[PATCH v2] meta: fix generation of kernel CONFIG_ in SPDX3

[PATCH v2] meta: fix generation of kernel CONFIG_ in SPDX3

[Benjamin Robin]

With the current solution, using a separate task
(do_create_kernel_config_spdx) there is a dependency issue. Sometimes
the final rootfs SBOM does not contain the CONFIG_ values.

do_create_kernel_config_spdx is executed after do_create_spdx which
deploys the SPDX file. do_create_kernel_config_spdx calls
oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
which is OK, but the do_create_kernel_config_spdx ends up writing to
this deployed file (updating it).

do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
tasks, but there is nothing that prevents executing
do_create_kernel_config_spdx after do_create_rootfs_spdx.

To fix it, instead, now read from the workdir, and write to the
workdir, and do the processing from the do_create_spdx task:
we append to the do_create_spdx task.
Furthermore, update oeqa selftest to execute do_create_spdx instead
of removed function.

Also only execute this task if create-spdx-3.0 was inherited,
previously this code could be executed if create-spdx-2.2 is
inherited.

Fixes: 228a968e7c47 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Changes in v2:
- Update spdx oeqa selftest
- Link to v1: https://lore.kernel.org/r/20260213-fix-kernel-config-spdx-v1-1-4fd66ca5cb5d@bootlin.com
---
 meta/classes-recipe/kernel.bbclass   | 22 ++++++++++------------
 meta/lib/oeqa/selftest/cases/spdx.py |  2 +-
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index f989b31c477c..ce43f6c13036 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -864,13 +864,9 @@ addtask deploy after do_populate_sysroot do_packagedata
 
 EXPORT_FUNCTIONS do_deploy
 
-python __anonymous() {
-    inherits = (d.getVar("INHERIT") or "")
-    if "create-spdx" in inherits:
-        bb.build.addtask('do_create_kernel_config_spdx', 'do_populate_lic do_deploy', 'do_create_spdx', d)
-}
-
-python do_create_kernel_config_spdx() {
+do_create_spdx:append() {
+    if not bb.data.inherits_class("create-spdx-3.0", d):
+        return
     if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) == "1":
         import oe.spdx30
         import oe.spdx30_tasks
@@ -903,9 +899,11 @@ python do_create_kernel_config_spdx() {
         except Exception as e:
             bb.error(f"Failed to parse kernel config file: {e}")
 
-        build, build_objset = oe.sbom30.find_root_obj_in_jsonld(
-            d, "recipes", f"recipe-{pn}", oe.spdx30.build_Build
-        )
+        path = oe.sbom30.jsonld_arch_path(d, pkg_arch, "recipes", f"recipe-{pn}", deploydir=deploydir)
+        build_objset = oe.sbom30.load_jsonld(d, path, required=True)
+        build = build_objset.find_root(oe.spdx30.build_Build)
+        if not build:
+            bb.fatal("No root %s found in %s" % (oe.spdx30.build_Build.__name__, path))
 
         kernel_build = build_objset.add_root(
             oe.spdx30.build_Build(
@@ -924,9 +922,9 @@ python do_create_kernel_config_spdx() {
             [kernel_build]
         )
 
-        oe.sbom30.write_jsonld_doc(d, build_objset, deploydir / pkg_arch / "recipes" / f"recipe-{pn}.spdx.json")
+        oe.sbom30.write_jsonld_doc(d, build_objset, path)
 }
-do_create_kernel_config_spdx[depends] = "virtual/kernel:do_configure"
+do_create_spdx[depends] += "virtual/kernel:do_configure"
 
 # Add using Device Tree support
 inherit kernel-devicetree
diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py
index 41ef52fce1ca..5830d7c0872a 100644
--- a/meta/lib/oeqa/selftest/cases/spdx.py
+++ b/meta/lib/oeqa/selftest/cases/spdx.py
@@ -369,7 +369,7 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
         objset = self.check_recipe_spdx(
             kernel_recipe,
             spdx_path,
-            task="do_create_kernel_config_spdx",
+            task="do_create_spdx",
             extraconf="""\
                 INHERIT += "create-spdx"
                 SPDX_INCLUDE_KERNEL_CONFIG = "1"

