Re: [OE-core][PATCH v6 00/15] Add SPDX 3 Recipe Information

Joshua Watt
2026-03-11T22:56:23Z

On Wed, Mar 11, 2026 at 1:33 PM Mathieu Dubois-Briand
<mathieu.dubois-briand@bootlin.com> wrote:
>
> On Wed Mar 11, 2026 at 5:39 PM CET, Joshua Watt wrote:
> > On Wed, Mar 11, 2026 at 7:55 AM Mathieu Dubois-Briand
> > <mathieu.dubois-briand@bootlin.com> wrote:
> >>
> >> On Tue Mar 10, 2026 at 7:38 PM CET, Joshua Watt via lists.openembedded.org wrote:
> >> > Changes the SPDX 3 output to include a "recipe" package that describe
> >> > static information available at parse time (without building). This is
> >> > primarily useful for gathering SPDX 3 VEX information about some or all
> >> > recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and
> >> > vex.bbclass.
> >> >
> >> > Special thanks to Benjamin Robin <benjamin.robin@bootlin.com> for
> >> > helping work through this.
> >> >
> >> > V2: Fixes a bug where do_populate_sysroot was running when it should not
> >> > be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is
> >> > incorrect (this is already handled by bitbake in the taskgraph, and
> >> > doesn't need to be manually removed).
> >> >
> >> > V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular
> >> > dependency. meta-world-recipe-sbom also no longer runs in world builds,
> >> > as there's no reason to this. Finally, fixes a bug where
> >> > NO_GENERIC_LICENSE files would fail to be found in do_create_spdx
> >> > (because do_unpack was not run).
> >> >
> >> > V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX
> >> > information is linked to binary packages, or just recipes. Defaults to
> >> > "0" to significantly reduce the size of the SPDX output.
> >> >
> >> > V5: Fixes dummy-sdk-packages to not generate SPDX output, since it
> >> > does funny things with its arch which prevents it from rebuilding SPDX
> >> > data properly, and no SPDX data is needed for it anyway
> >> >
> >> > V6: Fixes a bug where SPDX task would not correctly re-run when they
> >> > change, which would cause errors about missing SPDX document. Also
> >> > updates to the latest version of the SPDX bindings which improves
> >> > performance
> >> >
> >>
> >> Hi Joshua,
> >>
> >> Ok, we are almost there!
> >>
> >> I suspect it would work fine on master, but we have a fail on two tests
> >> that were recently added by Stefano, and were not merged so far.
> >>
> >> As both series might still evolve or get reviews, I will probably keep
> >> both in my branch, but some changes are needed if we want to merge both
> >> series.
> >
> > This is actually semi-intentional. I renamed the "recipe-" SPDX files
> > to "build-". The fix is simple, but it either needs to be applied to
> > my changes or Stephanos, depending on the order. Do you have a
> > preference?
> >
>
> I do not have any particular preference, so please do as is easier for
> you.

Stefano has some feedback to address, so please take my patch series
first and Stefano can fix it in the next revision.

Thanks

>
> --
> Mathieu Dubois-Briand, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
>