[PATCH] spdx30_tasks: include the SDK target packages in the SDK SBOM

[Prasanth R <ragaprasanth@gmail.com>]

The SDK target and host parts both write sdk-rootfs.spdx.json. The host
part runs last and overwrites the target one, so the SDK SBOM lists the
nativesdk packages but none of the target sysroot packages.

Write separate target and host documents, with their own build IDs, and
include both in the SDK SBOM.

SPDX 2.2 wrote separate host and target SBOMs, so this was lost when
the SDK SBOM moved to SPDX 3.0.

AI-Generated: Uses Claude
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
---

Notes:
    Tested with "bitbake core-image-minimal for checking the software_Package names in the SDK SBOM.
    
    Before: 740 packages, only the ...-toolchain-nodistro.0-host rootfs,
    no target packages (libc6...).
    
    After: 1128 packages, both the ...-host and ...-target rootfs, and the
    target packages are included.
    
    oe-selftest -r spdx.SPDX30Check.test_core_image_minimal_sdk passes.

 meta/lib/oe/spdx30_tasks.py | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 1d11d8d1d2..646ec7d074 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -1602,7 +1602,9 @@ def sdk_create_spdx(d, sdk_type, spdx_work_dir, toolchain_outputname):
     )
     set_timestamp_now(d, sdk_rootfs, "builtTime")
 
-    sdk_build = objset.add_root(objset.new_task_build("sdk-rootfs", "sdk-rootfs"))
+    sdk_build = objset.add_root(
+        objset.new_task_build("sdk-rootfs-" + sdk_type, "sdk-rootfs")
+    )
     set_timestamp_now(d, sdk_build, "build_buildEndTime")
 
     objset.new_scoped_relationship(
@@ -1615,28 +1617,36 @@ def sdk_create_spdx(d, sdk_type, spdx_work_dir, toolchain_outputname):
     collect_build_package_inputs(d, objset, sdk_build, sdk_packages)
 
     objset.add_aliases()
-    oe.sbom30.write_jsonld_doc(d, objset, spdx_work_dir / "sdk-rootfs.spdx.json")
+    oe.sbom30.write_jsonld_doc(
+        d, objset, spdx_work_dir / ("sdk-rootfs-%s.spdx.json" % sdk_type)
+    )
 
 
 def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname):
-    # Load the document written earlier
-    rootfs_objset = oe.sbom30.load_jsonld(
-        d, spdx_work_dir / "sdk-rootfs.spdx.json", required=True
-    )
+    # Load the target and host documents written earlier
+    rootfs_objsets = []
+    rootfs = []
+    for sdk_type in ("target", "host"):
+        objset = oe.sbom30.load_jsonld(
+            d, spdx_work_dir / ("sdk-rootfs-%s.spdx.json" % sdk_type), required=True
+        )
+        root = objset.find_root(oe.spdx30.software_Package)
+        if root is None:
+            bb.fatal("Unable to find %s rootfs artifact" % sdk_type)
+        rootfs_objsets.append(objset)
+        rootfs.append(root)
+
+    rootfs_objset = rootfs_objsets[0]
 
     # Create a new build for the SDK installer
     sdk_build = rootfs_objset.new_task_build("sdk-populate", "sdk-populate")
     set_timestamp_now(d, sdk_build, "build_buildEndTime")
 
-    rootfs = rootfs_objset.find_root(oe.spdx30.software_Package)
-    if rootfs is None:
-        bb.fatal("Unable to find rootfs artifact")
-
     rootfs_objset.new_scoped_relationship(
         [sdk_build],
         oe.spdx30.RelationshipType.hasInput,
         oe.spdx30.LifecycleScopeType.build,
-        [rootfs],
+        rootfs,
     )
 
     files = set()
@@ -1683,7 +1693,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname):
         bb.warn(f"No SDK output files found in {sdk_deploydir}")
 
     objset, sbom = oe.sbom30.create_sbom(
-        d, toolchain_outputname, sorted(list(files)), [rootfs_objset]
+        d, toolchain_outputname, sorted(list(files)), rootfs_objsets
     )
 
     # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
-- 
2.34.1