[OE-core][PATCH 0/2] Fix SPDX 2.2 for common SPDX changes

[OE-core][PATCH 0/2] Fix SPDX 2.2 for common SPDX changes

[Joshua Watt]

Fixes SPDX 2.2 generation to account for changes to the common SPDX
code, and improves the testing to get better coverage of SPDX 2.2

Joshua Watt (2):
  classes: create-spdx-2.2: Fix dependency handling
  oeqa: spdx: Add tar test for SPDX 2.2

 meta/classes/create-spdx-2.2.bbclass | 10 +++++-----
 meta/lib/oeqa/selftest/cases/spdx.py |  9 ++++++---
 2 files changed, 11 insertions(+), 8 deletions(-)

-- 
2.47.1

[OE-core][PATCH 1/2] classes: create-spdx-2.2: Fix dependency handling

[Joshua Watt]

The common SPDX code was changed to return a dataclass for dependency
information instead of a namedtuple, but the SPDX 2.2 was missed to
account for this. Correct the SPDX 2.2 code to correctly handle the new
datatype

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
 meta/classes/create-spdx-2.2.bbclass | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
index 8f988de8681..de62379c503 100644
--- a/meta/classes/create-spdx-2.2.bbclass
+++ b/meta/classes/create-spdx-2.2.bbclass
@@ -279,21 +279,21 @@ def collect_dep_recipes(d, doc, spdx_recipe):
 
     deps = oe.spdx_common.get_spdx_deps(d)
 
-    for dep_pn, dep_hashfn, in_taskhash in deps:
+    for dep in deps:
         # If this dependency is not calculated in the taskhash skip it.
         # Otherwise, it can result in broken links since this task won't
         # rebuild and see the new SPDX ID if the dependency changes
-        if not in_taskhash:
+        if not dep.in_taskhash:
             continue
 
-        dep_recipe_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "recipe-" + dep_pn, dep_hashfn)
+        dep_recipe_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "recipe-" + dep.pn, dep.hashfn)
         if not dep_recipe_path:
-            bb.fatal("Cannot find any SPDX file for recipe %s, %s" % (dep_pn, dep_hashfn))
+            bb.fatal("Cannot find any SPDX file for recipe %s, %s" % (dep.pn, dep.hashfn))
 
         spdx_dep_doc, spdx_dep_sha1 = oe.sbom.read_doc(dep_recipe_path)
 
         for pkg in spdx_dep_doc.packages:
-            if pkg.name == dep_pn:
+            if pkg.name == dep.pn:
                 spdx_dep_recipe = pkg
                 break
         else:
-- 
2.47.1

[OE-core][PATCH 2/2] oeqa: spdx: Add tar test for SPDX 2.2

[Joshua Watt]

The base-files test for SPDX 2.2 did not give good coverage, since
base-files doesn't have any dependencies. Add building tar as another
test which more fully exercises the code

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
 meta/lib/oeqa/selftest/cases/spdx.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py
index 2351103433a..6eac5f9911f 100644
--- a/meta/lib/oeqa/selftest/cases/spdx.py
+++ b/meta/lib/oeqa/selftest/cases/spdx.py
@@ -31,13 +31,13 @@ class SPDX22Check(OESelftestTestCase):
         self.write_config(config)
 
         deploy_dir = get_bb_var("DEPLOY_DIR")
-        machine_var = get_bb_var("MACHINE")
+        arch_dir = get_bb_var("PACKAGE_ARCH", target_name)
         spdx_version = get_bb_var("SPDX_VERSION")
         # qemux86-64 creates the directory qemux86_64
-        machine_dir = machine_var.replace("-", "_")
+        #arch_dir = arch_var.replace("-", "_")
 
         full_file_path = os.path.join(
-            deploy_dir, "spdx", spdx_version, machine_dir, high_level_dir, spdx_file
+            deploy_dir, "spdx", spdx_version, arch_dir, high_level_dir, spdx_file
         )
 
         try:
@@ -68,6 +68,9 @@ class SPDX22Check(OESelftestTestCase):
     def test_spdx_base_files(self):
         self.check_recipe_spdx("packages", "base-files.spdx.json", "base-files")
 
+    def test_spdx_tar(self):
+        self.check_recipe_spdx("packages", "tar.spdx.json", "tar")
+
 
 class SPDX3CheckBase(object):
     """
-- 
2.47.1

RE: [OE-core][PATCH 2/2] oeqa: spdx: Add tar test for SPDX 2.2

[Marko, Peter]

Hello Joshua,

I think the main issue why the code got broken was that there is no image test for spdx 2.2

Peter

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Joshua Watt via
> lists.openembedded.org
> Sent: Friday, March 21, 2025 16:13
> To: openembedded-core@lists.openembedded.org
> Cc: Joshua Watt <JPEWhacker@gmail.com>
> Subject: [OE-core][PATCH 2/2] oeqa: spdx: Add tar test for SPDX 2.2
> 
> The base-files test for SPDX 2.2 did not give good coverage, since
> base-files doesn't have any dependencies. Add building tar as another
> test which more fully exercises the code
> 
> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> ---
>  meta/lib/oeqa/selftest/cases/spdx.py | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/meta/lib/oeqa/selftest/cases/spdx.py
> b/meta/lib/oeqa/selftest/cases/spdx.py
> index 2351103433a..6eac5f9911f 100644
> --- a/meta/lib/oeqa/selftest/cases/spdx.py
> +++ b/meta/lib/oeqa/selftest/cases/spdx.py
> @@ -31,13 +31,13 @@ class SPDX22Check(OESelftestTestCase):
>          self.write_config(config)
> 
>          deploy_dir = get_bb_var("DEPLOY_DIR")
> -        machine_var = get_bb_var("MACHINE")
> +        arch_dir = get_bb_var("PACKAGE_ARCH", target_name)
>          spdx_version = get_bb_var("SPDX_VERSION")
>          # qemux86-64 creates the directory qemux86_64
> -        machine_dir = machine_var.replace("-", "_")
> +        #arch_dir = arch_var.replace("-", "_")
> 
>          full_file_path = os.path.join(
> -            deploy_dir, "spdx", spdx_version, machine_dir, high_level_dir, spdx_file
> +            deploy_dir, "spdx", spdx_version, arch_dir, high_level_dir, spdx_file
>          )
> 
>          try:
> @@ -68,6 +68,9 @@ class SPDX22Check(OESelftestTestCase):
>      def test_spdx_base_files(self):
>          self.check_recipe_spdx("packages", "base-files.spdx.json", "base-files")
> 
> +    def test_spdx_tar(self):
> +        self.check_recipe_spdx("packages", "tar.spdx.json", "tar")
> +
> 
>  class SPDX3CheckBase(object):
>      """
> --
> 2.47.1