Re: [bitbake-devel] [PATCH] upstream source tracing: base process (patch 1/3)

[Luca Ceresoli <luca.ceresoli@bootlin.com>]

Ciao Alberto,

On Thu, 20 Apr 2023 08:20:24 +0200
"Alberto Pianon" <alberto@pianon.eu> wrote:

> From: Alberto Pianon <alberto@pianon.eu>
> 
> License compliance, SBoM generation and CVE checking require to be able
> to trace each source file back to its corresponding upstream source. The
> current implementation of bb.fetch2 makes it difficult, especially when
> multiple sources are combined together.
> 
> This series of patches provides a solution to the issue by implementing
> a process that unpacks each SRC_URI element into a temporary directory,
> collects relevant provenance metadata on each source file, moves
> everything to the recipe rootdir, and saves metadata in a JSON file.
> 
> The proposed solution is split into a series of patches, with the first
> patch containing required modifications to fetchers' code and a
> TraceUnpackBase class that implements the process, and the second patch
> implementing the data collecting logic in a separate TraceUnpack
> subclass. The final patch includes test data and test cases to
> demonstrate the solution's efficacy.
> 
> Signed-off-by: Alberto Pianon <alberto@pianon.eu>

Testing this patchset on the autobuilders triggered failures on the
oe-selftest builds. Here are the logs:

https://autobuilder.yoctoproject.org/typhoon/#/builders/79/builds/5085/steps/14/logs/stdio
https://autobuilder.yoctoproject.org/typhoon/#/builders/80/builds/5034/steps/14/logs/stdio
https://autobuilder.yoctoproject.org/typhoon/#/builders/86/builds/5076/steps/14/logs/stdio
https://autobuilder.yoctoproject.org/typhoon/#/builders/87/builds/5114/steps/14/logs/stdio
https://autobuilder.yoctoproject.org/typhoon/#/builders/127/builds/1296/steps/15/logs/stdio

May you have a look at that?

Best regards,
Luca

-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com