Re: [OE-core] [PATCH v4 1/3] spdx: add option to include only compiled sources

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Thu, 2025-05-15 at 13:12 +0000, Daniel Turull via lists.openembedded.org wrote:
> Hi Quentin,
> Thanks for the feedback. That's a good point for the header files and
> the rust files. I'll need to find a better way to extract them, since
> scripts/clang-tools/gen_compile_commands.py only extracts the
> commands and includes only the c files. So unless we don't have
> better info on the files used, we should not exclude any header file.
> Do you know any better script to extract the compiled files from the
> kernel?
> 
> The current code in the spdx class is supposed to only ignore the c
> files that are not compiled, (so been conservative on what to remove)
> but probably the script that I have in [PATCH v4 3/3]
> improve_kernel_cve_report: add script for postprocesing of kernel CVE
> data.
> 
> Needs to be updated, that if the CVE is not in a c file is not
> ignored, unless we have the header files in the list of compiled
> files.
> 
> I'll correct the minor things in a newer patch, and probably needs
> another iteration to have it more generic and flexible.

Don't we already have tooling which look at the debug data and extract
the list of source files from that as part of do_package? This is how
we know what to put into the source debug packages?

Cheers,

Richard