From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25555109448A for ; Sat, 21 Mar 2026 16:29:58 +0000 (UTC) Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14064.1774110589885321962 for ; Sat, 21 Mar 2026 09:29:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@bootlin.com header.s=dkim header.b=eY9dmKRk; spf=pass (domain: bootlin.com, ip: 185.246.84.56, mailfrom: mathieu.dubois-briand@bootlin.com) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id BDDDA1A2EEF; Sat, 21 Mar 2026 16:29:47 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 8A8A46011D; Sat, 21 Mar 2026 16:29:47 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 0663410450D33; Sat, 21 Mar 2026 17:29:44 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1774110586; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=I7CUWX2588cP+z2Hdffwg5w3c781qqlp8ocLG9wyS14=; b=eY9dmKRkRysIfN1i4FTCTSFfstxjLCp1+IwR3JtwvDzrAKcjXcdeAr/EdOwFEAqTgJdvil kWrFo85V0B9b3IBSBXkLTbYXBbmuDCClL389MX+T7xDBLzBj+mZfpUo5YPRDC0EyCf6aHS 7kFoRe4gYOMF2wF+Vlivz0XYAxvv8Zo/9NkTUnrbIQSazTIdbqknqkihQvht8aIauCLfoP okyZBdhTGoU35LuKfy+yK3nqVGjN599iOWGqiky5jYkm0UIz7+n0WN6l6AkY1g6JuYN4yP c9JI8R0fAeLGE9MUKeB53aWblUjbxNvb+K8nw/m5og0NpsnOCfYpqC00sK4Abw== Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Sat, 21 Mar 2026 17:29:43 +0100 Message-Id: Subject: Re: [OE-core][PATCH v11 0/4] SPDX 3.0 SBOM enrichment and compliance improvements Cc: , , , , From: "Mathieu Dubois-Briand" To: , X-Mailer: aerc 0.19.0-0-gadd9e15e475d References: <20260321131826.1401671-1-stondo@gmail.com> In-Reply-To: <20260321131826.1401671-1-stondo@gmail.com> X-Last-TLS-Session-Version: TLSv1.3 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sat, 21 Mar 2026 16:29:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233666 On Sat Mar 21, 2026 at 2:18 PM CET, Stefano Tondo via lists.openembedded.or= g wrote: > From: Stefano Tondo > > This series enhances SPDX 3.0 SBOM generation with enriched > metadata and compliance-oriented controls for current master. > > Compared with v10, this series has been rebased on top of current > master after Joshua's related changes landed upstream. The merged or > superseded pieces have been dropped, leaving the four still-relevant > patches below. > > Changes since v10: > > - Rebased onto current master. > - Dropped patches now merged or superseded upstream. > - Restored the current recipe/build SPDX task split after rebase. > - Updated the remaining selftests to use the current builds/ output > paths. > - Revalidated the source-download enrichment tests requested by > Richard Purdie and Mathieu Dubois-Briand. > > Validated with: > > oe-selftest -r \ > spdx.SPDX30Check.test_packageconfig_spdx \ > spdx.SPDX30Check.test_download_location_defensive_handling \ > spdx.SPDX30Check.test_version_extraction_patterns > > Stefano Tondo (4): Hi Stefano, Thanks for the new version. I believe a call to collect_package_providers() was not modified to add the second argument: NOTE: recipe core-image-full-cmdline-1.0-r0: task do_create_rootfs_spdx: St= arted ERROR: core-image-full-cmdline-1.0-r0 do_create_rootfs_spdx: Error executin= g a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was= : File: 'exec_func_python() autogenerated', lineno: 2, function: 0001: *** 0002:do_create_rootfs_spdx(d) ... File: '/srv/pokybuild/yocto-worker/musl-qemux86-64/build/layers/openembedd= ed-core/meta/lib/oe/spdx30_tasks.py', lineno: 1300, function: collect_build= _package_inputs 1296: 1297:def collect_build_package_inputs(d, objset, build, packages, file= s_by_hash=3DNone): 1298: import oe.sbom30 1299: *** 1300: providers =3D oe.spdx_common.collect_package_providers(d) 1301: 1302: build_deps =3D set() 1303: missing_providers =3D set() 1304: Exception: TypeError: collect_package_providers() missing 1 required positi= onal argument: 'direct_deps' https://autobuilder.yoctoproject.org/valkyrie/#/builders/3/builds/3489 Also, we have a warning about tabs in cpan.bbclass: WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 73 WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 74 WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 75 WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 76 WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 77 WARNING: python should use 4 spaces indentation, but found tabs in cpan.bbc= lass, line 78 (same log file) This file already had mixed tabs and spaces, so I'm not sure why this is different. Can you have a look at it? Thanks, Mathieu --=20 Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com