9 files changed, 578 insertions, 672 deletions

diff --git a/scripts/contrib/improve_kernel_cve_report.py b/scripts/contrib/improve_kernel_cve_report.py
new file mode 100755
index 0000000000..829cc4cd30
--- /dev/null
+++ b/scripts/contrib/improve_kernel_cve_report.py
@@ -0,0 +1,467 @@
+#! /usr/bin/env python3
+#
+# Copyright OpenEmbedded Contributors
+#
+# The script uses another source of CVE information from linux-vulns
+# to enrich the cve-summary from cve-check or vex.
+# It can also use the list of compiled files from the kernel spdx to ignore CVEs
+# that are not affected since the files are not compiled.
+#
+# It creates a new json file with updated CVE information
+#
+# Compiled files can be extracted adding the following in local.conf
+# SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"
+#
+# Tested with the following CVE sources:
+# - https://git.kernel.org/pub/scm/linux/security/vulns.git
+# - https://github.com/CVEProject/cvelistV5
+#
+# Example:
+# python3 ./openembedded-core/scripts/contrib/improve_kernel_cve_report.py --spdx tmp/deploy/spdx/3.0.1/qemux86_64/recipes/recipe-linux-yocto.spdx.json --kernel-version 6.12.27 --datadir ./vulns
+# python3 ./openembedded-core/scripts/contrib/improve_kernel_cve_report.py --spdx tmp/deploy/spdx/3.0.1/qemux86_64/recipes/recipe-linux-yocto.spdx.json --datadir ./vulns --old-cve-report build/tmp/log/cve/cve-summary.json
+#
+# SPDX-License-Identifier: GPLv2
+
+import argparse
+import json
+import sys
+import logging
+import glob
+import os
+import pathlib
+from packaging.version import Version
+
+def is_linux_cve(cve_info):
+    '''Return true is the CVE belongs to Linux'''
+    if not "affected" in cve_info["containers"]["cna"]:
+        return False
+    for affected in cve_info["containers"]["cna"]["affected"]:
+        if not "product" in affected:
+            return False
+        if affected["product"] == "Linux" and affected["vendor"] == "Linux":
+            return True
+    return False
+
+def get_kernel_cves(datadir, compiled_files, version):
+    """
+    Get CVEs for the kernel
+    """
+    cves = {}
+
+    check_config = len(compiled_files) > 0
+
+    base_version = Version(f"{version.major}.{version.minor}")
+
+    # Check all CVES from kernel vulns
+    pattern = os.path.join(datadir, '**', "CVE-*.json")
+    cve_files = glob.glob(pattern, recursive=True)
+    not_applicable_config = 0
+    fixed_as_later_backport = 0
+    vulnerable = 0
+    not_vulnerable = 0
+    for cve_file in sorted(cve_files):
+        cve_info = {}
+        with open(cve_file, "r", encoding='ISO-8859-1') as f:
+            cve_info = json.load(f)
+
+        if len(cve_info) == 0:
+            logging.error("Not valid data in %s. Aborting", cve_file)
+            break
+
+        if not is_linux_cve(cve_info):
+            continue
+        cve_id = os.path.basename(cve_file)[:-5]
+        description = cve_info["containers"]["cna"]["descriptions"][0]["value"]
+        if cve_file.find("rejected") >= 0:
+            logging.debug("%s is rejected by the CNA", cve_id)
+            cves[cve_id] = {
+                "id": cve_id,
+                "status": "Ignored",
+                "detail": "rejected",
+                "summary": description,
+                "description": f"Rejected by CNA"
+            }
+            continue
+        if any(elem in cve_file for elem in ["review", "reverved", "testing"]):
+            continue
+
+        is_vulnerable, first_affected, last_affected, better_match_first, better_match_last, affected_versions = get_cpe_applicability(cve_info, version)
+
+        logging.debug("%s: %s (%s - %s) (%s - %s)", cve_id, is_vulnerable, better_match_first, better_match_last, first_affected, last_affected)
+
+        if is_vulnerable is None:
+            logging.warning("%s doesn't have good metadata", cve_id)
+        if is_vulnerable:
+            is_affected = True
+            affected_files = []
+            if check_config:
+                is_affected, affected_files = check_kernel_compiled_files(compiled_files, cve_info)
+
+            if not is_affected and len(affected_files) > 0:
+                logging.debug(
+                    "%s - not applicable configuration since affected files not compiled: %s",
+                    cve_id, affected_files)
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Ignored",
+                    "detail": "not-applicable-config",
+                    "summary": description,
+                    "description": f"Source code not compiled by config. {affected_files}"
+                }
+                not_applicable_config +=1
+            # Check if we have backport
+            else:
+                if not better_match_last:
+                    fixed_in = last_affected
+                else:
+                    fixed_in = better_match_last
+                logging.debug("%s needs backporting (fixed from %s)", cve_id, fixed_in)
+                cves[cve_id] = {
+                        "id": cve_id,
+                        "status": "Unpatched",
+                        "detail": "version-in-range",
+                        "summary": description,
+                        "description": f"Needs backporting (fixed from {fixed_in})"
+                }
+                vulnerable += 1
+                if (better_match_last and
+                    Version(f"{better_match_last.major}.{better_match_last.minor}") == base_version):
+                    fixed_as_later_backport += 1
+        # Not vulnerable
+        else:
+            if not first_affected:
+                logging.debug("%s - not known affected %s",
+                              cve_id,
+                              better_match_last)
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Patched",
+                    "detail": "version-not-in-range",
+                    "summary": description,
+                    "description": "No CPE match"
+                }
+                not_vulnerable += 1
+                continue
+            backport_base = Version(f"{better_match_last.major}.{better_match_last.minor}")
+            if version < first_affected:
+                logging.debug('%s - fixed-version: only affects %s onwards',
+                              cve_id,
+                              first_affected)
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Patched",
+                    "detail": "fixed-version",
+                    "summary": description,
+                    "description": f"only affects {first_affected} onwards"
+                }
+                not_vulnerable += 1
+            elif last_affected <= version:
+                logging.debug("%s - fixed-version: Fixed from version %s",
+                              cve_id,
+                              last_affected)
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Patched",
+                    "detail": "fixed-version",
+                    "summary": description,
+                    "description": f"fixed-version: Fixed from version {last_affected}"
+                }
+                not_vulnerable += 1
+            elif backport_base == base_version:
+                logging.debug("%s - cpe-stable-backport: Backported in %s",
+                              cve_id,
+                              better_match_last)
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Patched",
+                    "detail": "cpe-stable-backport",
+                    "summary": description,
+                    "description": f"Backported in {better_match_last}"
+                }
+                not_vulnerable += 1
+            else:
+                logging.debug("%s - version not affected %s", cve_id, str(affected_versions))
+                cves[cve_id] = {
+                    "id": cve_id,
+                    "status": "Patched",
+                    "detail": "version-not-in-range",
+                    "summary": description,
+                    "description": f"Range {affected_versions}"
+                }
+                not_vulnerable += 1
+
+    logging.info("Total CVEs ignored due to not applicable config: %d", not_applicable_config)
+    logging.info("Total CVEs not vulnerable due version-not-in-range: %d", not_vulnerable)
+    logging.info("Total vulnerable CVEs: %d", vulnerable)
+
+    logging.info("Total CVEs already backported in %s: %s", base_version,
+                    fixed_as_later_backport)
+    return cves
+
+def read_spdx(spdx_file):
+    '''Open SPDX file and extract compiled files'''
+    with open(spdx_file, 'r', encoding='ISO-8859-1') as f:
+        spdx = json.load(f)
+        if "spdxVersion" in spdx:
+            if spdx["spdxVersion"] == "SPDX-2.2":
+                return read_spdx2(spdx)
+        if "@graph" in spdx:
+            return read_spdx3(spdx)
+    return []
+
+def read_spdx2(spdx):
+    '''
+    Read spdx2 compiled files from spdx
+    '''
+    cfiles = set()
+    if 'files' not in spdx:
+        return cfiles
+    for item in spdx['files']:
+        for ftype in item['fileTypes']:
+            if ftype == "SOURCE":
+                filename = item["fileName"][item["fileName"].find("/")+1:]
+                cfiles.add(filename)
+    return cfiles
+
+def read_spdx3(spdx):
+    '''
+    Read spdx3 compiled files from spdx
+    '''
+    cfiles = set()
+    for item in spdx["@graph"]:
+        if "software_primaryPurpose" not in item:
+            continue
+        if item["software_primaryPurpose"] == "source":
+            filename = item['name'][item['name'].find("/")+1:]
+            cfiles.add(filename)
+    return cfiles
+
+def check_kernel_compiled_files(compiled_files, cve_info):
+    """
+    Return if a CVE affected us depending on compiled files
+    """
+    files_affected = set()
+    is_affected = False
