_spdx_source_deps to spdx-common.bbclass for both of create-spdx-2.2.bbclass and create-spdx-3.0.bbclass (From OE-Core rev: dda4b7ccd416ef370634babd150e944f2aa9116e) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx 3.0: Map gitsm URI to gitJoshua Watt2024-09-301-10/+1
| | | | | | | | | | | | | | | | | | "gitsm" is not a recognized URI protocol (outside of bitbake), so map it to "git" when writing. This should be OK since we report all of the submodule source code (if enabled), and it's still possible for 3rd party analyzers to determine that submodules are in use by looking at .gitmodules. The code to do the mapping is moved to a common location so it covers SPDX 2.2 also [YOCTO #15582] (From OE-Core rev: 6ecf89c75b1a74515266085acc5d3621a0fb2fa1) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sdpx: Avoid loading of SPDX_LICENSE_DATA into global configRichard Purdie2024-08-071-10/+15
| | | | | | | | | | | | | Loading a load of json files into a memory structure and stashing in a bitbake variable is relatively anti-social making bitbake -e output hard to read for example as well as other potential performance issues. Defer loading of that data until it is actually needed/used in a funciton where it is now passed as a parameter. (From OE-Core rev: 6f21cc9598178288784ff451ab3c40b174c0ef3e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx-*: Support multilibs via SPDX_MULTILIB_SSTATE_ARCHSMark Hatle2024-07-261-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When a create-spdx-* classes is processing documents, it needs to find the document in a path that is related to the SSTATE_ARCH when a packge is generated. The SSTATE_ARCH can be affected by multilib configurations, resulting is something like armv8a-mlib. When the image (or SDK) is being generated and the components are collected, the system has no knowledge of the multilib arch and will fail to find it, such as: ERROR: meta-toolchain-1.0-r0 do_populate_sdk: No SPDX file found for package libilp32-libgcc-dbg, False sstate:libilp32-libgcc:armv8a-ilp32-mllibilp32-elf:14.1.0:r0:armv8a-ilp32:12: sstate:libilp32-libgcc::14.1.0:r0::12: Adding in the new SPDX_MULTILIB_SSTATE_ARCHS will provide a full set of SSTATE_ARCHS including ones that contain the multilib extension which will allow create-spdx-* to correctly find the document it is looking for. This would also be valuable to any other function doing a similar search through SSTATE_ARCH that may have been extended with multilib configurations. (From OE-Core rev: f1499c36c1054fc90f7b7268cc95285f2eca72f7) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-sdpx-2.2.bbclass: Switch from exists to isfile checking debugsrcMark Hatle2024-07-181-1/+2
| | | | | | | | | | | | | While debugsrc is almost always a file (or link), there are apparently cases where a directory could be returned from the dwarfsrcfiles processing. When this happens, the hashing fails and an error results when building the SPDX documents. (From OE-Core rev: 02e262c291c0b2066132b4cb2ca5fda8145284a9) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/spdx-common: Move to libraryJoshua Watt2024-07-161-6/+17
| | | | | | | | | Moves the bulk of the code in the spdx-common bbclass into library code (From OE-Core rev: 3f9b7c7f6b15493b6890031190ca8d1a10f2f384) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Handle empty packagesJoshua Watt2024-07-131-41/+42
| | | | | | | | | | When combining an SPDX document, the package list might be empty (e.g. a baremetal image). Handle this case instead of erroring out (From OE-Core rev: baf4e360f6e65a5e9aff2def69d2a720f38f92b2) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Handle SemVer License List VersionsJoshua Watt2024-07-021-4/+9
| | | | | | | | | | | | SPDX transitioned the license list to use SemVer visioning, (e.g. "MAJOR.MINOR.MICRO"), but SPDX 2 only allows "MAJOR.MINOR". For maximum compatibility, only keep the first two version numbers and discard the rest which allows it to work with either scheme (From OE-Core rev: 8757a5eaeaf2b9d7345212d003e5622289b123e6) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/spdx-common: Move SPDX_SUPPLIERJoshua Watt2024-06-271-0/+8
| | | | | | | | | | | Move the SPDX_SUPPLIER variable to create-spdx-2.2 since it's format only has meaning in SPDX 2.2 (SPDX 3 uses SPDX_PACKAGE_SUPPLIER with a different format) (From OE-Core rev: 628c1e04072178d2c8095e53d5f6600c45a2679f) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/spdx-common: Add SPDX version to pathJoshua Watt2024-06-121-0/+2
| | | | | | | | | | Since multiple versions of SPDX are available, use the version in the path (From OE-Core rev: 35c061a4514905b3ebbb7f0633a584927519445c) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/spdx-common: Move common SPDX to new classJoshua Watt2024-06-121-249/+10
