Re: [docs] [PATCH] ref-manual: add SPDX_INCLUDE_KERNEL_CONFIG and SPDX_INCLUDE_PACKAGECONFIG

[Kamel Bouhara <kamel.bouhara@bootlin.com>]

On Wed, Feb 25, 2026 at 03:10:23PM +0100, Antonin Godard wrote:
> Hi,
>
> Thanks! This looks good to me.
>
> I've just fixed the alphabetical order in variables.rst locally:
>

Sorry for that and thanks !

> diff --git a/documentation/ref-manual/variables.rst b/documentation/ref-manual/variables.rst
> index 2e812d02d..45073d8a0 100644
> --- a/documentation/ref-manual/variables.rst
> +++ b/documentation/ref-manual/variables.rst
> @@ -9096,31 +9096,6 @@ system and gives an overview of their function and contents.
>        ``qemux86-64``, the uncompressed SBOM file can grow from hundreds
>        of megabytes to several gigabytes.
>
> -   :term:`SPDX_INCLUDE_SOURCES`
> -      This option allows to add a description of the source files used to build
> -      the host tools and the target packages, to the ``spdx.json`` files in
> -      ``tmp/deploy/spdx/MACHINE/recipes/`` under the :term:`Build Directory`.
> -      As a consequence, the ``spdx.json`` files under the ``by-namespace`` and
> -      ``packages`` subdirectories in ``tmp/deploy/spdx/MACHINE`` are also
> -      modified to include references to such source file descriptions.
> -
> -      Enable this option as follows::
> -
> -         SPDX_INCLUDE_SOURCES = "1"
> -
> -      For SPDX 2.2 format (release 4.1 "langdale"), building
> -      ``core-image-minimal`` for the ``qemux86-64`` machine, enabling
> -      this option multiplied the total size of the ``tmp/deploy/spdx``
> -      directory by a factor of 3  (+291 MiB for this image),
> -      and the size of the ``IMAGE-MACHINE.spdx.tar.zst`` in
> -      ``tmp/deploy/images/MACHINE`` by a factor of 130 (+15 MiB for this
> -      image), compared to just using the :ref:`ref-classes-create-spdx` class
> -      with no option.
> -
> -      With SPDX 3.0.1 JSON format, including source files significantly
> -      increases the SBOM size (potentially by several gigabytes for typical
> -      images).
> -
>     :term:`SPDX_INCLUDE_KERNEL_CONFIG`
>        This option allows exporting the Linux kernel configuration
>        (the contents of the ``.config`` file) into the recipe's SPDX
> @@ -9164,6 +9139,31 @@ system and gives an overview of their function and contents.
>        the SPDX SBOM to determine which optional features were
>        enabled or disabled in a given build.
>
> +   :term:`SPDX_INCLUDE_SOURCES`
> +      This option allows to add a description of the source files used to build
> +      the host tools and the target packages, to the ``spdx.json`` files in
> +      ``tmp/deploy/spdx/MACHINE/recipes/`` under the :term:`Build Directory`.
> +      As a consequence, the ``spdx.json`` files under the ``by-namespace`` and
> +      ``packages`` subdirectories in ``tmp/deploy/spdx/MACHINE`` are also
> +      modified to include references to such source file descriptions.
> +
> +      Enable this option as follows::
> +
> +         SPDX_INCLUDE_SOURCES = "1"
> +
> +      For SPDX 2.2 format (release 4.1 "langdale"), building
> +      ``core-image-minimal`` for the ``qemux86-64`` machine, enabling
> +      this option multiplied the total size of the ``tmp/deploy/spdx``
> +      directory by a factor of 3  (+291 MiB for this image),
> +      and the size of the ``IMAGE-MACHINE.spdx.tar.zst`` in
> +      ``tmp/deploy/images/MACHINE`` by a factor of 130 (+15 MiB for this
> +      image), compared to just using the :ref:`ref-classes-create-spdx` class
> +      with no option.
> +
> +      With SPDX 3.0.1 JSON format, including source files significantly
> +      increases the SBOM size (potentially by several gigabytes for typical
> +      images).
> +
>     :term:`SPDX_LICENSES`
>        Path to the JSON file containing SPDX license identifier mappings.
>        This file maps common license names to official SPDX license
>
> Antonin

--
Kamel Bouhara, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com