Re: [OE-core][PATCH v3 0/8] Implement SPDX for deploy tasks

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Wed Jun 24, 2026 at 4:15 PM CEST, Joshua Watt via lists.openembedded.org wrote:
> The SPDX use case for file system image has been well defined since SPDX
> was first implemented, however there has always been a desire to also
> express SPDX output for other non-image deliverables (primarily, those
> that have a do_deploy task or similar). These types of tasks cannot
> easily use the traditional method of having a separate SPDX task that
> runs to create their SPDX output as this causes lots of problems with
> the way dependencies are specified. Instead, it is desirable for these
> tasks to directly produce SPDX output that can be consumed by other
> tasks that depend on them.
>
> This patch series adds support for this. Any sstate task that starts
> with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and it
> will run a postfunc to generate SPDX output that describes what is being
> deployed. For classical do_deploy tasks, this is setup to be easy by
> automatically capturing all the deployed output files in the SPDX data,
> but other tasks can be added as well.
>
> Finally, the do_create_image_spdx task is removed and replaced with a
> SPDX deploy postfunc using this new system. This means that any task
> that depends on do_image_complete will automatically also get the SPDX
> output for the image, simplifying the dependency handling.
>
> V2: Fixed SPDX documents missing at SBoM creation time when the
> documents were not a direct dependency of the SBoM, and were present in
> a sstate object. Previously, these sstate objects were not restored
> because they were "covered" by the later sstate tasks, but now they are
> restored if they are depended on by a task that creates SPDX output.
>
> V3: Fixed a bug where dependencies that are not in the taskhash could be
> missing when the final SBoM is created and added tests.
>

Hi Joshua,

Thanks for the new version.

We still have a failing selftest here:
2026-06-24 19:12:57,622 - oe-selftest - INFO - sstatetests.SStateHashSameSigs3.test_sstate_sametune_samesigs (subunit.RemotedTestCase)
2026-06-24 19:12:57,624 - oe-selftest - INFO -  ... FAIL
...
2026-06-24 19:12:57,624 - oe-selftest - INFO - 4: 25/26 507/695 (312.34s) (0 failed) (sstatetests.SStateHashSameSigs3.test_sstate_sametune_samesigs)
2026-06-24 19:12:57,624 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/sstatetests.py", line 539, in test_sstate_sametune_samesigs
    self.assertCountEqual(files1, files2)
  File "/usr/lib/python3.12/unittest/case.py", line 1216, in assertCountEqual
    self.fail(msg)
  File "/usr/lib/python3.12/unittest/case.py", line 715, in fail
    raise self.failureException(msg)
AssertionError: Element counts were not equal:
First has 1, Second has 0:  '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-719621/tmp-sstatesamehash/stamps/core2-32-poky-linux/wic-tools/1.0.do_create_spdx.sigdata.85e2be6fe9ccda65abb33aacd4f946a084919518fc0ffc44e3e5698d1c2a98c7'
First has 1, Second has 0:  '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-719621/tmp-sstatesamehash/stamps/core2-32-poky-linux/wic-tools/1.0.do_compile.sigdata.fca66a6aef4d6bda698a57e8297346d610e2b3841dce7f1585dc33bc80d0592e'
First has 1, Second has 0:  '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-719621/tmp-sstatesamehash/stamps/core2-32-poky-linux/wic-tools/1.0.do_prepare_recipe_sysroot.sigdata.377ccf122b60bb2eff57f9c1dbbda056b8d3c687ab594cf2db80c3970706c170'
First has 1, Second has 0:  '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-719621/tmp-sstatesamehash/stamps/core2-32-poky-linux/wic-tools/1.0.do_configure.sigdata.2969439d8a538b9adc3ebf73eb457cce106dbbb1062cc66e9a64cf5a221306dc'
First has 1, Second has 0:  '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-719621/tmp-sstatesamehash/stamps/core2-32-poky-linux/wic-tools/1.0.do_populate_sysroot.sigdata.e8973cc6f00edf67eb1adebfdaa8487edaf137f61b7eec220911b7a1b9afb83c'
...

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4199
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4140
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/3969

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com