[PATCH] meta: fix generation of kernel CONFIG_ in SPDX3

[PATCH] meta: fix generation of kernel CONFIG_ in SPDX3

[Benjamin Robin]

With the current solution, using a separate task
(do_create_kernel_config_spdx) there is a dependency issue. Sometimes
the final rootfs SBOM does not contain the CONFIG_ values.

do_create_kernel_config_spdx is executed after do_create_spdx which
deploys the SPDX file. do_create_kernel_config_spdx calls
oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
which is OK, but the do_create_kernel_config_spdx ends up writing to
this deployed file (updating it).

do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
tasks, but there is nothing that prevents executing
do_create_kernel_config_spdx after do_create_rootfs_spdx.

To fix it, instead, now read from the workdir, and write to the
workdir, and do the processing from the do_create_spdx task:
we append to the do_create_spdx task.

Also only execute this task if create-spdx-3.0 was inherited,
previously this code could be executed if create-spdx-2.2 is
inherited.

Fixes: 228a968e7c47 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 meta/classes-recipe/kernel.bbclass | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index f989b31c477c..ce43f6c13036 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -864,13 +864,9 @@ addtask deploy after do_populate_sysroot do_packagedata
 
 EXPORT_FUNCTIONS do_deploy
 
-python __anonymous() {
-    inherits = (d.getVar("INHERIT") or "")
-    if "create-spdx" in inherits:
-        bb.build.addtask('do_create_kernel_config_spdx', 'do_populate_lic do_deploy', 'do_create_spdx', d)
-}
-
-python do_create_kernel_config_spdx() {
+do_create_spdx:append() {
+    if not bb.data.inherits_class("create-spdx-3.0", d):
+        return
     if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) == "1":
         import oe.spdx30
         import oe.spdx30_tasks
@@ -903,9 +899,11 @@ python do_create_kernel_config_spdx() {
         except Exception as e:
             bb.error(f"Failed to parse kernel config file: {e}")
 
-        build, build_objset = oe.sbom30.find_root_obj_in_jsonld(
-            d, "recipes", f"recipe-{pn}", oe.spdx30.build_Build
-        )
+        path = oe.sbom30.jsonld_arch_path(d, pkg_arch, "recipes", f"recipe-{pn}", deploydir=deploydir)
+        build_objset = oe.sbom30.load_jsonld(d, path, required=True)
+        build = build_objset.find_root(oe.spdx30.build_Build)
+        if not build:
+            bb.fatal("No root %s found in %s" % (oe.spdx30.build_Build.__name__, path))
 
         kernel_build = build_objset.add_root(
             oe.spdx30.build_Build(
@@ -924,9 +922,9 @@ python do_create_kernel_config_spdx() {
             [kernel_build]
         )
 
-        oe.sbom30.write_jsonld_doc(d, build_objset, deploydir / pkg_arch / "recipes" / f"recipe-{pn}.spdx.json")
+        oe.sbom30.write_jsonld_doc(d, build_objset, path)
 }
-do_create_kernel_config_spdx[depends] = "virtual/kernel:do_configure"
+do_create_spdx[depends] += "virtual/kernel:do_configure"
 
 # Add using Device Tree support
 inherit kernel-devicetree

---
base-commit: 3a8f0075d52cb653118774baa03aa8d5231f943c
change-id: 20260213-fix-kernel-config-spdx-99223936e69f

Best regards,
-- 
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

Re: [PATCH] meta: fix generation of kernel CONFIG_ in SPDX3

[Mathieu Dubois-Briand]

On Fri Feb 13, 2026 at 10:26 AM CET, Benjamin Robin wrote:
> With the current solution, using a separate task
> (do_create_kernel_config_spdx) there is a dependency issue. Sometimes
> the final rootfs SBOM does not contain the CONFIG_ values.
>
> do_create_kernel_config_spdx is executed after do_create_spdx which
> deploys the SPDX file. do_create_kernel_config_spdx calls
> oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
> which is OK, but the do_create_kernel_config_spdx ends up writing to
> this deployed file (updating it).
>
> do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
> tasks, but there is nothing that prevents executing
> do_create_kernel_config_spdx after do_create_rootfs_spdx.
>
> To fix it, instead, now read from the workdir, and write to the
> workdir, and do the processing from the do_create_spdx task:
> we append to the do_create_spdx task.
>
> Also only execute this task if create-spdx-3.0 was inherited,
> previously this code could be executed if create-spdx-2.2 is
> inherited.
>
> Fixes: 228a968e7c47 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---

Hi Benjamin,

Thanks for your patch.

It looks like this is breaking 

2026-02-15 20:21:08,055 - oe-selftest - INFO - spdx.SPDX30Check.test_kernel_config_spdx (subunit.RemotedTestCase)
2026-02-15 20:21:08,055 - oe-selftest - INFO -  ... FAIL
...
2026-02-15 20:21:08,055 - oe-selftest - INFO - 4: 41/51 636/670 (135.25s) (2 failed) (spdx.SPDX30Check.test_kernel_config_spdx)
2026-02-15 20:21:08,056 - oe-selftest - INFO - testtools.testresult.real._StringException: Traceback (most recent call last):
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/spdx.py", line 369, in test_kernel_config_spdx
    objset = self.check_recipe_spdx(
             ^^^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/selftest/cases/spdx.py", line 102, in check_recipe_spdx
    bitbake(f"-c {task} {target_name}")
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/utils/commands.py", line 236, in bitbake
    return runCmd(cmd, ignore_status, timeout, output_log=output_log, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/lib/oeqa/utils/commands.py", line 214, in runCmd
    raise AssertionError("Command '%s' returned non-zero exit status %d:\n%s" % (command, result.status, exc_output))
AssertionError: Command 'bitbake  -c do_create_kernel_config_spdx linux-yocto' returned non-zero exit status 1:
...
Initialising tasks...ERROR: Task do_create_kernel_config_spdx does not exist for target linux-yocto (/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/layers/openembedded-core/meta/recipes-kernel/linux/linux-yocto_6.18.bb:do_create_kernel_config_spdx)
ERROR: Command execution failed: 1

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/3329
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/3096
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/3220

Can you have a look at what is the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] meta: fix generation of kernel CONFIG_ in SPDX3

[Benjamin ROBIN]

Hello Mathieu,

On Monday, February 16, 2026 at 7:48 AM, Mathieu Dubois-Briand wrote:
> Hi Benjamin,
> 
> Thanks for your patch.
> 
> It looks like this is breaking
> 
> 2026-02-15 20:21:08,055 - oe-selftest - INFO -
> spdx.SPDX30Check.test_kernel_config_spdx (subunit.RemotedTestCase)
> 2026-02-15 20:21:08,055 - oe-selftest - INFO -  ... FAIL

> 
> Can you have a look at what is the issue?

Yes, I just forgot to update the test in this patch... Sorry about that.
I am preparing a v2.

Best regards,
-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com