+
+    for item in cve_info['containers']['cna']['affected']:
+        if "programFiles" in item:
+            for f in item['programFiles']:
+                if f not in files_affected:
+                    files_affected.add(f)
+
+    if len(files_affected) > 0:
+        for f in files_affected:
+            if f in compiled_files:
+                logging.debug("File match: %s", f)
+                is_affected = True
+    return is_affected, files_affected
+
+def get_cpe_applicability(cve_info, v):
+    '''
+    Check if version is affected and return affected versions
+    '''
+    base_branch = Version(f"{v.major}.{v.minor}")
+    affected = []
+    if not 'cpeApplicability' in cve_info["containers"]["cna"]:
+        return None, None, None, None, None, None
+
+    for nodes in cve_info["containers"]["cna"]["cpeApplicability"]:
+        for node in nodes.values():
+            vulnerable = False
+            matched_branch = False
+            first_affected = Version("5000")
+            last_affected = Version("0")
+            better_match_first = Version("0")
+            better_match_last = Version("5000")
+
+            if len(node[0]['cpeMatch']) == 0:
+                first_affected = None
+                last_affected = None
+                better_match_first = None
+                better_match_last = None
+
+            for cpe_match in node[0]['cpeMatch']:
+                version_start_including = Version("0")
+                version_end_excluding = Version("0")
+                if 'versionStartIncluding' in cpe_match:
+                    version_start_including = Version(cpe_match['versionStartIncluding'])
+                else:
+                    version_start_including = Version("0")
+                # if versionEndExcluding is missing we are in a branch, which is not fixed.
+                if "versionEndExcluding" in cpe_match:
+                    version_end_excluding = Version(cpe_match["versionEndExcluding"])
+                else:
+                    # if versionEndExcluding is missing we are in a branch, which is not fixed.
+                    version_end_excluding = Version(
+                        f"{version_start_including.major}.{version_start_including.minor}.5000"
+                    )
+                affected.append(f" {version_start_including}-{version_end_excluding}")
+                # Detect if versionEnd is in fixed in base branch. It has precedence over the rest
+                branch_end = Version(f"{version_end_excluding.major}.{version_end_excluding.minor}")
+                if branch_end == base_branch:
+                    if version_start_including <= v < version_end_excluding:
+                        vulnerable = cpe_match['vulnerable']
+                    # If we don't match in our branch, we are not vulnerable,
+                    # since we have a backport
+                    matched_branch = True
+                    better_match_first = version_start_including
+                    better_match_last = version_end_excluding
+                if version_start_including <= v < version_end_excluding and not matched_branch:
+                    if version_end_excluding < better_match_last:
+                        better_match_first = max(version_start_including, better_match_first)
+                        better_match_last = min(better_match_last, version_end_excluding)
+                        vulnerable = cpe_match['vulnerable']
+                        matched_branch = True
+
+                first_affected = min(version_start_including, first_affected)
+                last_affected = max(version_end_excluding, last_affected)
+            # Not a better match, we use the first and last affected instead of the fake .5000
+            if vulnerable and better_match_last == Version(f"{base_branch}.5000"):
+                better_match_last = last_affected
+                better_match_first = first_affected
+    return vulnerable, first_affected, last_affected, better_match_first, better_match_last, affected
+
+def copy_data(old, new):
+    '''Update dictionary with new entries, while keeping the old ones'''
+    for k in new.keys():
+        old[k] = new[k]
+    return old
+
+# Function taken from cve_check.bbclass. Adapted to cve fields
+def cve_update(cve_data, cve, entry):
+    # If no entry, just add it
+    if cve not in cve_data:
+        cve_data[cve] = entry
+        return
+    # If we are updating, there might be change in the status
+    if cve_data[cve]['status'] == "Unknown":
+        cve_data[cve] = copy_data(cve_data[cve], entry)
+        return
+    if cve_data[cve]['status'] == entry['status']:
+        return
+    if entry['status'] == "Unpatched" and cve_data[cve]['status'] == "Patched":
+        logging.warning("CVE entry %s update from Patched to Unpatched from the scan result", cve)
+        cve_data[cve] = copy_data(cve_data[cve], entry)
+        return
+    if entry['status'] == "Patched" and cve_data[cve]['status'] == "Unpatched":
+        logging.warning("CVE entry %s update from Unpatched to Patched from the scan result", cve)
+        cve_data[cve] = copy_data(cve_data[cve], entry)
+        return
+    # If we have an "Ignored", it has a priority
+    if cve_data[cve]['status'] == "Ignored":
+        logging.debug("CVE %s not updating because Ignored", cve)
+        return
+    # If we have an "Ignored", it has a priority
+    if entry['status'] == "Ignored":
+        cve_data[cve] = copy_data(cve_data[cve], entry)
+        logging.debug("CVE entry %s updated from Unpatched to Ignored", cve)
+        return
+    logging.warning("Unhandled CVE entry update for %s %s from %s %s to %s",
+        cve, cve_data[cve]['status'], cve_data[cve]['detail'],  entry['status'], entry['detail'])
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Update cve-summary with kernel compiled files and kernel CVE information"
+    )
+    parser.add_argument(
+        "-s",
+        "--spdx",
+        help="SPDX2/3 for the kernel. Needs to include compiled sources",
+    )
+    parser.add_argument(
+        "--datadir",
+        type=pathlib.Path,
+        help="Directory where CVE data is",
+        required=True
+    )
+    parser.add_argument(
+        "--old-cve-report",
+        help="CVE report to update. (Optional)",
+    )
+    parser.add_argument(
+        "--kernel-version",
+        help="Kernel version. Needed if old cve_report is not provided (Optional)",
+        type=Version
+    )
+    parser.add_argument(
+        "--new-cve-report",
+        help="Output file",
+        default="cve-summary-enhance.json"
+    )
+    parser.add_argument(
+        "-D",
+        "--debug",
+        help='Enable debug ',
+        action="store_true")
+
+    args = parser.parse_args()
+
+    if args.debug:
+        log_level=logging.DEBUG
+    else:
+        log_level=logging.INFO
+    logging.basicConfig(format='[%(filename)s:%(lineno)d] %(message)s', level=log_level)
+
+    if not args.kernel_version and not args.old_cve_report:
+        parser.error("either --kernel-version or --old-cve-report are needed")
+        return -1
+
+    # by default we don't check the compiled files, unless provided
+    compiled_files = []
+    if args.spdx:
+        compiled_files = read_spdx(args.spdx)
+        logging.info("Total compiled files %d", len(compiled_files))
+
+    if args.old_cve_report:
+        with open(args.old_cve_report, encoding='ISO-8859-1') as f:
+            cve_report = json.load(f)
+    else:
+        #If summary not provided, we create one
+        cve_report = {
+            "version": "1",
+            "package": [
+                {
+                    "name": "linux-yocto",
+                    "version": str(args.kernel_version),
+                    "products": [
+                        {
+                            "product": "linux_kernel",
+                            "cvesInRecord": "Yes"
+                        }
+                    ],
+                    "issue": []
+                }
+            ]
+        }
+
+    for pkg in cve_report['package']:
+        is_kernel = False
+        for product in pkg['products']:
+            if product['product'] == "linux_kernel":
+                is_kernel=True
+        if not is_kernel:
+            continue
+
+        kernel_cves = get_kernel_cves(args.datadir,
+                                      compiled_files,
+                                      Version(pkg["version"]))
+        logging.info("Total kernel cves from kernel CNA: %s", len(kernel_cves))
+        cves = {issue["id"]: issue for issue in pkg["issue"]}
+        logging.info("Total kernel before processing cves: %s", len(cves))
+
+        for cve in kernel_cves:
+            cve_update(cves, cve, kernel_cves[cve])
+
+        pkg["issue"] = []
+        for cve in sorted(cves):
+            pkg["issue"].extend([cves[cve]])
+        logging.info("Total kernel cves after processing: %s", len(pkg['issue']))
+
+    with open(args.new_cve_report, "w", encoding='ISO-8859-1') as f:
+        json.dump(cve_report, f, indent=2)
+
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())
+
diff --git a/scripts/lib/devtool/ide_sdk.py b/scripts/lib/devtool/ide_sdk.py
index f8cf65f4a8..931408fa74 100755
--- a/scripts/lib/devtool/ide_sdk.py
+++ b/scripts/lib/devtool/ide_sdk.py
@@ -334,7 +334,7 @@ class RecipeModified:
         self.srctree = workspace[workspacepn]['srctree']
         # Need to grab this here in case the source is within a subdirectory
         self.real_srctree = get_real_srctree(
-            self.srctree, recipe_d.getVar('S'), recipe_d.getVar('WORKDIR'))
+            self.srctree, recipe_d.getVar('S'), recipe_d.getVar('UNPACKDIR'))
         self.bbappend = workspace[workspacepn]['bbappend']
 
         self.ide_sdk_dir = os.path.join(
diff --git a/scripts/lib/devtool/standard.py b/scripts/lib/devtool/standard.py
index cdfdba43ee..1fd5947c41 100644
--- a/scripts/lib/devtool/standard.py
+++ b/scripts/lib/devtool/standard.py
@@ -625,7 +625,7 @@ def _extract_source(srctree, keep_temp, devbranch, sync, config, basepath, works
                 srcsubdir = f.read()
         except FileNotFoundError as e:
             raise DevtoolError('Something went wrong with source extraction - the devtool-source class was not active or did not function correctly:\n%s' % str(e))
-        srcsubdir_rel = os.path.relpath(srcsubdir, os.path.join(tempdir, 'workdir'))
+        srcsubdir_rel = os.path.relpath(srcsubdir, os.path.join(tempdir, 'workdir', os.path.relpath(d.getVar('UNPACKDIR'), d.getVar('WORKDIR'))))
 
         # Check if work-shared is empty, if yes
         # find source and copy to work-shared
@@ -742,13 +742,13 @@ def get_staging_kbranch(srcdir):
         staging_kbranch = "".join(branch.split('\n')[0])
     return staging_kbranch
 
-def get_real_srctree(srctree, s, workdir):
+def get_real_srctree(srctree, s, unpackdir):
     # Check that recipe isn't using a shared workdir
     s = os.path.abspath(s)
-    workdir = os.path.abspath(workdir)
-    if s.startswith(workdir) and s != workdir and os.path.dirname(s) != workdir:
+    unpackdir = os.path.abspath(unpackdir)
+    if s.startswith(unpackdir) and s != unpackdir and os.path.dirname(s) != unpackdir:
         # Handle if S is set to a subdirectory of the source
-        srcsubdir = os.path.relpath(s, workdir).split(os.sep, 1)[1]
+        srcsubdir = os.path.relpath(s, unpackdir).split(os.sep, 1)[1]
         srctree = os.path.join(srctree, srcsubdir)
     return srctree
 
@@ -907,7 +907,7 @@ def modify(args, config, basepath, workspace):
 
         # Need to grab this here in case the source is within a subdirectory
         srctreebase = srctree
-        srctree = get_real_srctree(srctree, rd.getVar('S'), rd.getVar('WORKDIR'))
+        srctree = get_real_srctree(srctree, rd.getVar('S'), rd.getVar('UNPACKDIR'))
 
         bb.utils.mkdirhier(os.path.dirname(appendfile))
         with open(appendfile, 'w') as f:
diff --git a/scripts/lib/devtool/upgrade.py b/scripts/lib/devtool/upgrade.py
index 0dace1fb24..d9aca6e2db 100644
--- a/scripts/lib/devtool/upgrade.py
+++ b/scripts/lib/devtool/upgrade.py
@@ -571,7 +571,7 @@ def upgrade(args, config, basepath, workspace):
         else:
             srctree = standard.get_default_srctree(config, pn)
 
-        srctree_s = standard.get_real_srctree(srctree, rd.getVar('S'), rd.getVar('WORKDIR'))
+        srctree_s = standard.get_real_srctree(srctree, rd.getVar('S'), rd.getVar('UNPACKDIR'))
 
         # try to automatically discover latest version and revision if not provided on command line
         if not args.version and not args.srcrev:
diff --git a/scripts/lib/recipetool/append.py b/scripts/lib/recipetool/append.py
index 10945d6008..041d79f162 100644
--- a/scripts/lib/recipetool/append.py
+++ b/scripts/lib/recipetool/append.py
@@ -317,7 +317,7 @@ def appendsrc(args, files, rd, extralines=None):
     import oe.recipeutils
 
     srcdir = rd.getVar('S')
-    workdir = rd.getVar('WORKDIR')
+    unpackdir = rd.getVar('UNPACKDIR')
 
     import bb.fetch
     simplified = {}
@@ -336,10 +336,10 @@ def appendsrc(args, files, rd, extralines=None):
         src_destdir = os.path.dirname(srcfile)
         if not args.use_workdir:
             if rd.getVar('S') == rd.getVar('STAGING_KERNEL_DIR'):
-                srcdir = os.path.join(workdir, 'git')
+                srcdir = os.path.join(unpackdir, rd.getVar('BB_GIT_DEFAULT_DESTSUFFIX'))
                 if not bb.data.inherits_class('kernel-yocto', rd):
-                    logger.warning('S == STAGING_KERNEL_DIR and non-kernel-yocto, unable to determine path to srcdir, defaulting to ${WORKDIR}/git')
-            src_destdir = os.path.join(os.path.relpath(srcdir, workdir), src_destdir)
+                    logger.warning('S == STAGING_KERNEL_DIR and non-kernel-yocto, unable to determine path to srcdir, defaulting to ${UNPACKDIR}/${BB_GIT_DEFAULT_DESTSUFFIX}')
+            src_destdir = os.path.join(os.path.relpath(srcdir, unpackdir), src_destdir)
         src_destdir = os.path.normpath(src_destdir)
 
         if src_destdir and src_destdir != '.':
diff --git a/scripts/lib/recipetool/create.py b/scripts/lib/recipetool/create.py
index 3c6ef6719f..ef0ba974a9 100644
--- a/scripts/lib/recipetool/create.py
+++ b/scripts/lib/recipetool/create.py
@@ -18,6 +18,7 @@ from urllib.parse import urlparse, urldefrag, urlsplit
 import hashlib
 import bb.fetch2
 logger = logging.getLogger('recipetool')
+from oe.license import tidy_licenses
 from oe.license_finder import find_licenses
 
 tinfoil = None
@@ -638,7 +639,6 @@ def create_recipe(args):
                     if len(splitline) > 1:
                         if splitline[0] == 'origin' and scriptutils.is_src_url(splitline[1]):
                             srcuri = reformat_git_uri(splitline[1]) + ';branch=master'
-                            srcsubdir = 'git'
                             break
 
     if args.src_subdir:
@@ -736,7 +736,7 @@ def create_recipe(args):
     if srcsubdir and not args.binary:
         # (for binary packages we explicitly specify subdir= when fetching to
         # match the default value of S, so we don't need to set it in that case)
-        lines_before.append('S = "${WORKDIR}/%s"' % srcsubdir)
+        lines_before.append('S = "${UNPACKDIR}/%s"' % srcsubdir)
         lines_before.append('')
 
     if pkgarch:
@@ -765,6 +765,7 @@ def create_recipe(args):
     extrafiles = extravalues.pop('extrafiles', {})
     extra_pn = extravalues.pop('PN', None)
     extra_pv = extravalues.pop('PV', None)
+    run_tasks = extravalues.pop('run_tasks', "").split()
 
     if extra_pv and not realpv:
         realpv = extra_pv
@@ -825,7 +826,8 @@ def create_recipe(args):
             extraoutdir = os.path.join(os.path.dirname(outfile), pn)
         bb.utils.mkdirhier(extraoutdir)
         for destfn, extrafile in extrafiles.items():
-            shutil.move(extrafile, os.path.join(extraoutdir, destfn))
+            fn = destfn.format(pn=pn, pv=realpv)
+            shutil.move(extrafile, os.path.join(extraoutdir, fn))
 
     lines = lines_before
     lines_before = []
@@ -840,7 +842,7 @@ def create_recipe(args):
                 line = line.replace(realpv, '${PV}')
             if pn:
                 line = line.replace(pn, '${BPN}')
-            if line == 'S = "${WORKDIR}/${BPN}-${PV}"':
+            if line == 'S = "${UNPACKDIR}/${BPN}-${PV}"' or 'tmp-recipetool-' in line:
                 skipblank = True
                 continue
         elif line.startswith('SRC_URI = '):
@@ -918,6 +920,10 @@ def create_recipe(args):
         log_info_cond('Recipe %s has been created; further editing may be required to make it fully functional' % outfile, args.devtool)
         tinfoil.modified_files()
 
+    for task in run_tasks:
+        logger.info("Running task %s" % task)
+        tinfoil.build_file_sync(outfile, task)
+
     if tempsrc:
         if args.keep_temp:
             logger.info('Preserving temporary directory %s' % tempsrc)
@@ -945,16 +951,6 @@ def fixup_license(value):
         return '(' + value + ')'
     return value
 
-def tidy_licenses(value):
-    """Flat, split and sort licenses"""
-    from oe.license import flattened_licenses
-    def _choose(a, b):
-        str_a, str_b  = sorted((" & ".join(a), " & ".join(b)), key=str.casefold)
-        return ["(%s | %s)" % (str_a, str_b)]
-    if not isinstance(value, str):
-        value = " & ".join(value)
-    return sorted(list(set(flattened_licenses(value, _choose))), key=str.casefold)
-
 def handle_license_vars(srctree, lines_before, handled, extravalues, d):
     lichandled = [x for x in handled if x[0] == 'license']
     if lichandled:
diff --git a/scripts/lib/recipetool/create_go.py b/scripts/lib/recipetool/create_go.py
index 5cc53931f0..4b1fa39d13 100644
--- a/scripts/lib/recipetool/create_go.py
+++ b/scripts/lib/recipetool/create_go.py
@@ -10,13 +10,7 @@
 #
 
 
-from collections import namedtuple
-from enum import Enum
-from html.parser import HTMLParser
 from recipetool.create import RecipeHandler, handle_license_vars
-from recipetool.create import find_licenses, tidy_licenses, fixup_license
-from recipetool.create import determine_from_url
-from urllib.error import URLError, HTTPError
 
 import bb.utils
 import json
@@ -25,33 +19,20 @@ import os
 import re
 import subprocess
 import sys
-import shutil
 import tempfile
-import urllib.parse
-import urllib.request
 
 
-GoImport = namedtuple('GoImport', 'root vcs url suffix')
 logger = logging.getLogger('recipetool')
-CodeRepo = namedtuple(
-    'CodeRepo', 'path codeRoot codeDir pathMajor pathPrefix pseudoMajor')
 
 tinfoil = None
 
-# Regular expression to parse pseudo semantic version
-# see https://go.dev/ref/mod#pseudo-versions
-re_pseudo_semver = re.compile(
-    r"^v[0-9]+\.(0\.0-|\d+\.\d+-([^+]*\.)?0\.)(?P<utc>\d{14})-(?P<commithash>[A-Za-z0-9]+)(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$")
-# Regular expression to parse semantic version
-re_semver = re.compile(
-    r"^v(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)(?:-(?P<prerelease>(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?P<buildmetadata>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$")
-
 
 def tinfoil_init(instance):
     global tinfoil
     tinfoil = instance
 
 
+
 class GoRecipeHandler(RecipeHandler):
     """Class to handle the go recipe creation"""
 
@@ -83,578 +64,6 @@ class GoRecipeHandler(RecipeHandler):
 
         return bindir
 
-    def __resolve_repository_static(self, modulepath):
-        """Resolve the repository in a static manner
-
-            The method is based on the go implementation of
-            `repoRootFromVCSPaths` in
-            https://github.com/golang/go/blob/master/src/cmd/go/internal/vcs/vcs.go
-        """
-
-        url = urllib.parse.urlparse("https://" + modulepath)
-        req = urllib.request.Request(url.geturl())
-
-        try:
-            resp = urllib.request.urlopen(req)
-            # Some modulepath are just redirects to github (or some other vcs
-            # hoster). Therefore, we check if this modulepath redirects to
-            # somewhere else
-            if resp.geturl() != url.geturl():
-                bb.debug(1, "%s is redirectred to %s" %
-                         (url.geturl(), resp.geturl()))
-                url = urllib.parse.urlparse(resp.geturl())
-                modulepath = url.netloc + url.path
-
-        except URLError as url_err:
-            # This is probably because the module path
-            # contains the subdir and major path. Thus,
-            # we ignore this error for now
-            logger.debug(
-                1, "Failed to fetch page from [%s]: %s" % (url, str(url_err)))
-
-        host, _, _ = modulepath.partition('/')
-
-        class vcs(Enum):
-            pathprefix = "pathprefix"
-            regexp = "regexp"
-            type = "type"
-            repo = "repo"
-            check = "check"
-            schemelessRepo = "schemelessRepo"
-
-        # GitHub
-        vcsGitHub = {}
-        vcsGitHub[vcs.pathprefix] = "github.com"
-        vcsGitHub[vcs.regexp] = re.compile(
-            r'^(?P<root>github\.com/[A-Za-z0-9_.\-]+/[A-Za-z0-9_.\-]+)(/(?P<suffix>[A-Za-z0-9_.\-]+))*$')
-        vcsGitHub[vcs.type] = "git"
-        vcsGitHub[vcs.repo] = "https://\\g<root>"
-
-        # Bitbucket
-        vcsBitbucket = {}
-        vcsBitbucket[vcs.pathprefix] = "bitbucket.org"
-        vcsBitbucket[vcs.regexp] = re.compile(
-            r'^(?P<root>bitbucket\.org/(?P<bitname>[A-Za-z0-9_.\-]+/[A-Za-z0-9_.\-]+))(/(?P<suffix>[A-Za-z0-9_.\-]+))*$')
-        vcsBitbucket[vcs.type] = "git"
-        vcsBitbucket[vcs.repo] = "https://\\g<root>"
-
-        # IBM DevOps Services (JazzHub)
-        vcsIBMDevOps = {}
-        vcsIBMDevOps[vcs.pathprefix] = "hub.jazz.net/git"
-        vcsIBMDevOps[vcs.regexp] = re.compile(
-            r'^(?P<root>hub\.jazz\.net/git/[a-z0-9]+/[A-Za-z0-9_.\-]+)(/(?P<suffix>[A-Za-z0-9_.\-]+))*$')
-        vcsIBMDevOps[vcs.type] = "git"
-        vcsIBMDevOps[vcs.repo] = "https://\\g<root>"
-
-        # Git at Apache
-        vcsApacheGit = {}
-        vcsApacheGit[vcs.pathprefix] = "git.apache.org"
-        vcsApacheGit[vcs.regexp] = re.compile(
-            r'^(?P<root>git\.apache\.org/[a-z0-9_.\-]+\.git)(/(?P<suffix>[A-Za-z0-9_.\-]+))*$')
-        vcsApacheGit[vcs.type] = "git"
-        vcsApacheGit[vcs.repo] = "https://\\g<root>"
-
-        # Git at OpenStack
-        vcsOpenStackGit = {}
-        vcsOpenStackGit[vcs.pathprefix] = "git.openstack.org"
-        vcsOpenStackGit[vcs.regexp] = re.compile(
-            r'^(?P<root>git\.openstack\.org/[A-Za-z0-9_.\-]+/[A-Za-z0-9_.\-]+)(\.git)?(/(?P<suffix>[A-Za-z0-9_.\-]+))*$')
-        vcsOpenStackGit[vcs.type] = "git"
-        vcsOpenStackGit[vcs.repo] = "https://\\g<root>"
-
-        # chiselapp.com for fossil
-        vcsChiselapp = {}
-        vcsChiselapp[vcs.pathprefix] = "chiselapp.com"
-        vcsChiselapp[vcs.regexp] = re.compile(
-            r'^(?P<root>chiselapp\.com/user/[A-Za-z0-9]+/repository/[A-Za-z0-9_.\-]+)$')
-        vcsChiselapp[vcs.type] = "fossil"
-        vcsChiselapp[vcs.repo] = "https://\\g<root>"
-
-        # General syntax for any server.
-        # Must be last.
-        vcsGeneralServer = {}
-        vcsGeneralServer[vcs.regexp] = re.compile(
-            "(?P<root>(?P<repo>([a-z0-9.\\-]+\\.)+[a-z0-9.\\-]+(:[0-9]+)?(/~?[A-Za-z0-9_.\\-]+)+?)\\.(?P<vcs>bzr|fossil|git|hg|svn))(/~?(?P<suffix>[A-Za-z0-9_.\\-]+))*$")
-        vcsGeneralServer[vcs.schemelessRepo] = True
-
-        vcsPaths = [vcsGitHub, vcsBitbucket, vcsIBMDevOps,
-                    vcsApacheGit, vcsOpenStackGit, vcsChiselapp,
-                    vcsGeneralServer]
-
-        if modulepath.startswith("example.net") or modulepath == "rsc.io":
-            logger.warning("Suspicious module path %s" % modulepath)
-            return None
-        if modulepath.startswith("http:") or modulepath.startswith("https:"):
-            logger.warning("Import path should not start with %s %s" %
-                           ("http", "https"))
-            return None
-
-        rootpath = None
-        vcstype = None
-        repourl = None
-        suffix = None
-
-        for srv in vcsPaths:
-            m = srv[vcs.regexp].match(modulepath)
-            if vcs.pathprefix in srv:
-                if host == srv[vcs.pathprefix]:
-                    rootpath = m.group('root')
-                    vcstype = srv[vcs.type]
-                    repourl = m.expand(srv[vcs.repo])
-                    suffix = m.group('suffix')
-                    break
-            elif m and srv[vcs.schemelessRepo]:
-                rootpath = m.group('root')
-                vcstype = m[vcs.type]
-                repourl = m[vcs.repo]
-                suffix = m.group('suffix')
-                break
-
-        return GoImport(rootpath, vcstype, repourl, suffix)
-
-    def __resolve_repository_dynamic(self, modulepath):
-        """Resolve the repository root in a dynamic manner.
-
-            The method is based on the go implementation of
-            `repoRootForImportDynamic` in
-            https://github.com/golang/go/blob/master/src/cmd/go/internal/vcs/vcs.go
-        """
-        url = urllib.parse.urlparse("https://" + modulepath)
-
-        class GoImportHTMLParser(HTMLParser):
-
-            def __init__(self):
-                super().__init__()
-                self.__srv = {}
-
-            def handle_starttag(self, tag, attrs):
-                if tag == 'meta' and list(
-                        filter(lambda a: (a[0] == 'name' and a[1] == 'go-import'), attrs)):
-                    content = list(
-                        filter(lambda a: (a[0] == 'content'), attrs))
-                    if content:
-                        srv = content[0][1].split()
-                        self.__srv[srv[0]] = srv
-
-            def go_import(self, modulepath):
-                if modulepath in self.__srv:
-                    srv = self.__srv[modulepath]
-                    return GoImport(srv[0], srv[1], srv[2], None)
-                return None
-
-        url = url.geturl() + "?go-get=1"
-        req = urllib.request.Request(url)
-
-        try:
-            body = urllib.request.urlopen(req).read()
-        except HTTPError as http_err:
-            logger.warning(
-                "Unclean status when fetching page from [%s]: %s", url, str(http_err))
-            body = http_err.fp.read()
-        except URLError as url_err:
-            logger.warning(
-                "Failed to fetch page from [%s]: %s", url, str(url_err))
-            return None
-
-        parser = GoImportHTMLParser()
-        parser.feed(body.decode('utf-8'))
-        parser.close()
-
-        return parser.go_import(modulepath)
-
-    def __resolve_from_golang_proxy(self, modulepath, version):
-        """
-        Resolves repository data from golang proxy
-        """
-        url = urllib.parse.urlparse("https://proxy.golang.org/"
-                                    + modulepath
-                                    + "/@v/"
-                                    + version
-                                    + ".info")
-
-        # Transform url to lower case, golang proxy doesn't like mixed case
-        req = urllib.request.Request(url.geturl().lower())
-
-        try:
-            resp = urllib.request.urlopen(req)
-        except URLError as url_err:
-            logger.warning(
-                "Failed to fetch page from [%s]: %s", url, str(url_err))
-            return None
-
-        golang_proxy_res = resp.read().decode('utf-8')
-        modinfo = json.loads(golang_proxy_res)
-
-        if modinfo and 'Origin' in modinfo:
-            origin = modinfo['Origin']
-            _root_url = urllib.parse.urlparse(origin['URL'])
-
-            # We normalize the repo URL since we don't want the scheme in it
-            _subdir = origin['Subdir'] if 'Subdir' in origin else None
-            _root, _, _ = self.__split_path_version(modulepath)
-            if _subdir:
-                _root = _root[:-len(_subdir)].strip('/')
-
-            _commit = origin['Hash']
-            _vcs = origin['VCS']
-            return (GoImport(_root, _vcs, _root_url.geturl(), None), _commit)
-
-        return None
-
-    def __resolve_repository(self, modulepath):
-        """
-        Resolves src uri from go module-path
-        """
-        repodata = self.__resolve_repository_static(modulepath)
-        if not repodata or not repodata.url:
-            repodata = self.__resolve_repository_dynamic(modulepath)
-            if not repodata or not repodata.url:
-                logger.error(
-                    "Could not resolve repository for module path '%s'" % modulepath)
-                # There is no way to recover from this
-                sys.exit(14)
-        if repodata:
-            logger.debug(1, "Resolved download path for import '%s' => %s" % (
-                modulepath, repodata.url))
-        return repodata
-
-    def __split_path_version(self, path):
-        i = len(path)
-        dot = False
-        for j in range(i, 0, -1):
-            if path[j - 1] < '0' or path[j - 1] > '9':
-                break
-            if path[j - 1] == '.':
-                dot = True
-                break
-            i = j - 1
-
-        if i <= 1 or i == len(
-                path) or path[i - 1] != 'v' or path[i - 2] != '/':
-            return path, "", True
-
-        prefix, pathMajor = path[:i - 2], path[i - 2:]
-        if dot or len(
-                pathMajor) <= 2 or pathMajor[2] == '0' or pathMajor == "/v1":
-            return path, "", False
-
-        return prefix, pathMajor, True
-
-    def __get_path_major(self, pathMajor):
-        if not pathMajor:
-            return ""
-
-        if pathMajor[0] != '/' and pathMajor[0] != '.':
-            logger.error(
-                "pathMajor suffix %s passed to PathMajorPrefix lacks separator", pathMajor)
-
-        if pathMajor.startswith(".v") and pathMajor.endswith("-unstable"):
-            pathMajor = pathMajor[:len("-unstable") - 2]
-
-        return pathMajor[1:]
-
-    def __build_coderepo(self, repo, path):
-        codedir = ""
-        pathprefix, pathMajor, _ = self.__split_path_version(path)
-        if repo.root == path:
-            pathprefix = path
-        elif path.startswith(repo.root):
-            codedir = pathprefix[len(repo.root):].strip('/')
-
-        pseudoMajor = self.__get_path_major(pathMajor)
-
-        logger.debug("root='%s', codedir='%s', prefix='%s', pathMajor='%s', pseudoMajor='%s'",
-                     repo.root, codedir, pathprefix, pathMajor, pseudoMajor)
-
-        return CodeRepo(path, repo.root, codedir,
-                        pathMajor, pathprefix, pseudoMajor)
-
-    def __resolve_version(self, repo, path, version):
-        hash = None
-        coderoot = self.__build_coderepo(repo, path)
-
-        def vcs_fetch_all():
-            tmpdir = tempfile.mkdtemp()
-            clone_cmd = "%s clone --bare %s %s" % ('git', repo.url, tmpdir)
-            bb.process.run(clone_cmd)
-            log_cmd = "git log --all --pretty='%H %d' --decorate=short"
-            output, _ = bb.process.run(
-                log_cmd, shell=True, stderr=subprocess.PIPE, cwd=tmpdir)
-            bb.utils.prunedir(tmpdir)
-            return output.strip().split('\n')
-
-        def vcs_fetch_remote(tag):
-            # add * to grab ^{}
-            refs = {}
-            ls_remote_cmd = "git ls-remote -q --tags {} {}*".format(
-                repo.url, tag)
-            output, _ = bb.process.run(ls_remote_cmd)
-            output = output.strip().split('\n')
-            for line in output:
-                f = line.split(maxsplit=1)
-                if len(f) != 2:
-                    continue
-
-                for prefix in ["HEAD", "refs/heads/", "refs/tags/"]:
-                    if f[1].startswith(prefix):
-                        refs[f[1][len(prefix):]] = f[0]
-
-            for key, hash in refs.items():
-                if key.endswith(r"^{}"):
-                    refs[key.strip(r"^{}")] = hash
-
-            return refs[tag]
-
-        m_pseudo_semver = re_pseudo_semver.match(version)
-
-        if m_pseudo_semver:
-            remote_refs = vcs_fetch_all()
-            short_commit = m_pseudo_semver.group('commithash')
-            for l in remote_refs:
-                r = l.split(maxsplit=1)
-                sha1 = r[0] if len(r) else None
-                if not sha1:
-                    logger.error(
-                        "Ups: could not resolve abbref commit for %s" % short_commit)
-
-                elif sha1.startswith(short_commit):
-                    hash = sha1
-                    break
-        else:
-            m_semver = re_semver.match(version)
-            if m_semver:
-
-                def get_sha1_remote(re):
-                    rsha1 = None
-                    for line in remote_refs:
-                        # Split lines of the following format:
-                        # 22e90d9b964610628c10f673ca5f85b8c2a2ca9a  (tag: sometag)
-                        lineparts = line.split(maxsplit=1)
-                        sha1 = lineparts[0] if len(lineparts) else None
-                        refstring = lineparts[1] if len(
-                            lineparts) == 2 else None
-                        if refstring:
-                            # Normalize tag string and split in case of multiple
-                            # regs e.g. (tag: speech/v1.10.0, tag: orchestration/v1.5.0 ...)
-                            refs = refstring.strip('(), ').split(',')
-                            for ref in refs:
-                                if re.match(ref.strip()):
-                                    rsha1 = sha1
-                    return rsha1
-
-                semver = "v" + m_semver.group('major') + "."\
-                             + m_semver.group('minor') + "."\
-                             + m_semver.group('patch') \
-                             + (("-" + m_semver.group('prerelease'))
-                                if m_semver.group('prerelease') else "")
-
-                tag = os.path.join(
-                    coderoot.codeDir, semver) if coderoot.codeDir else semver
-
-                # probe tag using 'ls-remote', which is faster than fetching
-                # complete history
-                hash = vcs_fetch_remote(tag)
-                if not hash:
-                    # backup: fetch complete history
-                    remote_refs = vcs_fetch_all()
-                    hash = get_sha1_remote(
-                        re.compile(fr"(tag:|HEAD ->) ({tag})"))
-
-                logger.debug(
-                    "Resolving commit for tag '%s' -> '%s'", tag, hash)
-        return hash
-
-    def __generate_srcuri_inline_fcn(self, path, version, replaces=None):
-        """Generate SRC_URI functions for go imports"""
-
-        logger.info("Resolving repository for module %s", path)
-        # First try to resolve repo and commit from golang proxy
-        # Most info is already there and we don't have to go through the
-        # repository or even perform the version resolve magic
-        golang_proxy_info = self.__resolve_from_golang_proxy(path, version)
-        if golang_proxy_info:
-            repo = golang_proxy_info[0]
-            commit = golang_proxy_info[1]
-        else:
-            # Fallback
-            # Resolve repository by 'hand'
-            repo = self.__resolve_repository(path)
-            commit = self.__resolve_version(repo, path, version)
-
-        url = urllib.parse.urlparse(repo.url)
-        repo_url = url.netloc + url.path
-
-        coderoot = self.__build_coderepo(repo, path)
-
-        inline_fcn = "${@go_src_uri("
-        inline_fcn += f"'{repo_url}','{version}'"
-        if repo_url != path:
-            inline_fcn += f",path='{path}'"
-        if coderoot.codeDir:
-            inline_fcn += f",subdir='{coderoot.codeDir}'"
-        if repo.vcs != 'git':
-            inline_fcn += f",vcs='{repo.vcs}'"
-        if replaces:
-            inline_fcn += f",replaces='{replaces}'"
-        if coderoot.pathMajor:
-            inline_fcn += f",pathmajor='{coderoot.pathMajor}'"
-        inline_fcn += ")}"
-
-        return inline_fcn, commit
-
-    def __go_handle_dependencies(self, go_mod, srctree, localfilesdir, extravalues, d):
-
-        import re
-        src_uris = []
-        src_revs = []
-
-        def generate_src_rev(path, version, commithash):
-            src_rev = f"# {path}@{version} => {commithash}\n"
-            # Ups...maybe someone manipulated the source repository and the
-            # version or commit could not be resolved. This is a sign of
-            # a) the supply chain was manipulated (bad)
-            # b) the implementation for the version resolving didn't work
-            #    anymore (less bad)
-            if not commithash:
-                src_rev += f"#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"
-                src_rev += f"#!!!   Could not resolve version  !!!\n"
-                src_rev += f"#!!! Possible supply chain attack !!!\n"
-                src_rev += f"#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"
-            src_rev += f"SRCREV_{path.replace('/', '.')} = \"{commithash}\""
-
-            return src_rev
-
-        # we first go over replacement list, because we are essentialy
-        # interested only in the replaced path
-        if go_mod['Replace']:
-            for replacement in go_mod['Replace']:
-                oldpath = replacement['Old']['Path']
-                path = replacement['New']['Path']
-                version = ''
-                if 'Version' in replacement['New']:
-                    version = replacement['New']['Version']
-
-                if os.path.exists(os.path.join(srctree, path)):
-                    # the module refers to the local path, remove it from requirement list
-                    # because it's a local module
-                    go_mod['Require'][:] = [v for v in go_mod['Require'] if v.get('Path') != oldpath]
-                else:
-                    # Replace the path and the version, so we don't iterate replacement list anymore
-                    for require in go_mod['Require']:
-                        if require['Path'] == oldpath:
-                            require.update({'Path': path, 'Version': version})
-                            break
-
-        for require in go_mod['Require']:
-            path = require['Path']
-            version = require['Version']
-
-            inline_fcn, commithash = self.__generate_srcuri_inline_fcn(
-                path, version)
-            src_uris.append(inline_fcn)
-            src_revs.append(generate_src_rev(path, version, commithash))
-
-        # strip version part from module URL /vXX
-        baseurl = re.sub(r'/v(\d+)$', '', go_mod['Module']['Path'])
-        pn, _ = determine_from_url(baseurl)
-        go_mods_basename = "%s-modules.inc" % pn
-
-        go_mods_filename = os.path.join(localfilesdir, go_mods_basename)
-        with open(go_mods_filename, "w") as f:
-            # We introduce this indirection to make the tests a little easier
-            f.write("SRC_URI += \"${GO_DEPENDENCIES_SRC_URI}\"\n")
-            f.write("GO_DEPENDENCIES_SRC_URI = \"\\\n")
-            for uri in src_uris:
-                f.write("    " + uri + " \\\n")
-            f.write("\"\n\n")
-            for rev in src_revs:
-                f.write(rev + "\n")
-
-        extravalues['extrafiles'][go_mods_basename] = go_mods_filename
-
-    def __go_run_cmd(self, cmd, cwd, d):
-        return bb.process.run(cmd, env=dict(os.environ, PATH=d.getVar('PATH')),
-                              shell=True, cwd=cwd)
-
-    def __go_native_version(self, d):
-        stdout, _ = self.__go_run_cmd("go version", None, d)
-        m = re.match(r".*\sgo((\d+).(\d+).(\d+))\s([\w\/]*)", stdout)
-        major = int(m.group(2))
-        minor = int(m.group(3))
-        patch = int(m.group(4))
-
-        return major, minor, patch
-
-    def __go_mod_patch(self, srctree, localfilesdir, extravalues, d):
-
-        patchfilename = "go.mod.patch"
-        go_native_version_major, go_native_version_minor, _ = self.__go_native_version(
-            d)
-        self.__go_run_cmd("go mod tidy -go=%d.%d" %
-                          (go_native_version_major, go_native_version_minor), srctree, d)
-        stdout, _ = self.__go_run_cmd("go mod edit -json", srctree, d)
-
-        # Create patch in order to upgrade go version
-        self.__go_run_cmd("git diff go.mod > %s" % (patchfilename), srctree, d)
-        # Restore original state
-        self.__go_run_cmd("git checkout HEAD go.mod go.sum", srctree, d)
-
-        go_mod = json.loads(stdout)
-        tmpfile = os.path.join(localfilesdir, patchfilename)
-        shutil.move(os.path.join(srctree, patchfilename), tmpfile)
-
-        extravalues['extrafiles'][patchfilename] = tmpfile
-
-        return go_mod, patchfilename
-
-    def __go_mod_vendor(self, go_mod, srctree, localfilesdir, extravalues, d):
-        # Perform vendoring to retrieve the correct modules.txt
-        tmp_vendor_dir = tempfile.mkdtemp()
-
-        # -v causes to go to print modules.txt to stderr
-        _, stderr = self.__go_run_cmd(
-            "go mod vendor -v -o %s" % (tmp_vendor_dir), srctree, d)
-
-        modules_txt_basename = "modules.txt"
-        modules_txt_filename = os.path.join(localfilesdir, modules_txt_basename)
-        with open(modules_txt_filename, "w") as f:
-            f.write(stderr)
-
-        extravalues['extrafiles'][modules_txt_basename] = modules_txt_filename
-
-        licenses = []
-        lic_files_chksum = []
-        licvalues = find_licenses(tmp_vendor_dir, d)
-        shutil.rmtree(tmp_vendor_dir)
-
-        if licvalues:
-            for licvalue in licvalues:
-                license = licvalue[0]
-                lics = tidy_licenses(fixup_license(license))
-                lics = [lic for lic in lics if lic not in licenses]
-                if len(lics):
-                    licenses.extend(lics)
-                lic_files_chksum.append(
-                    'file://src/${GO_IMPORT}/vendor/%s;md5=%s' % (licvalue[1], licvalue[2]))
-
-        # strip version part from module URL /vXX
-        baseurl = re.sub(r'/v(\d+)$', '', go_mod['Module']['Path'])
-        pn, _ = determine_from_url(baseurl)
-        licenses_basename = "%s-licenses.inc" % pn
-
-        licenses_filename = os.path.join(localfilesdir, licenses_basename)
-        with open(licenses_filename, "w") as f:
-            f.write("GO_MOD_LICENSES = \"%s\"\n\n" %
-                    ' & '.join(sorted(licenses, key=str.casefold)))
-            # We introduce this indirection to make the tests a little easier
-            f.write("LIC_FILES_CHKSUM  += \"${VENDORED_LIC_FILES_CHKSUM}\"\n")
-            f.write("VENDORED_LIC_FILES_CHKSUM = \"\\\n")
-            for lic in lic_files_chksum:
-                f.write("    " + lic + " \\\n")
-            f.write("\"\n")
-
-        extravalues['extrafiles'][licenses_basename] = licenses_filename
-
     def process(self, srctree, classes, lines_before,
                 lines_after, handled, extravalues):
 
