Re: [OE-core] [PATCH 0/2] Add meta layer information to spdx

["Antonin Godard" <antonin.godard@bootlin.com>]

On Mon Sep 14, 2026 at 1:44 PM CEST, Daniel Wagenknecht via lists.openembedded.org wrote:
> Hello,
>
> as discussed before here
> https://lists.openembedded.org/g/openembedded-core/message/226131
> and here
> https://lists.openembedded.org/g/openembedded-core/message/225774
>
> it would be good to include information about the layers used in a build in the
> generated spdx documents.
>
> My primary goal is to track where all the configuration files added via file
> protocol in `SRC_URI` originate from, but the approach could be extended to
> track recipes, classes, machine config etc.
>
> These patches are meant as a basis to discuss the approach and should be
> considered draft status.
>
> The approach is to generate a `layers.spdx.json` on each build invocation
> that lists each layer used in the build as a `softwarePackage` with version
> and source information as well as - if can be reasonably deducted - the
> downloadLocation. Each source file added via file protocol is then linked to the
> containing meta layer via a `contains` relationship.
>
> Open Questions:
> - is the overall architecture reasonable/correct?
> - referring to layers is inconsistent across tooling. E.g. the core layer is
>   either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is
>   the layer directory in the openembedded-core repository.
>   I chose the latter since that is what the utility function
>   `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL)
>   implementation uses the other naming scheme though. Any thoughts on which
>   should be chosen and why?
> - I do not understand the alias linking yet. With the current implementation
>   I see many hash mismatches like
>   WARNING: gcc-runtime-15.3.0-r0 do_create_spdx: Element http://spdx.org/spdxdocs/layers-7ad0d8d7-57f9-5c3c-9411-49227dd50610/layers/layer/meta
>     has alias http://spdx.org/spdxdocs/UNIHASH-7ad0d8d7-57f9-5c3c-9411-49227dd50610/UNIHASH/layer/meta, but it should have prefix
>     http://spdxdocs.org/openembedded-alias/by-doc-hash/e80f1d61f4749e663e80a4dfb25ebb1127b5f50600d3065de7ed91030942a1ef/
>
> I've currently got some time available to work on this to get a proper solution
> integrated into openembedded-core.

This series is causing the following issue on our Autobuilder:

  ERROR: No SPDX document named /srv/pokybuild/yocto-worker/qemuarm-alt/build/build/tmp/deploy/spdx/3.0.1/bitbake.spdx.json found

See full log here: https://autobuilder.yoctoproject.org/valkyrie/#/builders/74/builds/4598

Can you look into it?

Thanks,
Antonin