Re: [OE-core][PATCH 3/9] spdx3: Add recipe SPDX data

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Fri Feb 20, 2026 at 4:40 PM CET, Joshua Watt via lists.openembedded.org wrote:
> Adds a new package to the SPDX output that represents the recipe data
> for a given recipe. Importantly, this data contains only things that can
> be determined statically from only the recipe, so it doesn't require
> fetching or building anything. This means that build time dependencies
> and CVE information for recipes can be analyzed without needing to
> actually do any builds.
>
> Sadly, license data cannot be included because NO_GENERIC_LICENSE means
> that actual license text might only be available after do_fetch
>
> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> ---

Hi Joshua,

It looks like this is causing some failures, at list for glib:

ERROR: glib-2.0-1_2.86.4-r0 do_create_spdx: Error executing a python function in exec_func_python() autogenerated:

The stack trace of python calls that resulted in this exception/failure was:
File: 'exec_func_python() autogenerated', lineno: 2, function: <module>
     0001:
 *** 0002:extend_recipe_sysroot(d)
     0003:
File: '/srv/pokybuild/yocto-worker/musl-qemux86/build/layers/openembedded-core/meta/classes-global/staging.bbclass', lineno: 619, function: extend_recipe_sysroot
     0615:                    if "/bin/" in l or "/sbin/" in l:
     0616:                        # defer /*bin/* files until last in case they need libs
     0617:                        binfiles[l] = (targetdir, dest)
     0618:                    else:
 *** 0619:                        staging_copyfile(l, targetdir, dest, postinsts, seendirs)
     0620:
     0621:    # Handle deferred binfiles
     0622:    for l in binfiles:
     0623:        (targetdir, dest) = binfiles[l]
File: '/srv/pokybuild/yocto-worker/musl-qemux86/build/layers/openembedded-core/meta/classes-global/staging.bbclass', lineno: 165, function: staging_copyfile
     0161:        os.symlink(linkto, dest)
     0162:        #bb.warn(c)
     0163:    else:
     0164:        try:
 *** 0165:            os.link(c, dest)
     0166:        except OSError as err:
     0167:            if err.errno == errno.EXDEV:
     0168:                bb.utils.copyfile(c, dest)
     0169:            else:
Exception: FileExistsError: [Errno 17] File exists: '/srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/sysroots-components/core2-32/glib-2.0/usr/include/glib-2.0/glib.h' -> '/srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/work/core2-32-poky-linux-musl/glib-2.0/2.86.4/recipe-sysroot/usr/include/glib-2.0/glib.h'


https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/3240
https://autobuilder.yoctoproject.org/valkyrie/#/builders/19/builds/3220
https://autobuilder.yoctoproject.org/valkyrie/#/builders/65/builds/3201
https://autobuilder.yoctoproject.org/valkyrie/#/builders/68/builds/3296

And probably also this one:

Initialising tasks...ERROR: Task virtual:multilib:lib32:/srv/pokybuild/yocto-worker/qemux86-world/build/layers/openembedded-core/meta/recipes-core/meta/meta-world-recipe-sbom.bb:do_create_spdx has circular dependency on /srv/pokybuild/yocto-worker/qemux86-world/build/layers/openembedded-core/meta/recipes-core/meta/meta-world-recipe-sbom.bb:do_create_spdx
ERROR: Command execution failed: 1

https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/3219

Can you have a look?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com