[OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Piotr Łobacz]

Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
and by-namespace SPDX files are created without differentiation between machines.
This means that for two machines using a common package architecture
(e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
that the build of one can remove files from the other leading to build failures. An
example would be:

MACHINE=qemux86-64 bitbake core-image-minimal
MACHINE=genericx86-64 bitbake core-image-minimal
MACHINE=qemux86-64 bitbake linux-yocto -c clean
MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs

To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
to differentiate packages' dependencies between machines.

This commit fixes issue repored by Khem [1]

[1] https://patchwork.yoctoproject.org/comment/13577/

Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
---
 meta/classes/create-spdx-2.2.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
index ade1a04be3..9e228891ab 100644
--- a/meta/classes/create-spdx-2.2.bbclass
+++ b/meta/classes/create-spdx-2.2.bbclass
@@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
 CVE_PRODUCT ??= "${BPN}"
 CVE_VERSION ??= "${PV}"
 
-SPDXDIR ??= "${WORKDIR}/spdx"
+SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
 SPDXDEPLOY = "${SPDXDIR}/deploy"
 SPDXWORK = "${SPDXDIR}/work"
 SPDXIMAGEWORK = "${SPDXDIR}/image-work"
-- 
2.48.1

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Richard Purdie]

On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> and by-namespace SPDX files are created without differentiation between machines.
> This means that for two machines using a common package architecture
> (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> that the build of one can remove files from the other leading to build failures. An
> example would be:
> 
> MACHINE=qemux86-64 bitbake core-image-minimal
> MACHINE=genericx86-64 bitbake core-image-minimal
> MACHINE=qemux86-64 bitbake linux-yocto -c clean
> MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> 
> To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> to differentiate packages' dependencies between machines.
> 
> This commit fixes issue repored by Khem [1]
> 
> [1] https://patchwork.yoctoproject.org/comment/13577/
> 
> Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> ---
>  meta/classes/create-spdx-2.2.bbclass | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> index ade1a04be3..9e228891ab 100644
> --- a/meta/classes/create-spdx-2.2.bbclass
> +++ b/meta/classes/create-spdx-2.2.bbclass
> @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
>  CVE_PRODUCT ??= "${BPN}"
>  CVE_VERSION ??= "${PV}"
>  
> -SPDXDIR ??= "${WORKDIR}/spdx"
> +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
>  SPDXDEPLOY = "${SPDXDIR}/deploy"
>  SPDXWORK = "${SPDXDIR}/work"
>  SPDXIMAGEWORK = "${SPDXDIR}/image-work"

I suspect this is going to cause other challenges since the task stamp
isn't machine specific as far as I know but this change would require
it to be and force all of the SPDX tasks to be machine specific.

Cheers,

Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Piotr Łobacz]

Actually this was just an issue with the path to the deps.json file.
which was containing all the dependencies and in case of different
machine
for packages like e.g. base-files this file was containing bad
dependency, meaning that if i'm building first machine A, than B,
the spdx files from A for base-files are being moved to B but are
searched still in A directory.

We were discussing this issue with Joshua, but i'm not an expert in
this matter...

BR
Piotr

pon., 10 lut 2025 o 14:42 Richard Purdie
<richard.purdie@linuxfoundation.org> napisał(a):
>
> On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > and by-namespace SPDX files are created without differentiation between machines.
> > This means that for two machines using a common package architecture
> > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > that the build of one can remove files from the other leading to build failures. An
> > example would be:
> >
> > MACHINE=qemux86-64 bitbake core-image-minimal
> > MACHINE=genericx86-64 bitbake core-image-minimal
> > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> >
> > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > to differentiate packages' dependencies between machines.
> >
> > This commit fixes issue repored by Khem [1]
> >
> > [1] https://patchwork.yoctoproject.org/comment/13577/
> >
> > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > ---
> >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > index ade1a04be3..9e228891ab 100644
> > --- a/meta/classes/create-spdx-2.2.bbclass
> > +++ b/meta/classes/create-spdx-2.2.bbclass
> > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> >  CVE_PRODUCT ??= "${BPN}"
> >  CVE_VERSION ??= "${PV}"
> >
> > -SPDXDIR ??= "${WORKDIR}/spdx"
> > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> >  SPDXWORK = "${SPDXDIR}/work"
> >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
>
> I suspect this is going to cause other challenges since the task stamp
> isn't machine specific as far as I know but this change would require
> it to be and force all of the SPDX tasks to be machine specific.
>
> Cheers,
>
> Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Joshua Watt]

