Re: [OE-core][PATCH v6 00/12] Add SPDX 3.0 support

Joshua Watt
2024-07-15T21:26:23Z

On Mon, Jul 15, 2024 at 3:07 PM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Mon, 2024-07-15 at 14:40 -0600, Joshua Watt wrote:
> > On Sat, Jul 13, 2024 at 12:44 AM Richard Purdie
> > <richard.purdie@linuxfoundation.org> wrote:
> > >
> > > On Fri, 2024-07-12 at 09:58 -0600, Joshua Watt via
> > > lists.openembedded.org wrote:
> > > > This patch series add support for SPDX 3.0 and sets it as the
> > > > default.
> > > > Currently it is not possible to have SPDX 2.2 and SPDX 3.0
> > > > enabled at
> > > > the same time
> > > >
> > > > v2: Added tests and addressed feedback
> > > > v3: Fixed several oe-selftest and build failures
> > > > v4: Fixed silly typo mistake in staging.bbclass
> > > > v5: Reworked to make SPDX 3 output reproducible by default.
> > > > Variables
> > > > that introduce non-reproducible output are documented as
> > > > such.
> > > > v6: Many changes:
> > > > * Fixed bug where building baremetal images would break SPDX
> > > > 2.2
> > > > * Most SPDX code is now in python library files instead of
> > > > tasks
> > > > * Removed dependency on pacakge_write_* tasks
> > > > * Fixed sstate selftest cases to account for SPDX 3.0 task
> > > > names
> > >
> > > This had a lot of failures in testing I'm afraid:
> > >
> > > https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7134
> >
> > This appears to be caused because the SPDX tasks are not running for
> > some recipes (e.g. automake). It looks like this like:
> >
> > do_create_rootfs_spdx[recrdeptask] += "do_create_spdx
> > do_create_package_spdx"
> >
> > is not actually strong enough to make sure the SPDX tasks for
> > automake
> > run for e.g. core-image-sato-sdk, but I don't know why. I'll keep
> > looking, but if anyone happens to know off the top of their head let
> > me know
>
> Can you be specific about which tasks you mean when you say "make sure
> the SPDX tasks for automake run"? Do you mean do_create_spdx,
> do_create_package_spdx or a different one?

Specifically, do_create_package_spdx must be run for each package
installed in the rootfs before do_create_rootfs_spdx runs. I thought
that

do_create_rootfs_spdx[recrdeptask] += "do_create_spdx do_create_package_spdx"

would do this (the do_create_spdx is probably not necessary), since
AFIACT, this is also how the packages get generated before being
installed in the root file system via manipulation of
do_rootfs[recrdeptask], but I think I'm missing something?

>
> Cheers,
>
> Richard