---
base-commit: 3a8f0075d52cb653118774baa03aa8d5231f943c
change-id: 20260213-fix-kernel-config-spdx-99223936e69f

Best regards,
-- 
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

Re: [PATCH v2] meta: fix generation of kernel CONFIG_ in SPDX3

[Joshua Watt]

On Mon, Feb 16, 2026 at 1:47 AM Benjamin Robin
<benjamin.robin@bootlin.com> wrote:
>
> With the current solution, using a separate task
> (do_create_kernel_config_spdx) there is a dependency issue. Sometimes
> the final rootfs SBOM does not contain the CONFIG_ values.
>
> do_create_kernel_config_spdx is executed after do_create_spdx which
> deploys the SPDX file. do_create_kernel_config_spdx calls
> oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
> which is OK, but the do_create_kernel_config_spdx ends up writing to
> this deployed file (updating it).
>
> do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
> tasks, but there is nothing that prevents executing
> do_create_kernel_config_spdx after do_create_rootfs_spdx.
>
> To fix it, instead, now read from the workdir, and write to the
> workdir, and do the processing from the do_create_spdx task:
> we append to the do_create_spdx task.
> Furthermore, update oeqa selftest to execute do_create_spdx instead
> of removed function.
>
> Also only execute this task if create-spdx-3.0 was inherited,
> previously this code could be executed if create-spdx-2.2 is
> inherited.
>
> Fixes: 228a968e7c47 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---
> Changes in v2:
> - Update spdx oeqa selftest
> - Link to v1: https://lore.kernel.org/r/20260213-fix-kernel-config-spdx-v1-1-4fd66ca5cb5d@bootlin.com
> ---
>  meta/classes-recipe/kernel.bbclass   | 22 ++++++++++------------
>  meta/lib/oeqa/selftest/cases/spdx.py |  2 +-
>  2 files changed, 11 insertions(+), 13 deletions(-)
>
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index f989b31c477c..ce43f6c13036 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -864,13 +864,9 @@ addtask deploy after do_populate_sysroot do_packagedata
>
>  EXPORT_FUNCTIONS do_deploy
>
> -python __anonymous() {
> -    inherits = (d.getVar("INHERIT") or "")
> -    if "create-spdx" in inherits:
> -        bb.build.addtask('do_create_kernel_config_spdx', 'do_populate_lic do_deploy', 'do_create_spdx', d)
> -}
> -
> -python do_create_kernel_config_spdx() {
> +do_create_spdx:append() {
> +    if not bb.data.inherits_class("create-spdx-3.0", d):
> +        return

I like this in general, but if you're going to bbappend, the `return`
will mess with any other appends, so it needs to be avoided. Probably
just put all the code under a
`if bb.data.inherits_class("create-spdx-3.0", d):` instead

>      if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) == "1":
>          import oe.spdx30
>          import oe.spdx30_tasks
> @@ -903,9 +899,11 @@ python do_create_kernel_config_spdx() {
>          except Exception as e:
>              bb.error(f"Failed to parse kernel config file: {e}")
>
> -        build, build_objset = oe.sbom30.find_root_obj_in_jsonld(
> -            d, "recipes", f"recipe-{pn}", oe.spdx30.build_Build
> -        )
> +        path = oe.sbom30.jsonld_arch_path(d, pkg_arch, "recipes", f"recipe-{pn}", deploydir=deploydir)
> +        build_objset = oe.sbom30.load_jsonld(d, path, required=True)
> +        build = build_objset.find_root(oe.spdx30.build_Build)
> +        if not build:
> +            bb.fatal("No root %s found in %s" % (oe.spdx30.build_Build.__name__, path))
>
>          kernel_build = build_objset.add_root(
>              oe.spdx30.build_Build(
> @@ -924,9 +922,9 @@ python do_create_kernel_config_spdx() {
>              [kernel_build]
>          )
>
> -        oe.sbom30.write_jsonld_doc(d, build_objset, deploydir / pkg_arch / "recipes" / f"recipe-{pn}.spdx.json")
> +        oe.sbom30.write_jsonld_doc(d, build_objset, path)
>  }
> -do_create_kernel_config_spdx[depends] = "virtual/kernel:do_configure"
> +do_create_spdx[depends] += "virtual/kernel:do_configure"
>
>  # Add using Device Tree support
>  inherit kernel-devicetree
> diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py
> index 41ef52fce1ca..5830d7c0872a 100644
> --- a/meta/lib/oeqa/selftest/cases/spdx.py
> +++ b/meta/lib/oeqa/selftest/cases/spdx.py
> @@ -369,7 +369,7 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
>          objset = self.check_recipe_spdx(
>              kernel_recipe,
>              spdx_path,
> -            task="do_create_kernel_config_spdx",
> +            task="do_create_spdx",
>              extraconf="""\
>                  INHERIT += "create-spdx"
>                  SPDX_INCLUDE_KERNEL_CONFIG = "1"
>
> ---
> base-commit: 3a8f0075d52cb653118774baa03aa8d5231f943c
> change-id: 20260213-fix-kernel-config-spdx-99223936e69f
>
> Best regards,
> --
> Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
>