Piotr,

I think with the provided example I can look into this. I suspect it
will be a little more involved than adding MACHINE_ARCH

On Mon, Feb 10, 2025 at 9:58 AM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
>
> Actually this was just an issue with the path to the deps.json file.
> which was containing all the dependencies and in case of different
> machine
> for packages like e.g. base-files this file was containing bad
> dependency, meaning that if i'm building first machine A, than B,
> the spdx files from A for base-files are being moved to B but are
> searched still in A directory.
>
> We were discussing this issue with Joshua, but i'm not an expert in
> this matter...
>
> BR
> Piotr
>
> pon., 10 lut 2025 o 14:42 Richard Purdie
> <richard.purdie@linuxfoundation.org> napisał(a):
> >
> > On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > > and by-namespace SPDX files are created without differentiation between machines.
> > > This means that for two machines using a common package architecture
> > > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > > that the build of one can remove files from the other leading to build failures. An
> > > example would be:
> > >
> > > MACHINE=qemux86-64 bitbake core-image-minimal
> > > MACHINE=genericx86-64 bitbake core-image-minimal
> > > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> > >
> > > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > > to differentiate packages' dependencies between machines.
> > >
> > > This commit fixes issue repored by Khem [1]
> > >
> > > [1] https://patchwork.yoctoproject.org/comment/13577/
> > >
> > > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > > ---
> > >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > > index ade1a04be3..9e228891ab 100644
> > > --- a/meta/classes/create-spdx-2.2.bbclass
> > > +++ b/meta/classes/create-spdx-2.2.bbclass
> > > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> > >  CVE_PRODUCT ??= "${BPN}"
> > >  CVE_VERSION ??= "${PV}"
> > >
> > > -SPDXDIR ??= "${WORKDIR}/spdx"
> > > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> > >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> > >  SPDXWORK = "${SPDXDIR}/work"
> > >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
> >
> > I suspect this is going to cause other challenges since the task stamp
> > isn't machine specific as far as I know but this change would require
> > it to be and force all of the SPDX tasks to be machine specific.
> >
> > Cheers,
> >
> > Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Piotr Łobacz]

Sure Joshua,
I hope it won't be much extra work, as I have this patch already applied
and it is working for me without any issues.

BR
Piotr

pon., 10 lut 2025 o 18:51 Joshua Watt <jpewhacker@gmail.com> napisał(a):
>
> Piotr,
>
> I think with the provided example I can look into this. I suspect it
> will be a little more involved than adding MACHINE_ARCH
>
> On Mon, Feb 10, 2025 at 9:58 AM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> >
> > Actually this was just an issue with the path to the deps.json file.
> > which was containing all the dependencies and in case of different
> > machine
> > for packages like e.g. base-files this file was containing bad
> > dependency, meaning that if i'm building first machine A, than B,
> > the spdx files from A for base-files are being moved to B but are
> > searched still in A directory.
> >
> > We were discussing this issue with Joshua, but i'm not an expert in
> > this matter...
> >
> > BR
> > Piotr
> >
> > pon., 10 lut 2025 o 14:42 Richard Purdie
> > <richard.purdie@linuxfoundation.org> napisał(a):
> > >
> > > On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > > > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > > > and by-namespace SPDX files are created without differentiation between machines.
> > > > This means that for two machines using a common package architecture
> > > > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > > > that the build of one can remove files from the other leading to build failures. An
> > > > example would be:
> > > >
> > > > MACHINE=qemux86-64 bitbake core-image-minimal
> > > > MACHINE=genericx86-64 bitbake core-image-minimal
> > > > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > > > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> > > >
> > > > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > > > to differentiate packages' dependencies between machines.
> > > >
> > > > This commit fixes issue repored by Khem [1]
> > > >
> > > > [1] https://patchwork.yoctoproject.org/comment/13577/
> > > >
> > > > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > > > ---
> > > >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > > > index ade1a04be3..9e228891ab 100644
> > > > --- a/meta/classes/create-spdx-2.2.bbclass
> > > > +++ b/meta/classes/create-spdx-2.2.bbclass
> > > > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> > > >  CVE_PRODUCT ??= "${BPN}"
> > > >  CVE_VERSION ??= "${PV}"
> > > >
> > > > -SPDXDIR ??= "${WORKDIR}/spdx"
> > > > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> > > >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> > > >  SPDXWORK = "${SPDXDIR}/work"
> > > >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
> > >
> > > I suspect this is going to cause other challenges since the task stamp
> > > isn't machine specific as far as I know but this change would require
> > > it to be and force all of the SPDX tasks to be machine specific.
> > >
> > > Cheers,
> > >
> > > Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Joshua Watt]

