Re: [OE-core][PATCH v5 00/13] Add SPDX 3 Recipe Information

Mathieu Dubois-Briand
2026-03-05T19:59:47Z

On Wed Mar 4, 2026 at 5:44 PM CET, Joshua Watt via lists.openembedded.org wrote:
> Changes the SPDX 3 output to include a "recipe" package that describe
> static information available at parse time (without building). This is
> primarily useful for gathering SPDX 3 VEX information about some or all
> recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and
> vex.bbclass.
>
> Special thanks to Benjamin Robin <benjamin.robin@bootlin.com> for
> helping work through this.
>
> V2: Fixes a bug where do_populate_sysroot was running when it should not
> be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is
> incorrect (this is already handled by bitbake in the taskgraph, and
> doesn't need to be manually removed).
>
> V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular
> dependency. meta-world-recipe-sbom also no longer runs in world builds,
> as there's no reason to this. Finally, fixes a bug where
> NO_GENERIC_LICENSE files would fail to be found in do_create_spdx
> (because do_unpack was not run).
>
> V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX
> information is linked to binary packages, or just recipes. Defaults to
> "0" to significantly reduce the size of the SPDX output.
>
> V5: Fixes dummy-sdk-packages to not generate SPDX output, since it
> does funny things with its arch which prevents it from rebuilding SPDX
> data properly, and no SPDX data is needed for it anyway
>
> Joshua Watt (13):
> llvm-project-source: Use allarch.bbclass
> gcc-source: Use allarch.bbclass
> spdx3: Add recipe SPDX data
> spdx3: Add recipe SBoM task
> spdx3: Add is-native property
> spdx30: Include patch file information in VEX
> spdx: De-duplicate CreationInfo
> spdx_common: Check for dependent task in task flags
> spdx30: Skip install package CVE information
> dummy-sdk-package: Disable SPDX
> spdx: Remove fatal errors for missing providers
> spdx3: Use common variable for vardeps
> glibc-testsuite: Do not generate SPDX
>
> meta/classes-global/sstate.bbclass | 4 +-
> .../create-spdx-image-3.0.bbclass | 4 +-
> .../create-spdx-sdk-3.0.bbclass | 4 +-
> meta/classes-recipe/kernel.bbclass | 2 +-
> meta/classes-recipe/nospdx.bbclass | 1 +
> meta/classes/create-spdx-2.2.bbclass | 15 +-
> meta/classes/create-spdx-3.0.bbclass | 87 ++-
> meta/classes/spdx-common.bbclass | 22 +-
> meta/conf/distro/include/maintainers.inc | 1 +
> meta/lib/oe/sbom30.py | 192 ++++---
> meta/lib/oe/spdx30.py | 2 +-
> meta/lib/oe/spdx30_tasks.py | 496 +++++++++++++-----
> meta/lib/oe/spdx_common.py | 11 +
> meta/lib/oeqa/selftest/cases/spdx.py | 41 +-
> .../glibc/glibc-testsuite_2.42.bb | 1 +
> meta/recipes-core/meta/dummy-sdk-package.inc | 1 +
> .../meta/meta-world-recipe-sbom.bb | 29 +
> .../clang/llvm-project-source.inc | 8 +-
> meta/recipes-devtools/gcc/gcc-source.inc | 16 +-
> 19 files changed, 667 insertions(+), 270 deletions(-)
> create mode 100644 meta/recipes-core/meta/meta-world-recipe-sbom.bb

Ok, we are almost there! We only have a selftest failure now:

2026-03-05 16:33:10,060 - oe-selftest - INFO - sysroot.SysrootTests.test_sysroot_cleanup (subunit.RemotedTestCase)
2026-03-05 16:33:10,061 - oe-selftest - INFO - ... FAIL
...
ERROR: sysroot-test-1.0-r0 do_create_spdx: Could not find a builds SPDX document named build-sysroot-test-arch1

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/3457
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/3338
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/3227

Thanks,
Mathieu

--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering