Re: [OE-core] [RFC PATCH 1/2] classes/buildhistory: record SRC_URI

["Richard Purdie" <richard.purdie@linuxfoundation.org>]

On Thu, 2020-10-29 at 09:18 +0000, Mikko.Rapeli@bmw.de wrote:
> On Wed, Oct 28, 2020 at 02:21:22PM +0000, Richard Purdie wrote:
> > On Mon, 2020-10-26 at 06:43 +0000, Mikko Rapeli wrote:
> > > On Sun, Oct 18, 2020 at 09:03:56PM -0700, Paul Eggleton wrote:
> > > > From: Paul Eggleton <paul.eggleton@microsoft.com>
> > > > 
> > > > It can be useful to record SRC_URI into buildhistory for the
> > > > purposes of
> > > > tracking exactly which sources got built (we already have
> > > > SRCREV)
> > > > as
> > > > well as getting an indication when changes to the SRC_URI
> > > > relate to
> > > > changes in the output.
> > > > 
> > > > Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com>
> > > 
> > > I have similar patch in our poky trees. Also have patches
> > > to export LICENSE and CVE_PRODUCT to buildhistory. These are used
> > > by some post-build QA check scripts.
> > > 
> > > Acked-by: Mikko Rapeli <mikko.rapeli@bmw.de>
> > 
> > I'm actually fairly against some of these kinds of changes.
> > Buildhistory is meant to be there to highlight changes in the
> > output
> > over time. Using it to create manifests and for license checking
> > purposes is not what it was designed for.
> > 
> > I just feel if the original author of the class thinks its a good
> > idea
> > I need to give up :/.
> 
> Surely changes in LICENSE and SRC_URI over time are important for an
> overview of changes?

LICENSE is important and I understand that one. SRC_URI is trickier.
The recipe version is in some ways more relevant that SRC_URI. I guess
with the latter, you can look at the change in the set of patches or
perhaps source of the code but I'd suspect the version is the more
useful thing people are looking for.

There is then the temptation for people to use the buildhistory data
for license auditing which worries me as its not what its intended for.

> At least to me they are pretty much essential. I'm using buildhistory
> diffs to see what changes in major yocto updates for example once
> builds are passing.

The question is whether the history is of the inputs, the outputs or
tangential information like the license information. Traditionally it
was focused very specifically on the output, we've then added more and
more input data and people are using it for licensing (which there is
supposed to be separate code for). It makes it hard to maintain and
develop since the usage becomes so varied. I appreciate few people care
about that though as it's someone else's problem though :(. I try and
keep things true to their design and people end up unhappy. Where we
deviate, I try and ensure its at least a conscious decision, I'm still
not sure it is in this case.

Cheers,

Richard