[PATCH v1] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx

[PATCH v1] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx

[Eric Meyers]

The override was "task-create-image-sbom" but BitBake derives it as
"task-create-image-sbom-spdx" (do_ stripped, underscores to hyphens), so
the skip was never applied. The task then cached an ${IMAGE_NAME}-stamped
SBOM in sstate, letting a stale spdx.json be restored via setscene. A
later do_sbom_cve_check would compute the current IMAGE_NAME and fail with
"No such file or directory" on the missing timestamped SBOM. Correct the
key so the image SBOM is always regenerated, never restored from sstate.

Signed-off-by: Eric Meyers <eric.meyers@arthrex.com>
Cc: Joshua Watt <JPEWhacker@gmail.com>
---
 meta/classes-recipe/create-spdx-image-3.0.bbclass | 2 +-
 meta/classes-recipe/nospdx.bbclass                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/create-spdx-image-3.0.bbclass b/meta/classes-recipe/create-spdx-image-3.0.bbclass
index 15a91e90e2..cf79ef5b01 100644
--- a/meta/classes-recipe/create-spdx-image-3.0.bbclass
+++ b/meta/classes-recipe/create-spdx-image-3.0.bbclass
@@ -71,7 +71,7 @@ python do_create_image_sbom_spdx() {
 }
 addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build
 SSTATETASKS += "do_create_image_sbom_spdx"
-SSTATE_SKIP_CREATION:task-create-image-sbom = "1"
+SSTATE_SKIP_CREATION:task-create-image-sbom-spdx = "1"
 do_create_image_sbom_spdx[sstate-inputdirs] = "${SPDXIMAGEDEPLOYDIR}"
 do_create_image_sbom_spdx[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
 do_create_image_sbom_spdx[stamp-extra-info] = "${MACHINE_ARCH}"
diff --git a/meta/classes-recipe/nospdx.bbclass b/meta/classes-recipe/nospdx.bbclass
index 7c99fcd1ec..aec73ca54c 100644
--- a/meta/classes-recipe/nospdx.bbclass
+++ b/meta/classes-recipe/nospdx.bbclass
@@ -10,4 +10,4 @@ deltask do_create_spdx_runtime
 deltask do_create_package_spdx
 deltask do_create_rootfs_spdx
 deltask do_create_image_spdx
-deltask do_create_image_sbom
+deltask do_create_image_sbom_spdx

Re: [OE-core] [PATCH v1] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx

[Ryan Eatmon]

Yoann,

This patch needs to be backported to wrynose as well to fix the issue 
introduced with this patch:

https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=b9f060ea6d54cc419df9ff5f8822a3536934606f



On 6/26/2026 8:16 AM, Eric Meyers via lists.openembedded.org wrote:
> The override was "task-create-image-sbom" but BitBake derives it as
> "task-create-image-sbom-spdx" (do_ stripped, underscores to hyphens), so
> the skip was never applied. The task then cached an ${IMAGE_NAME}-stamped
> SBOM in sstate, letting a stale spdx.json be restored via setscene. A
> later do_sbom_cve_check would compute the current IMAGE_NAME and fail with
> "No such file or directory" on the missing timestamped SBOM. Correct the
> key so the image SBOM is always regenerated, never restored from sstate.
> 
> Signed-off-by: Eric Meyers <eric.meyers@arthrex.com>
> Cc: Joshua Watt <JPEWhacker@gmail.com>
> ---
>   meta/classes-recipe/create-spdx-image-3.0.bbclass | 2 +-
>   meta/classes-recipe/nospdx.bbclass                | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes-recipe/create-spdx-image-3.0.bbclass b/meta/classes-recipe/create-spdx-image-3.0.bbclass
> index 15a91e90e2..cf79ef5b01 100644
> --- a/meta/classes-recipe/create-spdx-image-3.0.bbclass
> +++ b/meta/classes-recipe/create-spdx-image-3.0.bbclass
> @@ -71,7 +71,7 @@ python do_create_image_sbom_spdx() {
>   }
>   addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build
>   SSTATETASKS += "do_create_image_sbom_spdx"
> -SSTATE_SKIP_CREATION:task-create-image-sbom = "1"
> +SSTATE_SKIP_CREATION:task-create-image-sbom-spdx = "1"
>   do_create_image_sbom_spdx[sstate-inputdirs] = "${SPDXIMAGEDEPLOYDIR}"
>   do_create_image_sbom_spdx[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
>   do_create_image_sbom_spdx[stamp-extra-info] = "${MACHINE_ARCH}"
> diff --git a/meta/classes-recipe/nospdx.bbclass b/meta/classes-recipe/nospdx.bbclass
> index 7c99fcd1ec..aec73ca54c 100644
> --- a/meta/classes-recipe/nospdx.bbclass
> +++ b/meta/classes-recipe/nospdx.bbclass
> @@ -10,4 +10,4 @@ deltask do_create_spdx_runtime
>   deltask do_create_package_spdx
>   deltask do_create_rootfs_spdx
>   deltask do_create_image_spdx
> -deltask do_create_image_sbom
> +deltask do_create_image_sbom_spdx
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#239630): https://lists.openembedded.org/g/openembedded-core/message/239630
> Mute This Topic: https://lists.openembedded.org/mt/119989237/6551054
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [reatmon@ti.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 

-- 
Ryan Eatmon                reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS