[OE-core][PATCH v7 07/12] spdx30: Remove package VEX

Joshua Watt
2026-03-18T13:47:10Z

Removes VEX statements from packages. These are no longer necessary
since the VEX data is now attached to the recipes, which significantly
reduces the duplication of the data, and thus the size of the SPDX
output files.

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
meta/lib/oe/spdx30_tasks.py | 72 -------------------------------------
1 file changed, 72 deletions(-)

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index aec47d4f81..5b651900c4 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -768,31 +768,6 @@ def create_spdx(d):
debug_source_ids = set()
source_hash_cache = {}

- # Collect all VEX statements from the recipe
- vex_statements = {}
- vex_patches = {}
- for rel in recipe_objset.foreach_filter(
- oe.spdx30.Relationship,
- relationshipType=oe.spdx30.RelationshipType.hasAssociatedVulnerability,
- ):
- for cve in rel.to:
- vex_statements[cve] = []
- vex_patches[cve] = []
-
- for cve in vex_statements.keys():
- for rel in recipe_objset.foreach_filter(
- oe.spdx30.security_VexVulnAssessmentRelationship,
- from_=cve,
- ):
- vex_statements[cve].append(rel)
- if rel.relationshipType == oe.spdx30.RelationshipType.fixedIn:
- for patch_rel in recipe_objset.foreach_filter(
- oe.spdx30.Relationship,
- relationshipType=oe.spdx30.RelationshipType.patchedBy,
- from_=rel,
- ):
- vex_patches[cve].extend(patch_rel.to)
-
# Write out the package SPDX data now. It is not complete as we cannot
# write the runtime data, so write it to a staging area and a later task
# will write out the final collection
@@ -931,53 +906,6 @@ def create_spdx(d):
[oe.sbom30.get_element_link_id(concluded_spdx_license)],
)

- # Copy CVEs from recipe
- if vex_statements:
- pkg_objset.new_relationship(
- [spdx_package],
- oe.spdx30.RelationshipType.hasAssociatedVulnerability,
- sorted(
- oe.sbom30.get_element_link_id(cve)
- for cve in vex_statements.keys()
- ),
- )
-
- for cve, vexes in vex_statements.items():
- for vex in vexes:
- if vex.relationshipType == oe.spdx30.RelationshipType.fixedIn:
- spdx_vex = pkg_objset.new_vex_patched_relationship(
- [oe.sbom30.get_element_link_id(cve)], [spdx_package]
- )
- if vex_patches[cve]:
- pkg_objset.new_scoped_relationship(
- spdx_vex,
- oe.spdx30.RelationshipType.patchedBy,
- oe.spdx30.LifecycleScopeType.build,
- [
- oe.sbom30.get_element_link_id(p)
- for p in vex_patches[cve]
- ],
- )
-
- elif vex.relationshipType == oe.spdx30.RelationshipType.affects:
- pkg_objset.new_vex_unpatched_relationship(
- [oe.sbom30.get_element_link_id(cve)], [spdx_package]
- )
- elif (
- vex.relationshipType == oe.spdx30.RelationshipType.doesNotAffect
- ):
- spdx_vex = pkg_objset.new_vex_ignored_relationship(
- [oe.sbom30.get_element_link_id(cve)],
- [spdx_package],
- impact_statement=vex.security_impactStatement,
- )
-
- if vex.security_justificationType:
- for v in spdx_vex:
- v.security_justificationType = (
- vex.security_justificationType
- )
-
bb.debug(1, "Adding package files to SPDX for package %s" % pkg_name)
package_files = add_package_files(
d,
--
2.53.0