Re: [PATCH v2] meta: fix generation of kernel CONFIG_ in SPDX3

[Benjamin ROBIN]

On Monday, February 23, 2026 at 6:43 PM, Joshua Watt wrote:
> I like this in general, but if you're going to bbappend, the `return`
> will mess with any other appends, so it needs to be avoided. Probably
> just put all the code under a
> `if bb.data.inherits_class("create-spdx-3.0", d):` instead

Indeed, thank you for your feedback.
My initial plan was to move all code inside a Python function named
create_kernel_config_spdx, and to call this function from 
do_create_spdx:append().

Sadly, the generated code looks like this:
```
def do_create_spdx(d):
    import oe.spdx30_tasks
    oe.spdx30_tasks.create_spdx(d)
    create_kernel_config_spdx()

do_create_spdx(d)

def create_kernel_config_spdx(d):
    # Code of the function
```

This is not going to work, since the create_kernel_config_spdx() is declared 
after the call to do_create_spdx().

From my point of view, there is a bug in bitbake code : The emit_func_python() 
function  declared in lib/bb/data.py does not generate code in the right 
order: The "write_func(func, o, True)" should be called at the end of 
emit_func_python().
I am missing something, or is there any reason why emit_func_python() is 
implemented that way?

Anyway I am preparing a v3, that solve this issue differently.

Best regards,
-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core] [PATCH v2] meta: fix generation of kernel CONFIG_ in SPDX3

[Richard Purdie]

On Tue, 2026-02-24 at 10:10 +0100, Benjamin Robin via lists.openembedded.org wrote:
> On Monday, February 23, 2026 at 6:43 PM, Joshua Watt wrote:
> > I like this in general, but if you're going to bbappend, the `return`
> > will mess with any other appends, so it needs to be avoided. Probably
> > just put all the code under a
> > `if bb.data.inherits_class("create-spdx-3.0", d):` instead
> 
> Indeed, thank you for your feedback.
> My initial plan was to move all code inside a Python function named
> create_kernel_config_spdx, and to call this function from 
> do_create_spdx:append().
> 
> Sadly, the generated code looks like this:
> ```
> def do_create_spdx(d):
>     import oe.spdx30_tasks
>     oe.spdx30_tasks.create_spdx(d)
>     create_kernel_config_spdx()
> 
> do_create_spdx(d)
> 
> def create_kernel_config_spdx(d):
>     # Code of the function
> ```
> 
> This is not going to work, since the create_kernel_config_spdx() is declared 
> after the call to do_create_spdx().
> 
> From my point of view, there is a bug in bitbake code : The emit_func_python() 
> function  declared in lib/bb/data.py does not generate code in the right 
> order: The "write_func(func, o, True)" should be called at the end of
> emit_func_python().
> I am missing something, or is there any reason why emit_func_python() is 
> implemented that way?
> 
> Anyway I am preparing a v3, that solve this issue differently.

I think it would work as the emit_python_func code generates code for
debugging, it isn't what is actually run. What actually happens is all
the python functions are compiled and then called within the current
python execution environment.

Improving emit_func_python() to be more accurate is something I've
wanted to do for a while as the data store is missing, as is most of
the fakeroot execution environment that the shell/python tasks
sometimes use too.

Cheers,

Richard