Based on this patch, I'm guessing you're not working off of master?
The patch doesn't apply to the latest master version because a lot of
the variables in create-spdx-2.2 were moved to spdx-common.bbclass.

I tried the reproduction steps on master and it seems to work OK, but
I'll keep trying; can you provide what branch/commit you are working
on and we can possible figure out what fix might be needed if it is
already fixed on master?

On Mon, Feb 10, 2025 at 1:51 PM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
>
> Sure Joshua,
> I hope it won't be much extra work, as I have this patch already applied
> and it is working for me without any issues.
>
> BR
> Piotr
>
> pon., 10 lut 2025 o 18:51 Joshua Watt <jpewhacker@gmail.com> napisał(a):
> >
> > Piotr,
> >
> > I think with the provided example I can look into this. I suspect it
> > will be a little more involved than adding MACHINE_ARCH
> >
> > On Mon, Feb 10, 2025 at 9:58 AM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> > >
> > > Actually this was just an issue with the path to the deps.json file.
> > > which was containing all the dependencies and in case of different
> > > machine
> > > for packages like e.g. base-files this file was containing bad
> > > dependency, meaning that if i'm building first machine A, than B,
> > > the spdx files from A for base-files are being moved to B but are
> > > searched still in A directory.
> > >
> > > We were discussing this issue with Joshua, but i'm not an expert in
> > > this matter...
> > >
> > > BR
> > > Piotr
> > >
> > > pon., 10 lut 2025 o 14:42 Richard Purdie
> > > <richard.purdie@linuxfoundation.org> napisał(a):
> > > >
> > > > On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > > > > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > > > > and by-namespace SPDX files are created without differentiation between machines.
> > > > > This means that for two machines using a common package architecture
> > > > > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > > > > that the build of one can remove files from the other leading to build failures. An
> > > > > example would be:
> > > > >
> > > > > MACHINE=qemux86-64 bitbake core-image-minimal
> > > > > MACHINE=genericx86-64 bitbake core-image-minimal
> > > > > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > > > > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> > > > >
> > > > > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > > > > to differentiate packages' dependencies between machines.
> > > > >
> > > > > This commit fixes issue repored by Khem [1]
> > > > >
> > > > > [1] https://patchwork.yoctoproject.org/comment/13577/
> > > > >
> > > > > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > > > > ---
> > > > >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > > > > index ade1a04be3..9e228891ab 100644
> > > > > --- a/meta/classes/create-spdx-2.2.bbclass
> > > > > +++ b/meta/classes/create-spdx-2.2.bbclass
> > > > > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> > > > >  CVE_PRODUCT ??= "${BPN}"
> > > > >  CVE_VERSION ??= "${PV}"
> > > > >
> > > > > -SPDXDIR ??= "${WORKDIR}/spdx"
> > > > > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> > > > >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> > > > >  SPDXWORK = "${SPDXDIR}/work"
> > > > >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
> > > >
> > > > I suspect this is going to cause other challenges since the task stamp
> > > > isn't machine specific as far as I know but this change would require
> > > > it to be and force all of the SPDX tasks to be machine specific.
> > > >
> > > > Cheers,
> > > >
> > > > Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Piotr Łobacz]

Nope. It is on the scarthgap and I have set it in the subject when git
send-mail, but somehow it has been cut...

