Re: [OE-core][PATCH v4 00/10] Implement SPDX for deploy tasks

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Sun, 2026-07-05 at 09:29 +0100, Richard Purdie via
lists.openembedded.org wrote:
> On Tue, 2026-06-30 at 15:01 -0600, Joshua Watt via
> lists.openembedded.org wrote:
> > The SPDX use case for file system image has been well defined since
> > SPDX
> > was first implemented, however there has always been a desire to
> > also
> > express SPDX output for other non-image deliverables (primarily,
> > those
> > that have a do_deploy task or similar). These types of tasks cannot
> > easily use the traditional method of having a separate SPDX task
> > that
> > runs to create their SPDX output as this causes lots of problems
> > with
> > the way dependencies are specified. Instead, it is desirable for
> > these
> > tasks to directly produce SPDX output that can be consumed by other
> > tasks that depend on them.
> > 
> > This patch series adds support for this. Any sstate task that
> > starts
> > with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and
> > it
> > will run a postfunc to generate SPDX output that describes what is
> > being
> > deployed. For classical do_deploy tasks, this is setup to be easy
> > by
> > automatically capturing all the deployed output files in the SPDX
> > data,
> > but other tasks can be added as well.
> > 
> > Finally, the do_create_image_spdx task is removed and replaced with
> > a
> > SPDX deploy postfunc using this new system. This means that any
> > task
> > that depends on do_image_complete will automatically also get the
> > SPDX
> > output for the image, simplifying the dependency handling.
> > 
> > V2: Fixed SPDX documents missing at SBoM creation time when the
> > documents were not a direct dependency of the SBoM, and were
> > present in
> > a sstate object. Previously, these sstate objects were not restored
> > because they were "covered" by the later sstate tasks, but now they
> > are
> > restored if they are depended on by a task that creates SPDX
> > output.
> > 
> > V3: Fixed a bug where dependencies that are not in the taskhash
> > could be
> > missing when the final SBoM is created and added tests.
> > 
> > V4: Fixed some testing errors that revealed that EFI providers have
> > to
> > be MACHINE_ARCH (and consequently, wic-tools)
> > 
> > Joshua Watt (10):
> >   spdx: Skip dependencies that are not in the taskhash
> >   spdx: Add ability for deploy tasks to create SPDX
> >   oeqa: Add SPDX deploy SBoM test
> >   classes-global/sstate: Keep SPDX generating setscene dependencies
> >   Add SPDX deploy tasks to various recipes
> >   spdx: Replace do_create_image_spdx with deploy task
> >   grub-efi: Change to MACHINE_ARCH
> >   systemd-boot: Change to MACHINE_ARCH
> >   multilib: Add systemd-boot to NON_MULTILIB_RECIPES
> >   wic-tools: Change to MACHINE_ARCH
> 
> There is something not quite right in here which I suspect, but
> havve't
> currently conclusively prove caused:
> 
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4276
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4216

Those failures were not related to this series...

Cheers,

Richard