Re: [OE-core][PATCH 2/2] spdx3: support SBOM compression based on SPDX_SBOM_EXT

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Joshua,

On Wednesday, May 13, 2026 at 12:29 AM, Joshua Watt wrote:
> On Tue, May 12, 2026 at 4:27 PM Joshua Watt <jpewhacker@gmail.com> wrote:
> >
> > On Tue, May 12, 2026 at 11:02 AM Jérémie Dautheribes via
> > lists.openembedded.org
> > <jeremie.dautheribes=bootlin.com@lists.openembedded.org> wrote:
> > >
> > > Add support for optional zstd compression for all types of SBOMs,
> > > including:
> > >   - image SBOM
> > >   - recipe SBOM
> > >   - SDK SBOM
> 
> We should perhaps also implement decompression when reading in
> documents, so that the intermediate documents are compressed as well;
> if we are allowing the final documents to be compressed, I don't see a
> compelling reason why we wouldn't just compress all of them.

I am not sure this is a good idea performance-wise, mainly because
Yocto is currently relying on an external program to compress and
decompress. We need to wait for Python 3.14 to be the minimum required
Python version to be able to use the native implementation of zstd.
Indeed intermediate documents are pretty "small".

Also with SPDX2, intermediate documents were not compressed.

The goal is not to reduce the size of the build directory, but only
the size of deployed artifacts.


-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com