śr., 12 lut 2025 o 23:07 Joshua Watt <jpewhacker@gmail.com> napisał(a):
>
> Based on this patch, I'm guessing you're not working off of master?
> The patch doesn't apply to the latest master version because a lot of
> the variables in create-spdx-2.2 were moved to spdx-common.bbclass.
>
> I tried the reproduction steps on master and it seems to work OK, but
> I'll keep trying; can you provide what branch/commit you are working
> on and we can possible figure out what fix might be needed if it is
> already fixed on master?
>
> On Mon, Feb 10, 2025 at 1:51 PM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> >
> > Sure Joshua,
> > I hope it won't be much extra work, as I have this patch already applied
> > and it is working for me without any issues.
> >
> > BR
> > Piotr
> >
> > pon., 10 lut 2025 o 18:51 Joshua Watt <jpewhacker@gmail.com> napisał(a):
> > >
> > > Piotr,
> > >
> > > I think with the provided example I can look into this. I suspect it
> > > will be a little more involved than adding MACHINE_ARCH
> > >
> > > On Mon, Feb 10, 2025 at 9:58 AM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> > > >
> > > > Actually this was just an issue with the path to the deps.json file.
> > > > which was containing all the dependencies and in case of different
> > > > machine
> > > > for packages like e.g. base-files this file was containing bad
> > > > dependency, meaning that if i'm building first machine A, than B,
> > > > the spdx files from A for base-files are being moved to B but are
> > > > searched still in A directory.
> > > >
> > > > We were discussing this issue with Joshua, but i'm not an expert in
> > > > this matter...
> > > >
> > > > BR
> > > > Piotr
> > > >
> > > > pon., 10 lut 2025 o 14:42 Richard Purdie
> > > > <richard.purdie@linuxfoundation.org> napisał(a):
> > > > >
> > > > > On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > > > > > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > > > > > and by-namespace SPDX files are created without differentiation between machines.
> > > > > > This means that for two machines using a common package architecture
> > > > > > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > > > > > that the build of one can remove files from the other leading to build failures. An
> > > > > > example would be:
> > > > > >
> > > > > > MACHINE=qemux86-64 bitbake core-image-minimal
> > > > > > MACHINE=genericx86-64 bitbake core-image-minimal
> > > > > > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > > > > > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> > > > > >
> > > > > > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > > > > > to differentiate packages' dependencies between machines.
> > > > > >
> > > > > > This commit fixes issue repored by Khem [1]
> > > > > >
> > > > > > [1] https://patchwork.yoctoproject.org/comment/13577/
> > > > > >
> > > > > > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > > > > > ---
> > > > > >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> > > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > > >
> > > > > > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > > > > > index ade1a04be3..9e228891ab 100644
> > > > > > --- a/meta/classes/create-spdx-2.2.bbclass
> > > > > > +++ b/meta/classes/create-spdx-2.2.bbclass
> > > > > > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> > > > > >  CVE_PRODUCT ??= "${BPN}"
> > > > > >  CVE_VERSION ??= "${PV}"
> > > > > >
> > > > > > -SPDXDIR ??= "${WORKDIR}/spdx"
> > > > > > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> > > > > >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> > > > > >  SPDXWORK = "${SPDXDIR}/work"
> > > > > >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
> > > > >
> > > > > I suspect this is going to cause other challenges since the task stamp
> > > > > isn't machine specific as far as I know but this change would require
> > > > > it to be and force all of the SPDX tasks to be machine specific.
> > > > >
> > > > > Cheers,
> > > > >
> > > > > Richard

Re: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDXDIR affecting multiconfig machines

[Piotr Łobacz]

If you want I can disable on my side this patch in order to reproduce
it and copy paste the files to which are causing the issue.

