[PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[Anna-Lena Marx]

Using ${IMAGE_NAME} to construct the sbom_path causes the do_sbom_cve_check
task to fail in subsequent builds when the image generation is restored from
the sstate cache.
${IMAGE_NAME} utilizes the DATETIME variable via ${IMAGE_VERSION_SUFFIX},
which is re-evaluated during the current execution.
This results in a timestamp mismatch with the actually deployed cached
SPDX artifact.

Switching the path construction to use ${IMAGE_LINK_NAME} ensures the task
reliably targets the stable symlink in the deploy directory,
restoring cache determinism and preventing "No such file or directory"
errors on rebuilds.

Signed-off-by: Anna-Lena Marx <anna-lena.marx@inovex.de>
---
 meta/classes-recipe/sbom-cve-check.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes-recipe/sbom-cve-check.bbclass b/meta/classes-recipe/sbom-cve-check.bbclass
index 451595f1d7..fe145a2212 100644
--- a/meta/classes-recipe/sbom-cve-check.bbclass
+++ b/meta/classes-recipe/sbom-cve-check.bbclass
@@ -14,7 +14,7 @@ python do_sbom_cve_check() {
     """
     Task: Run sbom-cve-check analysis on SBOM.
     """
-    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
+    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.spdx.json")
     image_name = d.getVar("IMAGE_NAME")
     link_name = d.getVar("IMAGE_LINK_NAME")
     run_sbom_cve_check(d, sbom_path, image_name, link_name)
-- 
2.55.0

Re: [OE-core] [PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[Yoann Congal]

[-- Attachment #1: Type: text/plain, Size: 2477 bytes --]

Le mer. 1 juil. 2026 à 12:00, Anna-Lena Marx via lists.openembedded.org
<anna-lena.marx=inovex.de@lists.openembedded.org> a écrit :

> Using ${IMAGE_NAME} to construct the sbom_path causes the do_sbom_cve_check
> task to fail in subsequent builds when the image generation is restored
> from
> the sstate cache.
> ${IMAGE_NAME} utilizes the DATETIME variable via ${IMAGE_VERSION_SUFFIX},
> which is re-evaluated during the current execution.
> This results in a timestamp mismatch with the actually deployed cached
> SPDX artifact.
>
> Switching the path construction to use ${IMAGE_LINK_NAME} ensures the task
> reliably targets the stable symlink in the deploy directory,
> restoring cache determinism and preventing "No such file or directory"
> errors on rebuilds.
>
> Signed-off-by: Anna-Lena Marx <anna-lena.marx@inovex.de>
> ---
>

Ping Ryan, isn't what you worked on as well?
That patch from Anna-Lena looks like a fix for the regression created by
[0] you talked about.

Anna-Lena, do you think your fix is linked to [0]?

[0]:
https://git.openembedded.org/openembedded-core/commit/?id=b9f060ea6d54cc419df9ff5f8822a3536934606f



>  meta/classes-recipe/sbom-cve-check.bbclass | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/sbom-cve-check.bbclass
> b/meta/classes-recipe/sbom-cve-check.bbclass
> index 451595f1d7..fe145a2212 100644
> --- a/meta/classes-recipe/sbom-cve-check.bbclass
> +++ b/meta/classes-recipe/sbom-cve-check.bbclass
> @@ -14,7 +14,7 @@ python do_sbom_cve_check() {
>      """
>      Task: Run sbom-cve-check analysis on SBOM.
>      """
> -    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
> +    sbom_path =
> d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.spdx.json")
>      image_name = d.getVar("IMAGE_NAME")
>      link_name = d.getVar("IMAGE_LINK_NAME")
>      run_sbom_cve_check(d, sbom_path, image_name, link_name)
> --
> 2.55.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#239959):
> https://lists.openembedded.org/g/openembedded-core/message/239959
> Mute This Topic: https://lists.openembedded.org/mt/120061528/4316185
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> yoann.congal@smile.fr]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
Yoann Congal
Smile ECS

[-- Attachment #2: Type: text/html, Size: 4122 bytes --]

RE: [OE-core] [PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[Marko, Peter]

[-- Attachment #1: Type: text/plain, Size: 2880 bytes --]

This patch does not look correct as it basically reverts previous patch, returning to broken builds with empty image link name.

There is I think a better patch for this on the mailing list - https://lists.openembedded.org/g/openembedded-core/message/239739

The main problem is that spdx tasks create sstate objects for images.
Image tasks are not supposed to do that.
I think I’ll send a patch for that some day.