| | | | | | | | | | Moves SPDX code that can be shared between different SPDX versions into a common class (From OE-Core rev: 769a390adc9fc0b52978abe0f19f885967af0117) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Fix SPDX dependencies for ABI Safe recipesjoshua Watt2024-05-091-4/+10
| | | | | | | | | | | | | | | | | | SPDX Documents can currently get into a state where they reference SPDX IDs that do not exist (locally). The reason for this is that some tasks/recipes are marked as ABI safe, and thus are excluded from taskhash. This means that when SPDX creates a document, it will refer to the SPDX ID in the dependency at the time when the document is created, but if the dependency changes and gets a new SPDX ID, the document will not rebuild to reference the new SPDX ID, causing it to be dangling. Fix this by using the new field in BB_TASKDEPDATA to skip dependencies that are not part of the taskhash calculation. (From OE-Core rev: 8393557b5229c7a0cea18a586848384bff1d7424) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Fix SPDX Namespace Prefixjoshua Watt2024-05-021-1/+1
| | | | | | | | | | | | According to the SPDX documentation, it should be "spdxdocs" not "spdxdoc" [YOCTO #15398] (From OE-Core rev: d1b25413ced62dc2927dae57b8d16e67d15dc220) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx-2.2: combine spdx can try to write before dir creationJeremy A. Puhlman2023-12-171-1/+1
| | | | | | | | | | | | | | | | | | | On occasion a file is attmpeded to be opened prior to the creation of the spdx_workdir. Create the directory before the open, just in case. File: '/build/layers/poky/meta/classes/create-spdx-2.2.bbclass', lineno: 1081, function: combine_spdx 1077: ) 1078: 1079: image_spdx_path = spdx_workdir / (rootfs_name + ".spdx.json") 1080: *** 1081: with image_spdx_path.open("wb") as f: 1082: doc.to_json(f, sort_keys=True, indent=get_json_indent(d)) (From OE-Core rev: bb9f2a9c0ff5dcdeaf1a0beb6a614d0d022a2481) Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Show error if document is not foundJoshua Watt2023-09-291-0/+2
| | | | | | | | | | | As in other places, print a more helpful error if a SPDX document is not found when assembling documents for the final SPDX archive. (From OE-Core rev: 0a3f7e0b41552e113347d6f5edefe84fd4e47fdf) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Ensure it is clear where the message comes fromRichard Purdie2023-09-261-1/+1
| | | | | | | | | | This message can appear in do_rootfs and the users tend to think this is some kind of packaging issue. Add SPDX to the message so users like me think in the right direction. (From OE-Core rev: ddcf15134b5ec4bf4c728156461c2e45194d71ca) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx: use TOOLCHAIN_OUTPUTNAME for SDK filename prefixDenys Dmytriyenko2023-09-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Replace SDK_NAME with TOOLCHAIN_OUTPUTNAME when naming SDK host and target SPDX archives. In most cases TOOLCHAIN_OUTPUTNAME is almost identical to SDK_NAME, but sometimes custom meta-toolchain recipes have some variations and populate_sdk_base.bbclass already uses TOOLCHAIN_OUTPUTNAME to name corresponding host and target manifests: SDK_HOST_MANIFEST = "${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.host.manifest" SDK_TARGET_MANIFEST = "${SDKDEPLOYDIR}/${TOOLCHAIN_OUTPUTNAME}.target.manifest" To match the naming convention, also use TOOLCHAIN_OUTPUTNAME here for naming SPDX archives as well, resulting in: ${TOOLCHAIN_OUTPUTNAME}-host.spdx.tar.zst ${TOOLCHAIN_OUTPUTNAME}-target.spdx.tar.zst (From OE-Core rev: 38158670256e2ce803aa45f609108d29523b3135) Signed-off-by: Denys Dmytriyenko <denys@konsulko.com> Signed-off-by: Denys Dmytriyenko <denis@denix.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx/sbom: Ensure files don't overlap between machinesRichard Purdie2023-09-221-11/+30
| | | | | | | | | | | | | | | | | | | | | | Currently the by-id and by-namespace SPDX files are created without reference to PACKAGE_ARCH. This means that for two machines using a common package architecture (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means that the build of one can remove files from the other leading to build failures. An example would be: MACHINE=qemux86-64 bitbake core-image-minimal MACHINE=genericx86-64 bitbake core-image-minimal MACHINE=qemux86-64 bitbake linux-yocto -c clean MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs To fix this, add PACKAGE_ARCH to the path used for the files and use a search path based upon PACKAGE_ARCHS to access them. (From OE-Core rev: b2db10e966438071d00d2057b84d5f347613d841) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Add extra debugging for missing package filesJoshua Watt2023-09-131-1/+2