@@ -665,63 +74,52 @@ class GoRecipeHandler(RecipeHandler):
         if not files:
             return False
 
-        d = bb.data.createCopy(tinfoil.config_data)
         go_bindir = self.__ensure_go()
         if not go_bindir:
             sys.exit(14)
 
-        d.prependVar('PATH', '%s:' % go_bindir)
         handled.append('buildsystem')
-        classes.append("go-vendor")
+        classes.append("go-mod")
 
-        stdout, _ = self.__go_run_cmd("go mod edit -json", srctree, d)
+        # Use go-mod-update-modules to set the full SRC_URI and LICENSE
+        classes.append("go-mod-update-modules")
+        extravalues["run_tasks"] = "update_modules"
 
-        go_mod = json.loads(stdout)
-        go_import = go_mod['Module']['Path']
-        go_version_match = re.match("([0-9]+).([0-9]+)", go_mod['Go'])
-        go_version_major = int(go_version_match.group(1))
-        go_version_minor = int(go_version_match.group(2))
-        src_uris = []
+        with tempfile.TemporaryDirectory(prefix="go-mod-") as tmp_mod_dir:
+            env = dict(os.environ)
+            env["PATH"] += f":{go_bindir}"
+            env['GOMODCACHE'] = tmp_mod_dir
 
-        localfilesdir = tempfile.mkdtemp(prefix='recipetool-go-')
-        extravalues.setdefault('extrafiles', {})
+            stdout = subprocess.check_output(["go", "mod", "edit", "-json"], cwd=srctree, env=env, text=True)
+            go_mod = json.loads(stdout)
+            go_import = re.sub(r'/v([0-9]+)$', '', go_mod['Module']['Path'])
 
-        # Use an explicit name determined from the module name because it
-        # might differ from the actual URL for replaced modules
-        # strip version part from module URL /vXX
-        baseurl = re.sub(r'/v(\d+)$', '', go_mod['Module']['Path'])
-        pn, _ = determine_from_url(baseurl)
+            localfilesdir = tempfile.mkdtemp(prefix='recipetool-go-')
+            extravalues.setdefault('extrafiles', {})
 
-        # go.mod files with version < 1.17 may not include all indirect
-        # dependencies. Thus, we have to upgrade the go version.
-        if go_version_major == 1 and go_version_minor < 17:
-            logger.warning(
-                "go.mod files generated by Go < 1.17 might have incomplete indirect dependencies.")
-            go_mod, patchfilename = self.__go_mod_patch(srctree, localfilesdir,
-                                                        extravalues, d)
-            src_uris.append(
-                "file://%s;patchdir=src/${GO_IMPORT}" % (patchfilename))
+            # Write the stub ${BPN}-licenses.inc and ${BPN}-go-mods.inc files
+            basename = "{pn}-licenses.inc"
+            filename = os.path.join(localfilesdir, basename)
+            with open(filename, "w") as f:
+                f.write("# FROM RECIPETOOL\n")
+            extravalues['extrafiles'][f"../{basename}"] = filename
 
-        # Check whether the module is vendored. If so, we have nothing to do.
-        # Otherwise we gather all dependencies and add them to the recipe
-        if not os.path.exists(os.path.join(srctree, "vendor")):
+            basename = "{pn}-go-mods.inc"
+            filename = os.path.join(localfilesdir, basename)
+            with open(filename, "w") as f:
+                f.write("# FROM RECIPETOOL\n")
+            extravalues['extrafiles'][f"../{basename}"] = filename
 
-            # Write additional $BPN-modules.inc file
-            self.__go_mod_vendor(go_mod, srctree, localfilesdir, extravalues, d)
-            lines_before.append("LICENSE += \" & ${GO_MOD_LICENSES}\"")
-            lines_before.append("require %s-licenses.inc" % (pn))
+            # Do generic license handling
+            d = bb.data.createCopy(tinfoil.config_data)
+            handle_license_vars(srctree, lines_before, handled, extravalues, d)
+            self.__rewrite_lic_vars(lines_before)
 
-            self.__rewrite_src_uri(lines_before, ["file://modules.txt"])
+            self.__rewrite_src_uri(lines_before)
 
