[PATCH] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[PATCH] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[iwanicki92]

Sub-variables (_name, _type, _comment, _id_email) were being looked
up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER"
"SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF",
instead of the value of those variables, breaking the documented
ability to use a custom prefix (e.g. MY_COMPANY).

Tested by setting in local.conf:

```
MY_COMPANY_name = "CCCC"
MY_COMPANY_type = "organization"
SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
SPDX_IMAGE_SUPPLIER_name = "AAAA"
SPDX_IMAGE_SUPPLIER_type = "organization"
SPDX_PACKAGE_SUPPLIER = "MY_COMPANY"
SPDX_PACKAGE_SUPPLIER_name = "BBBB"
SPDX_PACKAGE_SUPPLIER_type = "organization"
```

And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json`
SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC,
after there was only CCCC.

Signed-off-by: iwanicki92 <iwanicki92@gmail.com>
---
 meta/lib/oe/sbom30.py       |  6 +++++-
 meta/lib/oe/spdx30_tasks.py | 10 +++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py
index e02382c3cc78..5af2e4ff1c0c 100644
--- a/meta/lib/oe/sbom30.py
+++ b/meta/lib/oe/sbom30.py
@@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet):
         self.doc.import_.append(m)
         return spdxid
 
-    def new_agent(self, varname, *, creation_info=None, add=True):
+    def new_agent(self, varname, *, creation_info=None, add=True, expand=False):
+        if expand:
+            varname = self.d.getVar(f"{varname}")
+            if not varname:
+                return None
         ref_varname = self.d.getVar(f"{varname}_ref")
         if ref_varname:
             if ref_varname == varname:
diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index dac02e378429..88c707476a65 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -905,7 +905,7 @@ def create_spdx(d):
                 force_purposes=["install"],
             )
 
-            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER")
+            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER", expand=True)
             if supplier is not None:
                 spdx_package.suppliedBy = (
                     supplier if isinstance(supplier, str) else supplier._id
@@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d):
     objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False)
 
     host_import_key = d.getVar("SPDX_BUILD_HOST")
-    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False)
-    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False)
+    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False, expand=True)
+    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False, expand=True)
 
     if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1":
         # Since the Build objects are unique, we may as well set the creation
@@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d):
     objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements)
 
     # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined
-    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False)
+    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False, expand=True)
     if supplier is not None:
         supplier_id = supplier if isinstance(supplier, str) else supplier._id
         if not isinstance(supplier, str):
@@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname):
     )
 
     # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
-    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False)
+    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False, expand=True)
     if supplier is not None:
         supplier_id = supplier if isinstance(supplier, str) else supplier._id
         if not isinstance(supplier, str):
-- 
2.55.0

Re: [OE-core] [PATCH] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[Mathieu Dubois-Briand]

On Sat Aug 22, 2026 at 11:17 PM CEST, iwanicki92 via lists.openembedded.org wrote:
> Sub-variables (_name, _type, _comment, _id_email) were being looked
> up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER"
> "SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF",
> instead of the value of those variables, breaking the documented
> ability to use a custom prefix (e.g. MY_COMPANY).
>

Hi,

Thanks for your patch.

This is breaking the spdx.SPDX30Check.test_extra_opts selftest:

2026-08-23 18:55:20,012 - oe-selftest - INFO - spdx.SPDX30Check.test_extra_opts (subunit.RemotedTestCase)
2026-08-23 18:55:20,013 - oe-selftest - INFO -  ... FAIL
...
2026-08-23 18:55:20,018 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/spdx.py", line 226, in test_extra_opts
    self.assertTrue(False, "Unable to find organization")
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/unittest/case.py", line 744, in assertTrue
    raise self.failureException(msg)
AssertionError: False is not true : Unable to find organization

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4695
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4650
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4473

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[iwanicki92]

[-- Attachment #1: Type: text/plain, Size: 897 bytes --]

Posted v2 patch, issue was that I changed it to be more consistent with documentation e.g. for SPDX_IMAGE_SUPPLIER ( https://docs.yoctoproject.org/ref-manual/variables.html#term-SPDX_IMAGE_SUPPLIER ) :

> 
> If not set, no supplier information is added to the image SBOM
> 

but maybe it meant that if `<PREFIX>_*` is not set (e.g. _name or _type), then this information is not added.
So with this change it'll be possible to use `SPDX_IMAGE_SUPPLIER = "MY_COMPANY"` or undocumented `SPDX_IMAGE_SUPPLIER_ref = "MY_COMPANY"` (which doesn't pass all arguments it was called with (e.g. `add`), so it feels like a bug but I don't know enough about this subsystem to tell) with variable with no suffix having priority.

Another way to fix it would be to maybe change documentation and say explicitly to use SPDX_IMAGE_SUPPLIER_ref and that SPDX_IMAGE_SUPPLIER without any suffix is not used.

[-- Attachment #2: Type: text/html, Size: 1065 bytes --]