Re: [OE-core][PATCH v6 00/15] Add SPDX 3 Recipe Information

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Wed Mar 11, 2026 at 5:39 PM CET, Joshua Watt wrote:
> On Wed, Mar 11, 2026 at 7:55 AM Mathieu Dubois-Briand
> <mathieu.dubois-briand@bootlin.com> wrote:
>>
>> On Tue Mar 10, 2026 at 7:38 PM CET, Joshua Watt via lists.openembedded.org wrote:
>> > Changes the SPDX 3 output to include a "recipe" package that describe
>> > static information available at parse time (without building). This is
>> > primarily useful for gathering SPDX 3 VEX information about some or all
>> > recipes, enabling SPDX 3 to be used in place of cve_check.bbclass and
>> > vex.bbclass.
>> >
>> > Special thanks to Benjamin Robin <benjamin.robin@bootlin.com> for
>> > helping work through this.
>> >
>> > V2: Fixes a bug where do_populate_sysroot was running when it should not
>> > be. Drops the patch to ignore ASSUME_PROVIDES recipes, since this is
>> > incorrect (this is already handled by bitbake in the taskgraph, and
>> > doesn't need to be manually removed).
>> >
>> > V3: Fixes a bug where meta-world-recipe-sbom was reporting a circular
>> > dependency. meta-world-recipe-sbom also no longer runs in world builds,
>> > as there's no reason to this. Finally, fixes a bug where
>> > NO_GENERIC_LICENSE files would fail to be found in do_create_spdx
>> > (because do_unpack was not run).
>> >
>> > V4: Fixes test cases. Adds SPDX_PACKAGE_INCLUDE_VEX to control if VEX
>> > information is linked to binary packages, or just recipes. Defaults to
>> > "0" to significantly reduce the size of the SPDX output.
>> >
>> > V5: Fixes dummy-sdk-packages to not generate SPDX output, since it
>> > does funny things with its arch which prevents it from rebuilding SPDX
>> > data properly, and no SPDX data is needed for it anyway
>> >
>> > V6: Fixes a bug where SPDX task would not correctly re-run when they
>> > change, which would cause errors about missing SPDX document. Also
>> > updates to the latest version of the SPDX bindings which improves
>> > performance
>> >
>>
>> Hi Joshua,
>>
>> Ok, we are almost there!
>>
>> I suspect it would work fine on master, but we have a fail on two tests
>> that were recently added by Stefano, and were not merged so far.
>>
>> As both series might still evolve or get reviews, I will probably keep
>> both in my branch, but some changes are needed if we want to merge both
>> series.
>
> This is actually semi-intentional. I renamed the "recipe-" SPDX files
> to "build-". The fix is simple, but it either needs to be applied to
> my changes or Stephanos, depending on the order. Do you have a
> preference?
>

I do not have any particular preference, so please do as is easier for
you.

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com