Peter

From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Yoann Congal via lists.openembedded.org
Sent: Wednesday, July 1, 2026 12:31 PM
To: anna-lena.marx@inovex.de
Cc: openembedded-core@lists.openembedded.org; Ryan Eatmon <reatmon@ti.com>
Subject: Re: [OE-core] [PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path



Le mer. 1 juil. 2026 à 12:00, Anna-Lena Marx via lists.openembedded.org<http://lists.openembedded.org> <anna-lena.marx=inovex.de@lists.openembedded.org<mailto:inovex.de@lists.openembedded.org>> a écrit :
Using ${IMAGE_NAME} to construct the sbom_path causes the do_sbom_cve_check
task to fail in subsequent builds when the image generation is restored from
the sstate cache.
${IMAGE_NAME} utilizes the DATETIME variable via ${IMAGE_VERSION_SUFFIX},
which is re-evaluated during the current execution.
This results in a timestamp mismatch with the actually deployed cached
SPDX artifact.

Switching the path construction to use ${IMAGE_LINK_NAME} ensures the task
reliably targets the stable symlink in the deploy directory,
restoring cache determinism and preventing "No such file or directory"
errors on rebuilds.

Signed-off-by: Anna-Lena Marx <anna-lena.marx@inovex.de<mailto:anna-lena.marx@inovex.de>>
---

Ping Ryan, isn't what you worked on as well?
That patch from Anna-Lena looks like a fix for the regression created by [0] you talked about.

Anna-Lena, do you think your fix is linked to [0]?

[0]: https://git.openembedded.org/openembedded-core/commit/?id=b9f060ea6d54cc419df9ff5f8822a3536934606f

 meta/classes-recipe/sbom-cve-check.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes-recipe/sbom-cve-check.bbclass b/meta/classes-recipe/sbom-cve-check.bbclass
index 451595f1d7..fe145a2212 100644
--- a/meta/classes-recipe/sbom-cve-check.bbclass
+++ b/meta/classes-recipe/sbom-cve-check.bbclass
@@ -14,7 +14,7 @@ python do_sbom_cve_check() {
     """
     Task: Run sbom-cve-check analysis on SBOM.
     """
-    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
+    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.spdx.json")
     image_name = d.getVar("IMAGE_NAME")
     link_name = d.getVar("IMAGE_LINK_NAME")
     run_sbom_cve_check(d, sbom_path, image_name, link_name)
--
2.55.0





--
Yoann Congal
Smile ECS

[-- Attachment #2: Type: text/html, Size: 7961 bytes --]

Re: [PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[Anna-Lena Marx]

[-- Attachment #1: Type: text/plain, Size: 679 bytes --]

Hi Peter,

I'm a bit confused about your patch, not that I would not believe it solves the issue, but IMAGE_LINK_NAME is defined as

`IMAGE_LINK_NAME ?= "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}"`

and IMAGE_NAME as

`IMAGE_NAME ?= "${IMAGE_LINK_NAME}${IMAGE_VERSION_SUFFIX}"`

means, if I'm not completely confused, if IMAGE_LINK_NAME would be empty for some reason, IMAGE_NAME, would only consist of the IMAGE_VERSION_SUFFIX.
This does not read correct to me as well, and thus I'm not completely enthusiastic about your version.

But I'm completely with you in terms of the main issue and would rather like to fix it on this level than patching symptoms.

Anna

[-- Attachment #2: Type: text/html, Size: 789 bytes --]

RE: [OE-core] [PATCH] classes-recipe/sbom-cve-check: fix sstate cache mismatch in sbom path

[Marko, Peter]

Hello,

Both variables are defined with "?=", which means that they are allowed to be overridden.
And as usual, if something is allowed, someone is also doing that.
That's also why https://code.siemens.com/mirror/openembedded-core/-/commit/2a80840a4fe0d38254ed3e9f96c893f6e04db8d8 was submitted - the empty link name use-case was broken.
That obviously broke the thing that you're trying to fix but your commit is a clear revert, so we would be bouncing between error with empty link name and error with default link name.
Commit (which is actually not from me) I posted in my previous reply handles both cases.

Peter

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Anna-Lena Marx via
> lists.openembedded.org
> Sent: Wednesday, July 1, 2026 2:44 PM
> To: openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core] [PATCH] classes-recipe/sbom-cve-check: fix sstate cache
> mismatch in sbom path
> 
> Hi Peter,
> 
> I'm a bit confused about your patch, not that I would not believe it solves the issue,
> but IMAGE_LINK_NAME is defined as
> 
> `IMAGE_LINK_NAME ?= "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}"`
> 
> and IMAGE_NAME as
> 
> `IMAGE_NAME ?= "${IMAGE_LINK_NAME}${IMAGE_VERSION_SUFFIX}"`
> 
> means, if I'm not completely confused, if IMAGE_LINK_NAME would be empty for
> some reason, IMAGE_NAME, would only consist of the
> IMAGE_VERSION_SUFFIX.
> This does not read correct to me as well, and thus I'm not completely enthusiastic
> about your version.
> 
> But I'm completely with you in terms of the main issue and would rather like to fix it
> on this level than patching symptoms.
> 
> 
> Anna