Re: [OE-core][PATCH v4 00/10] Implement SPDX for deploy tasks

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Tue, 2026-06-30 at 15:01 -0600, Joshua Watt via lists.openembedded.org wrote:
> The SPDX use case for file system image has been well defined since SPDX
> was first implemented, however there has always been a desire to also
> express SPDX output for other non-image deliverables (primarily, those
> that have a do_deploy task or similar). These types of tasks cannot
> easily use the traditional method of having a separate SPDX task that
> runs to create their SPDX output as this causes lots of problems with
> the way dependencies are specified. Instead, it is desirable for these
> tasks to directly produce SPDX output that can be consumed by other
> tasks that depend on them.
> 
> This patch series adds support for this. Any sstate task that starts
> with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and it
> will run a postfunc to generate SPDX output that describes what is being
> deployed. For classical do_deploy tasks, this is setup to be easy by
> automatically capturing all the deployed output files in the SPDX data,
> but other tasks can be added as well.
> 
> Finally, the do_create_image_spdx task is removed and replaced with a
> SPDX deploy postfunc using this new system. This means that any task
> that depends on do_image_complete will automatically also get the SPDX
> output for the image, simplifying the dependency handling.
> 
> V2: Fixed SPDX documents missing at SBoM creation time when the
> documents were not a direct dependency of the SBoM, and were present in
> a sstate object. Previously, these sstate objects were not restored
> because they were "covered" by the later sstate tasks, but now they are
> restored if they are depended on by a task that creates SPDX output.
> 
> V3: Fixed a bug where dependencies that are not in the taskhash could be
> missing when the final SBoM is created and added tests.
> 
> V4: Fixed some testing errors that revealed that EFI providers have to
> be MACHINE_ARCH (and consequently, wic-tools)
> 
> Joshua Watt (10):
>   spdx: Skip dependencies that are not in the taskhash
>   spdx: Add ability for deploy tasks to create SPDX
>   oeqa: Add SPDX deploy SBoM test
>   classes-global/sstate: Keep SPDX generating setscene dependencies
>   Add SPDX deploy tasks to various recipes
>   spdx: Replace do_create_image_spdx with deploy task
>   grub-efi: Change to MACHINE_ARCH
>   systemd-boot: Change to MACHINE_ARCH
>   multilib: Add systemd-boot to NON_MULTILIB_RECIPES
>   wic-tools: Change to MACHINE_ARCH

There is something not quite right in here which I suspect, but havve't
currently conclusively prove caused:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4276
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4216

Cheers,

Richard