summaryrefslogtreecommitdiffstats
path: root/meta/classes/create-spdx.bbclass
Commit message (Collapse)AuthorAgeFilesLines
* classes: create-spdx: Move to version specific classJoshua Watt2022-11-111-1020/+3
| | | | | | | | | | | | | In expectation of SPDX 3.0 support, move the create-spdx.bbclass -> create-spdx-2.2.bbclass. The create-spdx.bbclass class still exists and can be used if a user doesn't care about which specific version of SPDX they get. (From OE-Core rev: 9ec01fe3e59be66331c14ab5391ecb0b6f140c22) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx.bbclass: remove unused SPDX_INCLUDE_PACKAGEDMichael Opdenacker2022-10-291-2/+0
| | | | | | | | | | [YOCTO #14948] (From OE-Core rev: 89f1abd5e00807cf179ddf658f74d48119523b0c) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Remove ";name=..." for downloadLocationKeiya Nobuta2022-10-261-0/+1
| | | | | | | | (From OE-Core rev: bbecab53d1b27f3bb8c5882cb0ec39b04ef300a3) Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: handle links to inaccessible locationsPeter Marko2022-08-141-1/+1
| | | | | | | | | | | | When a link is pointing to location inaccessible to build user (e.g. "/root/something"), filepath.is_file() throws "PermissionError: [Errno 13] Permission denied". Fix this by first checking if it is a link. (From OE-Core rev: e105befbe4ee0d85e94c2048a744f0373e2dbcdf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Add copyright statements to files without oneRichard Purdie2022-08-121-0/+2
| | | | | | | | | Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: ignore packing control files from ipk and debJose Quaresma2022-08-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise spdx can have references for data that is not packed in the package delivered because this contol data is temporarly and only exist while the package is been write. During do_package_write_ipk task in do_package_ipk the control files is cleaned up at the end. This can create a race condiction when the do_create_spdx task runs the add_package_files function and these files is been deleted at same time in the task do_package_write_ipk. ERROR: alsa-topology-conf-1.2.5.1-r0 do_create_spdx: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:do_create_spdx(d) 0003: File: '/srv/oe/build/conf/../../layers/openembedded-core/meta/classes/create-spdx.bbclass', lineno: 567, function: do_create_spdx 0563: package_doc.add_relationship(package_doc, "DESCRIBES", spdx_package) 0564: 0565: package_archive = deploy_dir_spdx / "packages" / (package_doc.name + ".tar.zst") 0566: with optional_tarfile(package_archive, archive_packaged) as archive: *** 0567: package_files = add_package_files( 0568: d, 0569: package_doc, 0570: spdx_package, 0571: pkgdest / package, File: '/srv/oe/build/conf/../../layers/openembedded-core/meta/classes/create-spdx.bbclass', lineno: 234, function: add_package_files 0230: info.mtime = source_date_epoch 0231: 0232: archive.addfile(info, f) 0233: *** 0234: sha1 = bb.utils.sha1_file(filepath) 0235: sha1s.append(sha1) 0236: spdx_file.checksums.append(oe.spdx.SPDXChecksum( 0237: algorithm="SHA1", 0238: checksumValue=sha1, File: '/srv/oe/bitbake/lib/bb/utils.py', lineno: 559, function: sha1_file 0555: """ 0556: Return the hex string representation of the SHA1 checksum of the filename 0557: """ 0558: import hashlib *** 0559: return _hasher(hashlib.sha1(), filename) 0560: 0561:def sha384_file(filename): 0562: """ 0563: Return the hex string representation of the SHA384 checksum of the filename File: '/srv/oe/bitbake/lib/bb/utils.py', lineno: 528, function: _hasher 0524: 0525:def _hasher(method, filename): 0526: import mmap 0527: *** 0528: with open(filename, "rb") as f: 0529: try: 0530: with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm: 0531: for chunk in iter(lambda: mm.read(8192), b''): 0532: method.update(chunk) Exception: FileNotFoundError: [Errno 2] No such file or directory: '/srv/oe/build/tmp-lmp/work/all-lmp-linux/alsa-topology-conf/1.2.5.1-r0/packages-split/alsa-topology-conf/CONTROL/control' ERROR: Logfile of failure stored in: /srv/oe/build/tmp-lmp/work/all-lmp-linux/alsa-topology-conf/1.2.5.1-r0/temp/log.do_create_spdx.998864 INFO: recipe alsa-topology-conf-1.2.5.1-r0: task do_create_spdx: Failed (From OE-Core rev: 0bfe403f46fd568910a727982c3ff528e3d5c8bc) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Fix supplier fieldMihai Lindner2022-07-281-3/+3
| | | | | | | | | | | The correct field name is "supplier" according to SPDX schema. The "supplier" field translates to "PackageSupplier", but that's for tag-value format. (From OE-Core rev: ca8db0e0a2860ac1e3f537471fa71b43c3be0a58) Signed-off-by: Mihai Lindner <mihai.lindner@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add SPDX_PRETTY optionJoshua Watt2022-06-151-6/+16
| | | | | | | | | | | Adds an option to make the SPDX more human-readable (at the expense of a larger files) (From OE-Core rev: 4799594b26f77ed259dc661bf077519b338390c8) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: delete virtual/kernel dependency to fix FreeRTOS buildDavide Gardenal2022-04-261-2/+0
| | | | | | | | | | | | | | | When building FreeRTOS this dependency generates an error because bitbake cannot find any provider for "virtual/kernel". >From a dependency analysis the task is executed independently from this so it can be safely removed. This patch has been discussed in this ML thread: https://lists.openembedded.org/g/openembedded-core/topic/90602531 (From OE-Core rev: 1c02b768a71ec88bfe1cc0c4443683de8b66056e) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: fix error when symlink cannot be createdDavide Gardenal2022-04-191-6/+4
| | | | | | | | | | | | | | | | If IMAGE_NAME and IMAGE_LINK_NAME are the same an exception is raised in image_combine_spdx because it cannot create a symlink with the same exact path of the original file. In that case there is no point in creating a link in the first place. Refactor image_combine_spdx to avoid code duplication (From OE-Core rev: 88f76bba705007a7fcda506c79f743060d8f2e52) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Avoid regex warning by quoting correctlyRichard Purdie2022-03-291-1/+1
| | | | | | | | | | | create-spdx.bbclass:43: DeprecationWarning: invalid escape sequence \W lic_regex = re.compile(b'^\W*SPDX-License-Identifier:\s*([ \w\d.()+-]+?)(?:\s+\W*)?$', re.MULTILINE) (From OE-Core rev: 5dfb26d45f69c4d5dc4b6fcef084b830ef9dbf4c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx.bbclass: Simplify extraction of license textPeter Kjellerstedt2022-03-241-15/+10
| | | | | | | | | | | | | There is no reason to first search for all available licenses using avail_licenses() and then search through the same paths looking for the actual license texts. Just look for the license texts directly instead. (From OE-Core rev: 59eb405a80f0a0acf9b754b2b78399bacb0094ae) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Use function rather than AVAILABLE_LICENSESRichard Purdie2022-03-161-4/+4
| | | | | | | | | | We can directly call the function rather than using the variable indirection. As this is the last user of the variable, it then allows removal of it in a followup patch. (From OE-Core rev: 3ed84651b2f4eff9409bfecba2a080e244124880) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx.bbclass: Remove an unnecessary path from do_create_spdx[dirs]Peter Kjellerstedt2022-03-151-1/+1
| | | | | | | | | | There is no reason to include a path in foo[dirs] if it is also in foo[cleandirs] (except if it is the last path in foo[dirs]). (From OE-Core rev: cb30a6cfa58072bbf5f5def36103fbcac920e168) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: add support for SDKsAndres Beltran2022-02-251-28/+60
| | | | | | | | | | Currently, SPDX SBOMs are only created for images. Add support for SDKs. (From OE-Core rev: c3acbb936a339636153903daf127eec9f36de79b) Signed-off-by: Andres Beltran <abeltran@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Get SPDX-License-Identifier from sourceSaul Wold2022-02-121-0/+22
| | | | | | | | | | | | | | | This patch will read the begining of source files and try to find the SPDX-License-Identifier to populate the licenseInfoInFiles field for each source file. This does not populate licenseConcluded at this time, nor rolls it up to package level. We read as binary file since some source code seem to have some binary characters, the license is then converted to ascii strings. (From OE-Core rev: 51e5f328635eb022143178c3169bae719509697a) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Remove unnecessary packageJoshua Watt2022-02-071-2/+0
