Re: [OE-core][question] sbom-cve-check: question about ${DEPLOY_DIR_IMAGE}

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello,

On Monday, April 20, 2026 at 3:43 AM, Ruoqin Zheng (Fujitsu) wrote:
>  Hi All
> 
>    I tryed to use sbom-cve-check-recipe and found that the sbom file will copy to ${DEPLOY_DIR_IMAGE}.
> 
>    It will cause a lot of sbom files in ${DEPLOY_DIR_IMAGE} dir and hard to find the rootfs/kernel which user want to find.
> 
>    ./deploy/images/qemux86-64/
>    ......
>     zlib-native-recipe-sbom.sbom-cve-check.spdx.json                    
>     zlib-native-recipe-sbom.sbom-cve-check.yocto.json                   
>     zlib-native-recipe-sbom.spdx.json                       
>     zlib-recipe-sbom.sbom-cve-check.spdx.json                     
>     zlib-recipe-sbom.sbom-cve-check.yocto.json                    
>     zlib-recipe-sbom.spdx.json                        
>    ......
> 
>    First, I want to ask the design goals of this output dir.
> 
>    Then I found it was defined in sbom-cve-check-recipe.bbclass and I tryed to change it to other dir in local.conf but it can't work.
>    do_sbom_cve_check_recipe[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
> 
>    Does any one know the way to change it outside of sbom-cve-check-recipe.bbclass?

Currently as designed, without modifying the bbclass, it is not possible to
modify the output directory.
We could create a variable, which is by default set to "${DEPLOY_DIR_IMAGE}"
and use this new variable to configure sstate-outputdirs.

Or we could simply replace the line by:
do_sbom_cve_check_recipe[sstate-outputdirs] ?= "${DEPLOY_DIR_IMAGE}"

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com