[OE-core][PATCH v13 0/4] SPDX 3.0 SBOM enrichment and compliance improvements

Stefano Tondo
2026-03-23T21:07:53Z

This series enhances SPDX 3.0 SBOM generation with enriched
metadata and compliance-oriented controls for current master.

Changes since v12:

- Respun the full series from scratch on current master to eliminate
cross-patch churn introduced during a previous rebase: patches were
modifying code that later patches in the same series changed again.
The net diff is byte-identical to v12; only patch boundaries changed
so each commit is now self-contained with no overlapping hunks.

Validated with:

oe-selftest -r \
spdx.SPDX30Check.test_packageconfig_spdx \
spdx.SPDX30Check.test_download_location_defensive_handling \
spdx.SPDX30Check.test_version_extraction_patterns

Stefano Tondo (4):
spdx30: Add configurable file exclusion pattern support
spdx30: Add supplier support for image and SDK SBOMs
spdx30: Enrich source downloads with version and PURL
oeqa/selftest: Add tests for source download enrichment

meta/classes-recipe/cargo_common.bbclass | 3 +
meta/classes-recipe/cpan.bbclass | 11 +
meta/classes-recipe/go-mod.bbclass | 6 +
meta/classes-recipe/npm.bbclass | 7 +
meta/classes-recipe/pypi.bbclass | 6 +-
meta/classes/create-spdx-3.0.bbclass | 17 ++
meta/classes/spdx-common.bbclass | 7 +
meta/lib/oe/spdx30_tasks.py | 278 +++++++++++++++++------
meta/lib/oeqa/selftest/cases/spdx.py | 104 +++++++--
9 files changed, 345 insertions(+), 94 deletions(-)

--
2.53.0