| | | | | | | | | A superfluous package was being created, but it was never used. (From OE-Core rev: ddfa61f691fc51c1968e8f1ff43f69dccd1632ee) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add packageSupplier fieldJoshua Watt2022-02-071-0/+8
| | | | | | | | | | | | Per NIST SBoM recommendations, include the Package Supplier field for all SPDX packages that are created. This field should generally be set to the person or organization that is performing the build, since they would be considered the "supplier" of the SPDX packages. (From OE-Core rev: ca48349501e0ec93dc2448d064e1567fca390bf5) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Add kernel work-shared sourceSaul Wold2022-01-131-1/+5
| | | | | | | | | | | Since the kernel source is stored in work-shared, we need to add it to the search path so the kernel and kernel-modules source code can be found correctly. (From OE-Core rev: 93a94890b9f2679945e96973937b209aa12302b7) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: handle if IMAGE_LINK_NAME is emptyPaul Eggleton2022-01-111-4/+6
| | | | | | | | | | If IMAGE_LINK_NAME is set to "" (supported in other classes) then skip creating symlinks for the spdx manifest files. (From OE-Core rev: c2d5e2dbbba78d8d7036f6418360b2e84bcdc169) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Fix key errors in do_create_runtime_spdxAndres Beltran2021-11-211-0/+3
| | | | | | | | | | | Currently, the do_create_runtime_spdx task fails with a Key Error if a dependency is not contained in the package providers dictionary. Add a check before using "dep" as a key in "providers". (From OE-Core rev: 140ce5ef5e8f10251091660e3ef76f315f409076) Signed-off-by: Andres Beltran <abeltran@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Protect against None from LICENSE_PATHSaul Wold2021-11-211-2/+1
| | | | | | | | | If LICENSE_PATH is not set, then the split() will fail on a NoneType. (From OE-Core rev: d6260decae6d2654f6e058f12ca02d582a8ef5a4) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create_spdx: ensure is_work_shared() is uniqueSaul Wold2021-11-211-7/+5
| | | | | | | | | | | | There is a function with the same name is_work_shared() in the archiver class this causes a conflict when both classes are included. Use work-shared as the check in WORKDIR to allow for other packages beyond the kernel and gcc that use a common shared-work source directory. (From OE-Core rev: 18eab77ee65c73b17225e69c7ba446ab1c69fa92) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Set the Organization field via a variableAndres Beltran2021-11-051-4/+6
| | | | | | | | | | | Currently, the "Organization" field for SBOMs is hard-coded in create-spdx. Create a new variable SPDX_ORG to make this field more generic. (From OE-Core rev: f239814f3f5d9bd54de54b0f2a5081067336e32b) Signed-off-by: Andres Beltran <abeltran@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: cross recipes are native alsoSaul Wold2021-10-281-2/+2
| | | | | | | | | | Recipes that inherit cross should also be categorized as isNative (From OE-Core rev: ee113e3894deb1cfb18622085a3fe0600e1ef01d) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: add create_annotation functionSaul Wold2021-10-281-6/+12
| | | | | | | | | | This allows code reuse and future usage with relationship annotations (From OE-Core rev: 1f8fdb7dc9d02d0ee3c42674ca16e03f0ec18cba) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Use SPDXAnnotation to track native recipesSaul Wold2021-09-281-2/+19
| | | | | | | | | | | | | | | Create a small function that checks for 'isNative' as part of an Annotation When the collect_dep_sources() runs, it collects sources from both native and non-native recipes. Later when the GENERATED_FROM matching occurs it may find the file (via checksum) from the native recipe since it's the same checksum as the target file. The that are generated DocumentRefs point to the native recipe rather than the target recipe DocumentRef. (From OE-Core rev: ba5ec03986a0bce8dccbc381fd34e44b8a135e66) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx.bbclass: Search all license directories for licensesPeter Kjellerstedt2021-09-161-5/+8