| | | | | | | | | | In a effort to debug YOCTO #15185, improve the logging when a package file cannot be found in the list of SPDX files. (From OE-Core rev: 35d827d44d65380bfb7f6e1d0a0ee63516f822a8) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Drop ';' delimiter from ROOTFS/IMAGE*COMMAND variablesRichard Purdie2023-09-091-3/+3
| | | | | | | | | | | | | Originally these were shell functions but they have long since been processed by bb.build.exec_func(). Since we no longer need shell syntax, we can drop the ';' delimiters and just use a space separated string. This cleans up the variable and quietly removes any stray ';' that do happen to still make it in. (From OE-Core rev: c3365dfd9ddd7fbe70b62e0f11166e57a8ca6f73) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Make license errors fatalJoshua Watt2023-06-021-1/+1
| | | | | | | | | | Otherwise the task is still put into sstate, which means the error can effectively be hidden by ignoring it. (From OE-Core rev: 9d00f3ba4555510cf9525f4f6f186bf8a1371cee) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx-2.2: Add missing variable exclusionsRichard Purdie2023-06-021-0/+9
| | | | | | | | | | Some variables cause issues with taskhashes and are accounted for in the output in other ways, or don't affect it. Exclude these to improve the taskhashes with create-spdx and allow the sstate selftests to work better. (From OE-Core rev: e7daaa50af4ccd5ccb568f7a380ded18c7f74ab0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx-2-2: Fix packagedata usage to work with SDK packagesRichard Purdie2023-06-021-2/+7
| | | | | | | | | | | | There are two seperate PKGDATA_DIR directories, one for the target and one for the SDK. Rather than fail when a package can't be found, try the SDK first. We use a datastore copy to keep the code simple, rather than havng to parameterise all the packagedata functions. (From OE-Core rev: 701d8f975c89dc6753188fbcf9d4883650ba5b58) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Fix runtime dependency calculationsJoshua Watt2023-06-021-8/+5
| | | | | | | | | | | Fixes the runtime dependency calculations to also only follow direct dependencies of the current task instead of all transient dependencies in a similar way as the build time dependencies. (From OE-Core rev: 5fa00564b047725541a5fed95b621f0202803345) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Fix build time dependency calculationsJoshua Watt2023-06-021-17/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | Build time dependencies were not being correctly calculated for SPDX documents because while a task can `deptask` itself (as do_create_spdx did), those dependencies do not appear in BB_TASKDEPDATA (to avoid circular dependencies). To fix this, an intermediate task called do_collect_sdpx_deps is created that does the 'deptask' on do_create_spdx and records the recipe dependencies. do_create_spdx then runs after this new task. This breaks the circular dependency and thus all of the do_create_spdx tasks correctly show up as dependencies of do_collect_spdx_deps. In addition, the dependency collection logic was improved to handle the case of transitive dependencies (that is, a dependency of a dependency) SPDX documents missing and causing an error. These transitive dependencies don't actually need to be included anyway since one can follow the relationship of the direct dependency to find them. As such, the code is reworked to find the current task in BB_TASKDEPDATA, and then only collect the immediate dependencies of the current task. (From OE-Core rev: 55b3f160b13c6db778db09476cc4c73e70c5e930) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Respect PKG for providersJoshua Watt2023-06-021-0/+4
| | | | | | | | | | If a package renames itself using PKG, the new name should be respected as a name that the recipe provides. (From OE-Core rev: 871f48126180bf30c001c6b97268cee1853dbda2) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Use hashfn from BB_TASKDEPDATA instead of MACHINEJoshua Watt2023-06-021-23/+38
| | | | | | | | | | | | | | | Enabling the SPDX class and running two builds, one with SDKMACHINE=i686 and then again with SDKMACHINE=x86_64 would lead to errors since the output was stored per MACHINE and the overlapping files would cause manifest errors. The hashfn data from bitbake has SSTATE_PKGARCH encoded into it which is how sstate separates out it's targets and SDPX should be using the same structure. Therefore switch to using this. (From OE-Core rev: 51049cde0cf477f7988b94c1041eb33b018a669f) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx: Fix license parsingLouis Rannou2023-05-311-1/+1
