Re: [OE-core][PATCH v2] scripts/contrib/image-manifest: add new script

["Paul Eggleton" <bluelightning@bluelightning.org>]

Hi folks

On Friday, 9 April 2021 06:03:36 NZST Anders Wallin wrote:
> image-manifest: script to generate product/image specific BOM
> 
> The image-manifest script generates image specific reports based on
> an image manifest file. Currently there is data generated by buildhistory,
> pkgdata, and license manifest but this data is poorly formated and spread
> across multiple text files. This script can generate a single JSON output
> file that is machine readable by other tools.
> 
> The manifest-info collects package information and stores the information
> in a tarball. manifest-info can be configured using a json configuration
> file. The default configuration including all possible options can be
> dumped using the dump-config subcommand.
> 
> image-manifest takes an image manifest file as input to get the runtime
> dependencies. As an option image-manifest can also use the build dependency
> file, pn-buildlist, to get the build dependencies excluding native
> packages.
> 
> This script extends the oe-image-manifest script [0] done by Paul Eggleton
> 
> [0]
> https://github.com/intel/clear-linux-dissector-web/blob/master/layerindex/st
> atic/files/oe-image-manifest

So I've thought some more about this. At minimum I think this script should be 
under contrib/, and looking at the command line options it seems like there's 
been a bit of scope creep such that it overlaps with other tools that we have. 
As a matter of best practice, for reporting / compliance usage I think getting 
this information should be something that is integrated into the build process 
(a la buildhistory) rather than something that you run afterwards -  that way 
there is less chance that the information doesn't match up with the images 
produced. I wrote the original script so that it would work with older 
releases where the logic wouldn't have been able to be practically added that 
way without otherwise needing to patch the code, so it kind of made sense to 
have it as a separate script that you could run.

All that is not to say this script *shouldn't* be used, I just think that it 
shouldn't be something we have front-and-centre.

Cheers,
Paul