Re: [OE-core] [PATCH v4 1/3] spdx: add option to include only compiled sources

[Quentin Schulz <quentin.schulz@cherry.de>]

Hi Daniel,

On 5/15/25 3:12 PM, Daniel Turull wrote:
> Hi Quentin,
> Thanks for the feedback. That's a good point for the header files and the rust files. I'll need to find a better way to extract them, since scripts/clang-tools/gen_compile_commands.py only extracts the commands and includes only the c files. So unless we don't have better info on the files used, we should not exclude any header file. Do you 

I would then suggest to include all files by default and only exclude C 
files if they do not appear in the output of 
scripts/clang-tools/gen_compile_commands.py so you cover everything and 
allowlist only things you know are safe.

know any better script to extract the compiled files from the kernel?
> 

No clue, sorry.

> The current code in the spdx class is supposed to only ignore the c files that are not compiled, (so been conservative on what to remove) but probably the script that I have in [PATCH v4 3/3] improve_kernel_cve_report: add script for postprocesing of kernel CVE data.
> 
> Needs to be updated, that if the CVE is not in a c file is not ignored, unless we have the header files in the list of compiled files.
> 

Anything that is NOT a C file should NOT be ignored (except if you have 
a tool that allows to know which non-C files are compiled in). Anything 
you can guarantee is never compiled in, then you can ignore. For now it 
seems you're saying gen_compile_commands.py only returns C files so 
that's all we can filter out.

Cheers,
Quentin