Re: [OE-core][PATCH v7 00/12] Add SPDX 3 Recipe Information

Joshua Watt
2026-03-18T13:49:20Z

Mathieu,

Here is my latest SPDX patch set (finally!). I'm sorry for the delay
and the mix up with Stefano's patches. I believe that you can now
stack Stefanos patches on top of mine and everything should be OK

Thank you,
Joshua

On Wed, Mar 18, 2026 at 7:46 AM Joshua Watt <jpewhacker@gmail.com> wrote:
>
> Changes the SPDX 3 output to include a "recipe" package that describe
> static information available at parse time (without building). This is
> primarily useful for gathering SPDX 3 VEX information about some or all
> recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and
> vex.bbclass.
>
> Special thanks to Benjamin Robin <benjamin.robin@bootlin.com> for
> helping work through this.
>
> V2: Fixes a bug where do_populate_sysroot was running when it should not
> be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is
> incorrect (this is already handled by bitbake in the taskgraph, and
> doesn't need to be manually removed).
>
> V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular
> dependency. meta-world-recipe-sbom also no longer runs in world builds,
> as there's no reason to this. Finally, fixes a bug where
> NO_GENERIC_LICENSE files would fail to be found in do_create_spdx
> (because do_unpack was not run).
>
> V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX
> information is linked to binary packages, or just recipes. Defaults to
> "0" to significantly reduce the size of the SPDX output.
>
> V5: Fixes dummy-sdk-packages to not generate SPDX output, since it
> does funny things with its arch which prevents it from rebuilding SPDX
> data properly, and no SPDX data is needed for it anyway
>
> V6: Fixes a bug where SPDX task would not correctly re-run when they
> change, which would cause errors about missing SPDX document. Also
> updates to the latest version of the SPDX bindings which improves
> performance
>
> V7: Makes meta-world-recipe-sbom create the world SBoM when run with a
> task (e.g. as part of do_build). Drops the removal of SPDX from
> dummy-sdk-packages as these have been fixed to work properly.
>
> Joshua Watt (12):
> spdx3: Add recipe SPDX data
> spdx3: Add recipe SBoM task
> spdx3: Add is-native property
> spdx30: Include patch file information in VEX
> spdx: De-duplicate CreationInfo
> spdx_common: Check for dependent task in task flags
> spdx30: Remove package VEX
> spdx: Remove fatal errors for missing providers
> spdx3: Use common variable for vardeps
> glibc-testsuite: Do not generate SPDX
> spdx: Remove do_collect_spdx_deps task
> spdx: Update to latest bindings
>
> meta/classes-global/sstate.bbclass | 4 +-
> .../create-spdx-image-3.0.bbclass | 4 +-
> .../create-spdx-sdk-3.0.bbclass | 4 +-
> meta/classes-recipe/kernel.bbclass | 2 +-
> meta/classes-recipe/nospdx.bbclass | 2 +-
> meta/classes/create-spdx-2.2.bbclass | 33 +-
> meta/classes/create-spdx-3.0.bbclass | 81 +-
> meta/classes/spdx-common.bbclass | 34 +-
> meta/conf/distro/include/maintainers.inc | 1 +
> meta/lib/oe/sbom30.py | 239 +-
> meta/lib/oe/spdx30/__init__.py | 8 +
> meta/lib/oe/spdx30/__main__.py | 12 +
> meta/lib/oe/spdx30/cmd.py | 75 +
> meta/lib/oe/{spdx30.py => spdx30/model.py} | 5935 ++++++++++-------
> meta/lib/oe/spdx30/stub.pyi | 2544 +++++++
> meta/lib/oe/spdx30_tasks.py | 459 +-
> meta/lib/oe/spdx_common.py | 78 +-
> meta/lib/oeqa/selftest/cases/spdx.py | 28 +-
> .../glibc/glibc-testsuite_2.43.bb | 1 +
> .../meta/meta-world-recipe-sbom.bb | 38 +
> scripts/contrib/make-spdx-bindings.sh | 3 +-
> 21 files changed, 6837 insertions(+), 2748 deletions(-)
> create mode 100644 meta/lib/oe/spdx30/__init__.py
> create mode 100644 meta/lib/oe/spdx30/__main__.py
> create mode 100644 meta/lib/oe/spdx30/cmd.py
> rename meta/lib/oe/{spdx30.py => spdx30/model.py} (52%)
> create mode 100644 meta/lib/oe/spdx30/stub.pyi
> create mode 100644 meta/recipes-core/meta/meta-world-recipe-sbom.bb
>
> --
> 2.53.0
>