[PATCH v2] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[PATCH v2] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[iwanicki92]

Sub-variables (_name, _type, _comment, _id_email) were being looked
up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER"
"SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF",
instead of the value of those variables, breaking the documented
ability to use a custom prefix (e.g. MY_COMPANY).

Tested by setting in local.conf:

```
MY_COMPANY_name = "CCCC"
MY_COMPANY_type = "organization"
SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
SPDX_IMAGE_SUPPLIER_name = "AAAA"
SPDX_IMAGE_SUPPLIER_type = "organization"
SPDX_PACKAGE_SUPPLIER = "MY_COMPANY"
SPDX_PACKAGE_SUPPLIER_name = "BBBB"
SPDX_PACKAGE_SUPPLIER_type = "organization"
```

And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json`
SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC,
after there was only CCCC.

Signed-off-by: iwanicki92 <iwanicki92@gmail.com>
---
Changes in v2:

Change the expand path to fallback to `varname` itself when lookup
doesn't find anything. This change allows for both old, undocumented `_ref`
indirection and documented indirection (`SPDX_* = "<PREFIX>"`)
---
 meta/lib/oe/sbom30.py       |  6 +++++-
 meta/lib/oe/spdx30_tasks.py | 10 +++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py
index e02382c3cc78..becf9e30d392 100644
--- a/meta/lib/oe/sbom30.py
+++ b/meta/lib/oe/sbom30.py
@@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet):
         self.doc.import_.append(m)
         return spdxid
 
-    def new_agent(self, varname, *, creation_info=None, add=True):
+    def new_agent(self, varname, *, creation_info=None, add=True, expand=False):
+        if expand:
+            varname = self.d.getVar(varname) or varname
+        if not varname:
+            return None
         ref_varname = self.d.getVar(f"{varname}_ref")
         if ref_varname:
             if ref_varname == varname:
diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index dac02e378429..88c707476a65 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -905,7 +905,7 @@ def create_spdx(d):
                 force_purposes=["install"],
             )
 
-            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER")
+            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER", expand=True)
             if supplier is not None:
                 spdx_package.suppliedBy = (
                     supplier if isinstance(supplier, str) else supplier._id
@@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d):
     objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False)
 
     host_import_key = d.getVar("SPDX_BUILD_HOST")
-    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False)
-    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False)
+    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False, expand=True)
+    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False, expand=True)
 
     if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1":
         # Since the Build objects are unique, we may as well set the creation
@@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d):
     objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements)
 
     # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined
-    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False)
+    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False, expand=True)
     if supplier is not None:
         supplier_id = supplier if isinstance(supplier, str) else supplier._id
         if not isinstance(supplier, str):
@@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname):
     )
 
     # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
-    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False)
+    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False, expand=True)
     if supplier is not None:
         supplier_id = supplier if isinstance(supplier, str) else supplier._id
         if not isinstance(supplier, str):
-- 
2.55.0

Re: [OE-core] [PATCH v2] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[Joshua Watt]

[-- Attachment #1: Type: text/plain, Size: 5350 bytes --]

On Mon, Aug 24, 2026 at 2:14 PM iwanicki92 via lists.openembedded.org
<iwanicki92=gmail.com@lists.openembedded.org> wrote:

> Sub-variables (_name, _type, _comment, _id_email) were being looked
> up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER"
> "SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF",
> instead of the value of those variables, breaking the documented
> ability to use a custom prefix (e.g. MY_COMPANY).
>
> Tested by setting in local.conf:
>
> ```
> MY_COMPANY_name = "CCCC"
> MY_COMPANY_type = "organization"
> SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
> SPDX_IMAGE_SUPPLIER_name = "AAAA"
> SPDX_IMAGE_SUPPLIER_type = "organization"
> SPDX_PACKAGE_SUPPLIER = "MY_COMPANY"
> SPDX_PACKAGE_SUPPLIER_name = "BBBB"
> SPDX_PACKAGE_SUPPLIER_type = "organization"
> ```
>
> And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json`
> SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC,
> after there was only CCCC.
>

This isn't how these variables are intended to work; I'm not sure where the
documentation you found suggests this, but the values for any base variable
are suffixes always appended to that base variable. For example:

SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
SPDX_IMAGE_SUPPLIER_MY_COMPANY_name = "CCCC"
SPDX_IMAGE_SUPPLIER_MY_COMPANY_type = "organization"




> Signed-off-by: iwanicki92 <iwanicki92@gmail.com>
> ---
> Changes in v2:
>
> Change the expand path to fallback to `varname` itself when lookup
> doesn't find anything. This change allows for both old, undocumented `_ref`
> indirection and documented indirection (`SPDX_* = "<PREFIX>"`)
> ---
>  meta/lib/oe/sbom30.py       |  6 +++++-
>  meta/lib/oe/spdx30_tasks.py | 10 +++++-----
>  2 files changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py
> index e02382c3cc78..becf9e30d392 100644
> --- a/meta/lib/oe/sbom30.py
> +++ b/meta/lib/oe/sbom30.py
> @@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet):
>          self.doc.import_.append(m)
>          return spdxid
>
> -    def new_agent(self, varname, *, creation_info=None, add=True):
> +    def new_agent(self, varname, *, creation_info=None, add=True,
> expand=False):
> +        if expand:
> +            varname = self.d.getVar(varname) or varname
> +        if not varname:
> +            return None
>          ref_varname = self.d.getVar(f"{varname}_ref")
>          if ref_varname:
>              if ref_varname == varname:
> diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
> index dac02e378429..88c707476a65 100644
> --- a/meta/lib/oe/spdx30_tasks.py
> +++ b/meta/lib/oe/spdx30_tasks.py
> @@ -905,7 +905,7 @@ def create_spdx(d):
>                  force_purposes=["install"],
>              )
>
> -            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER")
> +            supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER",
> expand=True)
>              if supplier is not None:
>                  spdx_package.suppliedBy = (
>                      supplier if isinstance(supplier, str) else
> supplier._id
> @@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d):
>      objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False)
>
>      host_import_key = d.getVar("SPDX_BUILD_HOST")
> -    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False)
> -    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False)
> +    invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False,
> expand=True)
> +    on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False,
> expand=True)
>
>      if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1":
>          # Since the Build objects are unique, we may as well set the
> creation
> @@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d):
>      objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements)
>
>      # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined
> -    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False)
> +    supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False,
> expand=True)
>      if supplier is not None:
>          supplier_id = supplier if isinstance(supplier, str) else
> supplier._id
>          if not isinstance(supplier, str):
> @@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir,
> toolchain_outputname):
>      )
>
>      # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
> -    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False)
> +    supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False,
> expand=True)
>      if supplier is not None:
>          supplier_id = supplier if isinstance(supplier, str) else
> supplier._id
>          if not isinstance(supplier, str):
> --
> 2.55.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#244150):
> https://lists.openembedded.org/g/openembedded-core/message/244150
> Mute This Topic: https://lists.openembedded.org/mt/120910416/3616693
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> JPEWhacker@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 7203 bytes --]

Re: [PATCH v2] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[iwanicki92]

[-- Attachment #1: Type: text/plain, Size: 1365 bytes --]

> 
> I'm not sure where the documentation you found suggests this
> 

The Yocto Project documentation: https://docs.yoctoproject.org/ref-manual/variables.html#term-SPDX_IMAGE_SUPPLIER contains almost the same example:

MY_COMPANY_name = "Acme Corp"
MY_COMPANY_type = "organization"
SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
SPDX_SDK_SUPPLIER = "MY_COMPANY"

the support for this is already implemented by undocumented `_ref` suffix, so maybe documentation should be changed instead.
Though `_ref` suffix if I'm reading code correctly allows for infinite chaining e.g:

SPDX_IMAGE_SUPPLIER_ref = "MY_COMPANY1"
MY_COMPANY1_ref = "MY_COMPANY2"
MY_COMPANY2_name = "Acme Corp

> 
> but the values for any base variable are suffixes always appended to that
> base variable
> 
> 
> SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
> SPDX_IMAGE_SUPPLIER_MY_COMPANY_name = "CCCC"
> SPDX_IMAGE_SUPPLIER_MY_COMPANY_type = "organization"
> 