| | | | | | | | | | | | | [YOCTO #14890] -- https://bugzilla.yoctoproject.org/show_bug.cgi?id=14890#c3 Since spaces in the license name are not mandatory, we need to add spaces around `|` and `&` before spliting. (From OE-Core rev: 28c704bdf731f1c5012b74e4fdb899622f15a7b1) Signed-off-by: Louis Rannou <lrannou@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: fix config build by adding dependency to enable rerunsMaanya Goenka2023-03-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | The issue encountered is about local stos builds failing (when these builds are preceded by a local SoC OS or MOS build). Essentially, the failure is seen when building two different configs with shared state, one where gcc-cross-<arch> has a dependency and one where it doesn't (specifically, one where the abicheck class in meta-binaryaudit is inherited and one where it isn't). Hence, the task signatures change but a rerun of those said tasks does not occur. The result is that when the config with the dependency is built and then the one without is built, due to incorrect dependencies, the SPDX manifest creation stage errors out. create-spdx relies on BB_TASKDEPDATA to get dependencies and then adds that variable to vardepsexclude. A change in dependencies therefore, does not result in a re-execution of the tasks. This commit adds an explicit dependency on DEPENDS which influences BB_TASKDEPDATA and triggers reruns for new config builds having different dependencies. (From OE-Core rev: 1a0dac4f45c489d107d9627d3c3ab7ccf1c60920) Signed-off-by: Maanya Goenka <maanyagoenka@microsoft.com> Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx-2.2: Report downloads as separate packagesJoshua Watt2023-02-191-8/+50
| | | | | | | | | | | | | | | | | | | | Moves the downloaded items from SRC_URI into separate packages in the recipe document. This is much better than the previous implementation because: 1) It can report multiple download locations in SRC_URI, instead of just the first one reported. 2) It prevents the assumption that the source files listed in the recipe are the exact file from the source URL; in particular, files that come from file:// SRC_URI entries, and source files that have been patched were problematic, since these aren't from the upstream source. 3) It allows the checksums to be specified (From OE-Core rev: 1dd4369b3638637a2cbba2a3c37c6b6f4df335cd) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx-2.2: Add support for custom AnnotationsSaul Wold2023-02-151-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | This change adds a new variable to track which recipe variables are added as SPDX Annotations. Usage: add SPDX_CUSTOM_ANNOTATION_VARS = <some recipe variable> The recipe spdx json will contain an annotation stanza that looks something like this: "annotations": [ { "annotationDate": "2023-02-13T19:44:20Z", "annotationType": "OTHER", "annotator": "Tool: oe-spdx-creator - 1.0", "comment": "CUSTOM_VARIABLE=some value or string" }, (From OE-Core rev: 33ced8338f0facb412b5f24cf9df4a84226a2a94) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-sdpx-2.2: Remove image SPDX and index from deploydirJoshua Watt2023-02-151-12/+8
| | | | | | | | | | | | | Per feedback from users, remove the top level image SPDX file and the JSON index file from DEPLOYDIR. Having these files here is confusing to end users because these files are not very useful by themselves, and having them in DEPLOYDIR makes it unclear which they should be using. (From OE-Core rev: 4e081802ecb352e0a300a98c924354f8393e4163) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: default share_src for shared sourcesKonrad Weihmann2022-11-111-2/+3
| | | | | | | | | | | | | | | | | | | | if a source is using work-shared but isn't a kernel, like for instance llvm-source from meta-clang, share_src was previously undefined leading to a crash of the python code. Default to WORKDIR and just override it in case the source being a kernel recipe. Additionally changes the variable names in the following, as they imply that it's only about the kernel, which is not the case in every case (From OE-Core rev: 34fa68a0b07328c4ed4eef81f8cde80137a91f18) Signed-off-by: Konrad Weihmann <kweihmann@witekio.com> On-behalf-of: Avnet Embedded <AvnetEmbedded@avnet.eu> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: create-spdx: Move to version specific classJoshua Watt2022-11-111-0/+1025
In expectation of SPDX 3.0 support, move the create-spdx.bbclass -> create-spdx-2.2.bbclass. The create-spdx.bbclass class still exists and can be used if a user doesn't care about which specific version of SPDX they get. (From OE-Core rev: 9ec01fe3e59be66331c14ab5391ecb0b6f140c22) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 08:27:15 +0000