-            self.__go_handle_dependencies(go_mod, srctree, localfilesdir, extravalues, d)
-            lines_before.append("require %s-modules.inc" % (pn))
-
-        # Do generic license handling
-        handle_license_vars(srctree, lines_before, handled, extravalues, d)
-        self.__rewrite_lic_uri(lines_before)
-
-        lines_before.append("GO_IMPORT = \"{}\"".format(baseurl))
-        lines_before.append("SRCREV_FORMAT = \"${BPN}\"")
+            lines_before.append('require ${BPN}-licenses.inc')
+            lines_before.append('require ${BPN}-go-mods.inc')
+            lines_before.append(f'GO_IMPORT = "{go_import}"')
 
     def __update_lines_before(self, updated, newlines, lines_before):
         if updated:
@@ -733,9 +131,9 @@ class GoRecipeHandler(RecipeHandler):
                 lines_before.append(line)
         return updated
 
-    def __rewrite_lic_uri(self, lines_before):
-
+    def __rewrite_lic_vars(self, lines_before):
         def varfunc(varname, origvalue, op, newlines):
+            import urllib.parse
             if varname == 'LIC_FILES_CHKSUM':
                 new_licenses = []
                 licenses = origvalue.split('\\')
@@ -760,12 +158,11 @@ class GoRecipeHandler(RecipeHandler):
             lines_before, ['LIC_FILES_CHKSUM'], varfunc)
         return self.__update_lines_before(updated, newlines, lines_before)
 
-    def __rewrite_src_uri(self, lines_before, additional_uris = []):
+    def __rewrite_src_uri(self, lines_before):
 
         def varfunc(varname, origvalue, op, newlines):
             if varname == 'SRC_URI':
-                src_uri = ["git://${GO_IMPORT};destsuffix=git/src/${GO_IMPORT};nobranch=1;name=${BPN};protocol=https"]
-                src_uri.extend(additional_uris)
+                src_uri = ['git://${GO_IMPORT};protocol=https;nobranch=1;destsuffix=${GO_SRCURI_DESTSUFFIX}']
                 return src_uri, None, -1, True
             return origvalue, None, 0, True
 
diff --git a/scripts/test-remote-image b/scripts/test-remote-image
index d209d22854..1d018992b0 100755
--- a/scripts/test-remote-image
+++ b/scripts/test-remote-image
@@ -152,8 +152,7 @@ class AutoTargetProfile(BaseTargetProfile):
         return controller
 
     def set_kernel_file(self):
-        postconfig = "QA_GET_MACHINE = \"${MACHINE}\""
-        machine = get_bb_var('QA_GET_MACHINE', postconfig=postconfig)
+        machine = get_bb_var('MACHINE')
         self.kernel_file = self.kernel_type + '-' + machine + '.bin'
 
     def set_rootfs_file(self):
@@ -215,13 +214,11 @@ class PublicAB(BaseRepoProfile):
     def get_repo_path(self):
         path = '/machines/'
 
-        postconfig = "QA_GET_MACHINE = \"${MACHINE}\""
-        machine = get_bb_var('QA_GET_MACHINE', postconfig=postconfig)
+        machine = get_bb_var('MACHINE')
         if 'qemu' in machine:
             path += 'qemu/'
 
-        postconfig = "QA_GET_DISTRO = \"${DISTRO}\""
-        distro = get_bb_var('QA_GET_DISTRO', postconfig=postconfig)
+        distro = get_bb_var('DISTRO')
         path += distro.replace('poky', machine) + '/'
         return path
 
diff --git a/scripts/wic b/scripts/wic
index 06e0b48db0..9137208f5e 100755
--- a/scripts/wic
+++ b/scripts/wic
@@ -237,6 +237,13 @@ def wic_ls_subcommand(args, usage_str):
     Command-line handling for list content of images.
     The real work is done by engine.wic_ls()
     """
+
+    if args.image_name:
+        BB_VARS.default_image = args.image_name
+
+    if args.vars_dir:
+        BB_VARS.vars_dir = args.vars_dir
+
     engine.wic_ls(args, args.native_sysroot)
 
 def wic_cp_subcommand(args, usage_str):
@@ -244,6 +251,12 @@ def wic_cp_subcommand(args, usage_str):
     Command-line handling for copying files/dirs to images.
     The real work is done by engine.wic_cp()
     """
+    if args.image_name:
+        BB_VARS.default_image = args.image_name
+
+    if args.vars_dir:
+        BB_VARS.vars_dir = args.vars_dir
+
     engine.wic_cp(args, args.native_sysroot)
 
 def wic_rm_subcommand(args, usage_str):
@@ -251,6 +264,12 @@ def wic_rm_subcommand(args, usage_str):
     Command-line handling for removing files/dirs from images.
     The real work is done by engine.wic_rm()
     """
+    if args.image_name:
+        BB_VARS.default_image = args.image_name
+
+    if args.vars_dir:
+        BB_VARS.vars_dir = args.vars_dir
+
     engine.wic_rm(args, args.native_sysroot)
 
 def wic_write_subcommand(args, usage_str):
@@ -258,6 +277,12 @@ def wic_write_subcommand(args, usage_str):
     Command-line handling for writing images.
     The real work is done by engine.wic_write()
     """
+    if args.image_name:
+        BB_VARS.default_image = args.image_name
+
+    if args.vars_dir:
+        BB_VARS.vars_dir = args.vars_dir
+
     engine.wic_write(args, args.native_sysroot)
 
 def wic_help_subcommand(args, usage_str):
@@ -390,6 +415,12 @@ def wic_init_parser_ls(subparser):
                         help="image spec: <image>[:<vfat partition>[<path>]]")
     subparser.add_argument("-n", "--native-sysroot",
                         help="path to the native sysroot containing the tools")
+    subparser.add_argument("-e", "--image-name", dest="image_name",
+                      help="name of the image to use the artifacts from "
+                           "e.g. core-image-sato")
+    subparser.add_argument("-v", "--vars", dest='vars_dir',
+                      help="directory with <image>.env files that store "
+                           "bitbake variables")
 
 def imgpathtype(arg):
     img = imgtype(arg)
@@ -404,6 +435,12 @@ def wic_init_parser_cp(subparser):
                         help="image spec: <image>:<vfat partition>[<path>] or <file>")
     subparser.add_argument("-n", "--native-sysroot",
                         help="path to the native sysroot containing the tools")
+    subparser.add_argument("-e", "--image-name", dest="image_name",
+                      help="name of the image to use the artifacts from "
+                           "e.g. core-image-sato")
+    subparser.add_argument("-v", "--vars", dest='vars_dir',
+                      help="directory with <image>.env files that store "
+                           "bitbake variables")
 
 def wic_init_parser_rm(subparser):
     subparser.add_argument("path", type=imgpathtype,
@@ -413,6 +450,12 @@ def wic_init_parser_rm(subparser):
     subparser.add_argument("-r", dest="recursive_delete", action="store_true", default=False,
                         help="remove directories and their contents recursively, "
                         " this only applies to ext* partition")
+    subparser.add_argument("-e", "--image-name", dest="image_name",
+                      help="name of the image to use the artifacts from "
+                           "e.g. core-image-sato")
+    subparser.add_argument("-v", "--vars", dest='vars_dir',
+                      help="directory with <image>.env files that store "
+                           "bitbake variables")
 
 def expandtype(rules):
     """
@@ -454,6 +497,12 @@ def wic_init_parser_write(subparser):
                         help="expand rules: auto or <partition>:<size>[,<partition>:<size>]")
     subparser.add_argument("-n", "--native-sysroot",
                         help="path to the native sysroot containing the tools")
+    subparser.add_argument("--image-name", dest="image_name",
+                      help="name of the image to use the artifacts from "
+                           "e.g. core-image-sato")
+    subparser.add_argument("-v", "--vars", dest='vars_dir',
+                      help="directory with <image>.env files that store "
+                           "bitbake variables")
 
 def wic_init_parser_help(subparser):
     helpparsers = subparser.add_subparsers(dest='help_topic', help=hlp.wic_usage)