This one I don't think is mentioned anywhere, and also doesn't work. Maybe you meant SPDX_AUTHORS which has this syntax:

SPDX_AUTHORS ??= "openembedded"
SPDX_AUTHORS[doc] = "A space separated list of the document authors. Each item \
is used to name a base variable like SPDX_AUTHORS_<AUTHOR> that \
describes the author."
SPDX_AUTHORS_openembedded_name = "OpenEmbedded"
SPDX_AUTHORS_openembedded_type = "organization"

[-- Attachment #2: Type: text/html, Size: 1716 bytes --]

Re: [OE-core] [PATCH v2] sbom30.py/spdx30_tasks.py: fix SPDX_* prefix lookup

[Joshua Watt]

[-- Attachment #1: Type: text/plain, Size: 3185 bytes --]

On Mon, Aug 24, 2026 at 11:48 PM iwanicki92 via lists.openembedded.org
<iwanicki92=gmail.com@lists.openembedded.org> wrote:

> I'm not sure where the documentation you found suggests this
>
>
> The Yocto Project documentation:
> https://docs.yoctoproject.org/ref-manual/variables.html#term-SPDX_IMAGE_SUPPLIER
> contains almost the same example:
>
> MY_COMPANY_name = "Acme Corp"
> MY_COMPANY_type = "organization"
> SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
> SPDX_SDK_SUPPLIER = "MY_COMPANY"
>

This is incorrect and needs to be removed


>
> the support for this is already implemented by undocumented `_ref` suffix,
> so maybe documentation should be changed instead.
> Though `_ref` suffix if I'm reading code correctly allows for infinite
> chaining e.g:
>
> SPDX_IMAGE_SUPPLIER_ref = "MY_COMPANY1"
> MY_COMPANY1_ref = "MY_COMPANY2"
> MY_COMPANY2_name = "Acme Corp
>


That's not how _ref works. _ref allows you to "reference" another SPDX
"Agent" that was created elsewhere (instead of creating a new one each
time). So you can do:

SPDX_IMAGE_SUPPLIER_name = "AAAA"
SPDX_IMAGE_SUPPLIER_type = "organization"

SPDX_SDK_SUPPLIER_ref = "SPDX_IMAGE_SUPPLIER"

And then the generated SPDX will only contain a single "AAAA" company
object that is referenced in both cases, instead of creating 2 duplicate
objects. However, at least one of the variables must actually create the
organization for that to work (e.g. SPDX_IMAGE_SUPPLIER in this case)


>
>
> but the values for any base variable are suffixes always appended to that
> base variable
>
> SPDX_IMAGE_SUPPLIER = "MY_COMPANY"
> SPDX_IMAGE_SUPPLIER_MY_COMPANY_name = "CCCC"
> SPDX_IMAGE_SUPPLIER_MY_COMPANY_type = "organization"
>
>
> This one I don't think is mentioned anywhere, and also doesn't work. Maybe
> you meant SPDX_AUTHORS which has this syntax:
>

Yes, I did, sorry for being confusing. Some variables allow multiple things
to be assigned (like SPDX_AUTHORS) and some only allow a single one (like
SPDX_IMAGE_SUPPLIER). The ones the support multiple require the suffixes to
be specified in the variable name, e.g.

  SPDX_AUTHORS = "A B C"

And then the code will create authors using SPDX_AUTHORS_A, SPDX_AUTHORS_B,
and SPDX_AUTHORS_C, but these 3 variables are all treated the same as all
other SPDX Agent variables (e.g. the same as SPDX_IMAGE_SUPPLIER)



>
> SPDX_AUTHORS ??= "openembedded"
> SPDX_AUTHORS[doc] = "A space separated list of the document authors. Each
> item \
>     is used to name a base variable like SPDX_AUTHORS_<AUTHOR> that \
>     describes the author."
> SPDX_AUTHORS_openembedded_name = "OpenEmbedded"
> SPDX_AUTHORS_openembedded_type = "organization"
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#244192):
> https://lists.openembedded.org/g/openembedded-core/message/244192
> Mute This Topic: https://lists.openembedded.org/mt/120910416/3616693
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> JPEWhacker@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 5243 bytes --]