Re: [PATCH] classes/sbom-cve-check: fall back to the stable SBOM symlink

[Paul Barker <paul@pbarker.dev>]

On Tue, 2026-08-04 at 13:24 +0200, roosesweb@gmail.com wrote:
> do_sbom_cve_check builds its input path from ${IMAGE_NAME}, which carries
> ${IMAGE_VERSION_SUFFIX} and so ${DATETIME}. That value is excluded from task
> hashes but changes on every bitbake invocation, so the path is only correct when
> do_create_image_sbom_spdx ran in the same invocation.
> 
> It does not when the class is newly enabled on an existing build tree: the image
> SBOM is already deployed and stamped from an earlier build, do_sbom_cve_check has
> never run, so bitbake executes only the latter and it looks for a file whose
> timestamp belongs to the current invocation. The same happens on any forced re-run
> of just this task:
> 
>   $ bitbake -f -c sbom_cve_check core-image-minimal
>   ERROR: core-image-minimal-1.0-r0 do_sbom_cve_check: sbom-cve-check failed: [...]
>   sbom-cve-check: error: [Errno 2] No such file or directory:
>     '.../core-image-minimal-qemux86-64.rootfs-20260804101106.spdx.json'
> 
>   $ ls tmp/deploy/images/qemux86-64/*.spdx.json
>   core-image-minimal-qemux86-64.rootfs-20260804095834.spdx.json
>   core-image-minimal-qemux86-64.rootfs.spdx.json -> ...-20260804095834.spdx.json
> 
> The file is there under ${IMAGE_LINK_NAME}, the symlink do_create_image_sbom_spdx
> maintains. Keep preferring the timestamped name, so behaviour is unchanged whenever
> it exists, and fall back to the symlink rather than failing. Guarded on link_name
> being set, since IMAGE_LINK_NAME can be empty.
> 
> Signed-off-by: Thomas Roos <roosesweb@gmail.com>

Hi Thomas,

This code has already changed recently in commit 2a80840a4fe0
("sbom-cve-check: Fix breakage with empty IMAGE_LINK_NAME"). Perhaps we
should have just added a fallback to IMAGE_NAME if IMAGE_LINK_NAME is
unset.

A quick scan of the code shows that there are other places where it is
assumed that IMAGE_LINK_NAME is valid, such as vex.bbclass.

Best regards,

-- 
Paul Barker