czw., 13 lut 2025 o 09:56 Piotr Łobacz <pio.lobacz@gmail.com> napisał(a):
>
> Nope. It is on the scarthgap and I have set it in the subject when git
> send-mail, but somehow it has been cut...
>
> śr., 12 lut 2025 o 23:07 Joshua Watt <jpewhacker@gmail.com> napisał(a):
> >
> > Based on this patch, I'm guessing you're not working off of master?
> > The patch doesn't apply to the latest master version because a lot of
> > the variables in create-spdx-2.2 were moved to spdx-common.bbclass.
> >
> > I tried the reproduction steps on master and it seems to work OK, but
> > I'll keep trying; can you provide what branch/commit you are working
> > on and we can possible figure out what fix might be needed if it is
> > already fixed on master?
> >
> > On Mon, Feb 10, 2025 at 1:51 PM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> > >
> > > Sure Joshua,
> > > I hope it won't be much extra work, as I have this patch already applied
> > > and it is working for me without any issues.
> > >
> > > BR
> > > Piotr
> > >
> > > pon., 10 lut 2025 o 18:51 Joshua Watt <jpewhacker@gmail.com> napisał(a):
> > > >
> > > > Piotr,
> > > >
> > > > I think with the provided example I can look into this. I suspect it
> > > > will be a little more involved than adding MACHINE_ARCH
> > > >
> > > > On Mon, Feb 10, 2025 at 9:58 AM Piotr Łobacz <pio.lobacz@gmail.com> wrote:
> > > > >
> > > > > Actually this was just an issue with the path to the deps.json file.
> > > > > which was containing all the dependencies and in case of different
> > > > > machine
> > > > > for packages like e.g. base-files this file was containing bad
> > > > > dependency, meaning that if i'm building first machine A, than B,
> > > > > the spdx files from A for base-files are being moved to B but are
> > > > > searched still in A directory.
> > > > >
> > > > > We were discussing this issue with Joshua, but i'm not an expert in
> > > > > this matter...
> > > > >
> > > > > BR
> > > > > Piotr
> > > > >
> > > > > pon., 10 lut 2025 o 14:42 Richard Purdie
> > > > > <richard.purdie@linuxfoundation.org> napisał(a):
> > > > > >
> > > > > > On Mon, 2025-02-10 at 13:50 +0100, Piotr Łobacz via lists.openembedded.org wrote:
> > > > > > > Currently SPDXDIR is pointing to `${WORKDIR}/spdx` which means that the by-id
> > > > > > > and by-namespace SPDX files are created without differentiation between machines.
> > > > > > > This means that for two machines using a common package architecture
> > > > > > > (e.g. genericx86-64 and qqemux86-64), there would be overlapping files. This means
> > > > > > > that the build of one can remove files from the other leading to build failures. An
> > > > > > > example would be:
> > > > > > >
> > > > > > > MACHINE=qemux86-64 bitbake core-image-minimal
> > > > > > > MACHINE=genericx86-64 bitbake core-image-minimal
> > > > > > > MACHINE=qemux86-64 bitbake linux-yocto -c clean
> > > > > > > MACHINE=genericx86-64 bitbake core-image-minimal -C rootfs
> > > > > > >
> > > > > > > To fix this, add MACHINE_ARCH to the SPDXDIR path used for the files in order
> > > > > > > to differentiate packages' dependencies between machines.
> > > > > > >
> > > > > > > This commit fixes issue repored by Khem [1]
> > > > > > >
> > > > > > > [1] https://patchwork.yoctoproject.org/comment/13577/
> > > > > > >
> > > > > > > Signed-off-by: Piotr Łobacz <pio.lobacz@gmail.com>
> > > > > > > ---
> > > > > > >  meta/classes/create-spdx-2.2.bbclass | 2 +-
> > > > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > > > >
> > > > > > > diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
> > > > > > > index ade1a04be3..9e228891ab 100644
> > > > > > > --- a/meta/classes/create-spdx-2.2.bbclass
> > > > > > > +++ b/meta/classes/create-spdx-2.2.bbclass
> > > > > > > @@ -11,7 +11,7 @@ DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
> > > > > > >  CVE_PRODUCT ??= "${BPN}"
> > > > > > >  CVE_VERSION ??= "${PV}"
> > > > > > >
> > > > > > > -SPDXDIR ??= "${WORKDIR}/spdx"
> > > > > > > +SPDXDIR ??= "${WORKDIR}/spdx/${MACHINE_ARCH}"
> > > > > > >  SPDXDEPLOY = "${SPDXDIR}/deploy"
> > > > > > >  SPDXWORK = "${SPDXDIR}/work"
> > > > > > >  SPDXIMAGEWORK = "${SPDXDIR}/image-work"
> > > > > >
> > > > > > I suspect this is going to cause other challenges since the task stamp
> > > > > > isn't machine specific as far as I know but this change would require
> > > > > > it to be and force all of the SPDX tasks to be machine specific.
> > > > > >
> > > > > > Cheers,
> > > > > >
> > > > > > Richard