[PATCH] classes/sbom-cve-check: fall back to the stable SBOM symlink

[roosesweb@gmail.com]

do_sbom_cve_check builds its input path from ${IMAGE_NAME}, which carries
${IMAGE_VERSION_SUFFIX} and so ${DATETIME}. That value is excluded from task
hashes but changes on every bitbake invocation, so the path is only correct when
do_create_image_sbom_spdx ran in the same invocation.

It does not when the class is newly enabled on an existing build tree: the image
SBOM is already deployed and stamped from an earlier build, do_sbom_cve_check has
never run, so bitbake executes only the latter and it looks for a file whose
timestamp belongs to the current invocation. The same happens on any forced re-run
of just this task:

  $ bitbake -f -c sbom_cve_check core-image-minimal
  ERROR: core-image-minimal-1.0-r0 do_sbom_cve_check: sbom-cve-check failed: [...]
  sbom-cve-check: error: [Errno 2] No such file or directory:
    '.../core-image-minimal-qemux86-64.rootfs-20260804101106.spdx.json'

  $ ls tmp/deploy/images/qemux86-64/*.spdx.json
  core-image-minimal-qemux86-64.rootfs-20260804095834.spdx.json
  core-image-minimal-qemux86-64.rootfs.spdx.json -> ...-20260804095834.spdx.json

The file is there under ${IMAGE_LINK_NAME}, the symlink do_create_image_sbom_spdx
maintains. Keep preferring the timestamped name, so behaviour is unchanged whenever
it exists, and fall back to the symlink rather than failing. Guarded on link_name
being set, since IMAGE_LINK_NAME can be empty.

Signed-off-by: Thomas Roos <roosesweb@gmail.com>
---
 meta/classes-recipe/sbom-cve-check.bbclass | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/sbom-cve-check.bbclass b/meta/classes-recipe/sbom-cve-check.bbclass
index 451595f..b184c12 100644
--- a/meta/classes-recipe/sbom-cve-check.bbclass
+++ b/meta/classes-recipe/sbom-cve-check.bbclass
@@ -14,9 +14,20 @@ python do_sbom_cve_check() {
     """
     Task: Run sbom-cve-check analysis on SBOM.
     """
-    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
+    import os
+
     image_name = d.getVar("IMAGE_NAME")
     link_name = d.getVar("IMAGE_LINK_NAME")
+    deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
+
+    # IMAGE_NAME carries DATETIME, which changes on every invocation while being
+    # excluded from task hashes, so this path is only valid when
+    # do_create_image_sbom_spdx ran in the same invocation. Fall back to the
+    # symlink it maintains, which is stable across builds.
+    sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % image_name)
+    if not os.path.exists(sbom_path) and link_name:
+        sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % link_name)
+
     run_sbom_cve_check(d, sbom_path, image_name, link_name)
 }
 
-- 
2.55.0