From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linuxplesk15.openhost.net.nz (linuxplesk15.openhost.net.nz [119.47.118.83]) by mx.groups.io with SMTP id smtpd.web08.1154.1618518722719778604 for ; Thu, 15 Apr 2021 13:32:03 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=none, err=permanent DNS error (domain: bluelightning.org, ip: 119.47.118.83, mailfrom: bluelightning@bluelightning.org) Received: from linc.localnet (unknown [151.210.226.152]) by linuxplesk15.openhost.net.nz (Postfix) with ESMTPSA id 2A696A2F44; Fri, 16 Apr 2021 08:31:59 +1200 (NZST) Authentication-Results: linuxplesk15.openhost.net.nz; spf=pass (sender IP is 151.210.226.152) smtp.mailfrom=bluelightning@bluelightning.org smtp.helo=linc.localnet Received-SPF: pass (linuxplesk15.openhost.net.nz: connection is authenticated) From: "Paul Eggleton" To: openembedded-core@lists.openembedded.org Cc: Anders Wallin , Saul Wold , Anders Wallin Subject: Re: [OE-core][PATCH v2] scripts/contrib/image-manifest: add new script Date: Fri, 16 Apr 2021 08:31:58 +1200 Message-ID: <3067223.aV6nBDHxoP@linc> In-Reply-To: <20210408180336.2670839-1-anders.wallin@windriver.com> References: <20210408180336.2670839-1-anders.wallin@windriver.com> MIME-Version: 1.0 X-PPP-Message-ID: <20210415203159.1560969.36916@localhost6.localdomain6> X-PPP-Vhost: softec.co.nz Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Hi folks On Friday, 9 April 2021 06:03:36 NZST Anders Wallin wrote: > image-manifest: script to generate product/image specific BOM > > The image-manifest script generates image specific reports based on > an image manifest file. Currently there is data generated by buildhistory, > pkgdata, and license manifest but this data is poorly formated and spread > across multiple text files. This script can generate a single JSON output > file that is machine readable by other tools. > > The manifest-info collects package information and stores the information > in a tarball. manifest-info can be configured using a json configuration > file. The default configuration including all possible options can be > dumped using the dump-config subcommand. > > image-manifest takes an image manifest file as input to get the runtime > dependencies. As an option image-manifest can also use the build dependency > file, pn-buildlist, to get the build dependencies excluding native > packages. > > This script extends the oe-image-manifest script [0] done by Paul Eggleton > > [0] > https://github.com/intel/clear-linux-dissector-web/blob/master/layerindex/st > atic/files/oe-image-manifest So I've thought some more about this. At minimum I think this script should be under contrib/, and looking at the command line options it seems like there's been a bit of scope creep such that it overlaps with other tools that we have. As a matter of best practice, for reporting / compliance usage I think getting this information should be something that is integrated into the build process (a la buildhistory) rather than something that you run afterwards - that way there is less chance that the information doesn't match up with the images produced. I wrote the original script so that it would work with older releases where the logic wouldn't have been able to be practically added that way without otherwise needing to patch the code, so it kind of made sense to have it as a separate script that you could run. All that is not to say this script *shouldn't* be used, I just think that it shouldn't be something we have front-and-centre. Cheers, Paul