[PATCH v3 2/3] create-spdx-3.0: record component release date in SPDX output

[<daniel.turull@ericsson.com>]

From: Daniel Turull <daniel.turull@ericsson.com>

Record each recipe's release date in the releaseTime property of its
software_Package object, using the SOURCE_DATE_EPOCH already computed
for reproducible builds.

Accuracy depends on how SOURCE_DATE_EPOCH was derived: exact for
git-tagged recipes, best-effort for tarball/http(s) sources. Some
Python sdists (e.g. cryptography, hypothesis, maturin) normalize all
file mtimes to a fixed placeholder, so their releaseTime reflects
packaging-tool behavior, not the real release date.

Tested with oe-selftest -r spdx, and with `bitbake world
--runall=do_create_spdx`: 1011/1150 recipes got a releaseTime (range
1998-12-30 to 2026-09-17), 139 correctly had none.

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
v2:
- Dropped all options per Joshua's feedback; read SDE_FILE directly.
- Dropped the redundant else: delattr(recipe, "releaseTime") branch.
- Selftest compares against SDE_FILE content directly instead of
  SOURCE_DATE_EPOCH, which can diverge from it.
- Fixed a leak: recipes with no git checkout and no fetched source
  had SDE_FILE holding only SOURCE_DATE_EPOCH_FALLBACK, showing a
  bogus 2011-04-05T23:00:00Z releaseTime instead of none.
v3:
- Also run after do_unpack: do_deploy_source_date_epoch's setscene
  shortcut can skip it, leaving SOURCE_DATE_EPOCH unset.
- get_release_date() reads SOURCE_DATE_EPOCH again instead of
  SDE_FILE, now that they're guaranteed equivalent.
- test_release_date_source_date_epoch: switched to tar (base-files
  has S == UNPACKDIR and never gets a real SOURCE_DATE_EPOCH).
- Added test_release_date_omitted_for_fallback_value.
---
 meta/classes/create-spdx-3.0.bbclass |  2 +-
 meta/lib/oe/spdx30_tasks.py          | 19 ++++++++++++++
 meta/lib/oeqa/selftest/cases/spdx.py | 39 ++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/meta/classes/create-spdx-3.0.bbclass b/meta/classes/create-spdx-3.0.bbclass
index 56fd01fd53..2b1465b5a6 100644
--- a/meta/classes/create-spdx-3.0.bbclass
+++ b/meta/classes/create-spdx-3.0.bbclass
@@ -192,7 +192,7 @@ python do_create_recipe_spdx() {
     import oe.spdx30_tasks
     oe.spdx30_tasks.create_recipe_spdx(d)
 }
-addtask do_create_recipe_spdx
+addtask do_create_recipe_spdx after do_unpack do_deploy_source_date_epoch
 
 SSTATETASKS += "do_create_recipe_spdx"
 do_create_recipe_spdx[sstate-inputdirs] = "${SPDXRECIPEDEPLOY}"
diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index b6456a214a..964c2f1594 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -36,6 +36,21 @@ def set_timestamp_now(d, o, prop):
         delattr(o, prop)
 
 
+def get_release_date(d):
+    """Resolve the release date to record in a recipe's releaseTime property.
+
+    Uses SOURCE_DATE_EPOCH; omits the fallback value since it's not a
+    meaningful release date.
+
+    Returns a datetime, or None if no release date should be recorded.
+    """
+    source_date_epoch = d.getVar("SOURCE_DATE_EPOCH")
+    if not source_date_epoch or source_date_epoch == d.getVar("SOURCE_DATE_EPOCH_FALLBACK"):
+        return None
+
+    return datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+
 def add_license_expression(
     d, objset, license_expression, license_data, search_objsets=[]
 ):
@@ -633,6 +648,10 @@ def create_recipe_spdx(d):
     if val := d.getVar("DESCRIPTION"):
         recipe.description = val
 
+    release_date = get_release_date(d)
+    if release_date is not None:
+        recipe.releaseTime = release_date
+
     for cpe_id in oe.cve_check.get_cpe_ids(
         d.getVar("CVE_PRODUCT"), d.getVar("CVE_VERSION")
     ):
diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py
index 8285189382..668915b686 100644
--- a/meta/lib/oeqa/selftest/cases/spdx.py
+++ b/meta/lib/oeqa/selftest/cases/spdx.py
@@ -6,6 +6,7 @@
 
 import textwrap
 import hashlib
+from datetime import datetime, timezone
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars
 import oe.spdx30
@@ -443,3 +444,41 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
                 r'\d',
                 f"Version '{version}' for package '{name}' should contain digits"
             )
+
+    def test_release_date_source_date_epoch(self):
+        """releaseTime should be derived from SOURCE_DATE_EPOCH."""
+        objset = self.check_recipe_spdx(
+            "tar",
+            "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/static/static-tar.spdx.json",
+            task="create_recipe_spdx",
+        )
+
+        source_date_epoch = get_bb_var("SOURCE_DATE_EPOCH", "tar")
+        expected = datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+        recipe = None
+        for pkg in objset.foreach_type(oe.spdx30.software_Package):
+            if pkg.name == "tar":
+                recipe = pkg
+                break
+
+        self.assertIsNotNone(recipe, "Unable to find tar software_Package")
+        self.assertEqual(recipe.releaseTime, expected)
+
+    def test_release_date_omitted_for_fallback_value(self):
+        """releaseTime must be omitted when SDE_FILE only has the fallback."""
+        # packagegroup-base has no SRC_URI, so it only ever gets the fallback.
+        objset = self.check_recipe_spdx(
+            "packagegroup-base",
+            "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-packagegroup-base.spdx.json",
+            task="create_recipe_spdx",
+        )
+
+        recipe = None
+        for pkg in objset.foreach_type(oe.spdx30.software_Package):
+            if pkg.name == "packagegroup-base":
+                recipe = pkg
+                break
+
+        self.assertIsNotNone(recipe, "Unable to find packagegroup-base software_Package")
+        self.assertIsNone(recipe.releaseTime)