Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> and by-namespace SPDX files are created without differentiation between machines.
> This means that for two machines using a common package architecture
> (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> that the build of one can remove files from the other leading to build failures. An
> example would be:
> 
> MACHINE=qemux86-64 bitbake core-image-minimal
> MACHINE=genericx86-64 bitbake core-image-minimal
> MACHINE=qemux86-64 bitbake linux-yocto -c clean
> MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> 
> To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> to differentiate packages' dependencies between machines.
> 
> This commit fixes issue repored by Khem [1]
> 
> [1] https://patchwork.yoctoproject.org/comment/13577/
> 
> Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> ---
>  meta/classes/create-spdx-2.2.bbclass | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> index ade1a04be3..9e228891ab 100644
> --- a/meta/classes/create-spdx-2.2.bbclass
> +++ b/meta/classes/create-spdx-2.2.bbclass
> @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
>  CVE_PRODUCT ??= "${BPN}"
>  CVE_VERSION ??= "${PV}"
>  
> -SPDXDIR ??= "${WORKDIR}/spdx"
> +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
>  SPDXDEPLOY = "${SPDXDIR}/deploy"
>  SPDXWORK = "${SPDXDIR}/work"
>  SPDXIMAGEWORK = "${SPDXDIR}/image-work"

I suspect this is going to cause other challenges since the task stamp
isn't machine specific as far as I know but this change would require
it to be and force all of the SPDX tasks to be machine specific.

Cheers,

Richard