Re: [DRAFT PATCH v3 0/2] Add meta layer information to spdx

["Paul Barker" <paul@pbarker.dev>]

On Fri Nov 6, 2026 at 11:54 AM GMT, Daniel Wagenknecht wrote:
> v3 of the patch series looking for feedback on the overall architecture. I
> worked out the problem in alias linking, so a major blocker is out of the way.
>
> Please continue to consider this as a draft for discussion only!
>
> During discussion on IRC some questions were raised especially regarding the
> interaction with sstate caching.
> The layer information is only part of `create_spdx`, not `create_recipe_spdx`.
> It is thus only added to the final image spdx documents, not to the individual
> recipe or packagage spdx document. Images and their spdx documents are always
> rebuild, so with this approach no additional rebuilds occur even if a layers
> revision changes.
>
> My still open questions are:
> * is the overall architecture reasonable/correct?
> * referring to layers is inconsistent across tooling. E.g. the core layer is
>   either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is
>   the layer directory in the openembedded-core repository.
>   I chose the latter since that is what the utility function
>   `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL)
>   implementation uses the other naming scheme though. Any thoughts on which
>   should be chosen and why? 

Hi Daniel,

It's worth thinking about how this will interact with the proposed
changes to how layer.conf will work [1] [2]. That should hopefully
improve consistency in how layers are referred to across tools, but may
also impact other parts of these patches.

[1]: https://lists.openembedded.org/g/openembedded-architecture/topic/layers_and_layer_conf_time/121884200
[2]: https://lists.openembedded.org/g/openembedded-architecture/topic/layer_changes_poc_and_rfc/122113105

Best regards,

-- 
Paul Barker