| | | | | | | | | | | | | | Before, even if the code was seemingly written to search through all licenses in ${COMMON_LICENSE_DIR} and ${LICENSE_PATH}, it would actually bail out after only searching ${COMMON_LICENSE_DIR} due to the exception handling. Also refrain from using f-strings. (From OE-Core rev: f58d54b31a1ddb4e60eb07365bfb7dfe78ed56af) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: handle CLOSED licenseRoss Burton2021-09-101-0/+3
| | | | | | | | | | | The special CLOSED license means that this is closed source code with no other licensing assertions. It's not a generic license in oe-core, and not a SPDX license, so transform it to NONE explicitly. (From OE-Core rev: b71bfba1b5076ad1b9a10c08ef0e3393ccbed92a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: remove trailing commaSaul Wold2021-09-081-1/+1
| | | | | | | | | | | The trailing comma turns ref_id into an object instead of a string when added to the relationship table. (From OE-Core rev: ec20e1a0e0ba61a7615b361bfc9d9dc58a91f9b3) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: don't duplicate license texts in each packageRoss Burton2021-09-041-11/+14
| | | | | | | | | | | Instead of putting the full license text for non-SPDX licenses into the recipe and every package, use links to the recipe from the packages if possible. (From OE-Core rev: 9220d35dc9071ebbe991117af8261ad99f321bb3) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: embed unknown license textsRoss Burton2021-09-041-14/+37
| | | | | | | | | | For licenses which are not known to SPDX, find and embed the actual license text in an ExtractedLicesingInfo block. (From OE-Core rev: c638f4ae579520cab8cf30e1b4306bd0e2d2a788) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: remove redundant testRoss Burton2021-09-041-3/+0
| | | | | | | | | | add_extracted_document() is only called if the license isn't known to SPDX, so there's no need to check again. (From OE-Core rev: 03f084251510c810c8434d9ddd459187827c1ca8) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: transform license list into a dict for faster lookupsRoss Burton2021-09-041-7/+8
| | | | | | | | | | spdx-licenses.json contains an array of licenses objects. As we'll be searching it often, convert that to a dictionary when we parse it. (From OE-Core rev: 3405d9114ca9fe4ba820e0025c91670d1a5150b1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Comment out placeholder license warningJoshua Watt2021-09-031-1/+2
| | | | | | | | | | We don't want this warning causing problems on the AB, so leave it comment out for now (From OE-Core rev: d41018311abf91899645b8f3160db540abdb5398) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Skip package processing for native recipesJoshua Watt2021-09-031-129/+134
| | | | | | | | | | Native recipes do not produce packages and should not process them, otherwise it can trigger an error in read_subpackage_metadata (From OE-Core rev: ea077b1ff6a4ccd5241a085bf9a3f67011e0f7bf) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Collect all task dependenciesJoshua Watt2021-09-031-2/+1
| | | | | | | | | | | | | Stop filtering the runtime dependencies based on do_create_sdpx (makes it only pick up things in DEPENDS) and instead include all task dependencies that are not the current PN. This allows other dependency methods to be picked up correctly, for example the dependency on the kernel used by kernel modules. (From OE-Core rev: c9659562cf88a820c668ff1eb20814dcb4829392) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add special exception for Public Domain licenseJoshua Watt2021-09-031-12/+21
| | | | | | | | | | | The Public Domain license (PD) needs a special exception in the license processing since there is no common license text to be extracted for these licenses. (From OE-Core rev: fe5b757712aa99ff1ff10d2304ac320100635200) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Fix file:// in downloadLocationJoshua Watt2021-09-031-3/+6
| | | | | | | | | | | file:// URIs should not be included as the downloadLocation. Instead, loop until a non-file:// URI is found, or set the location to NOASSERTION if none is found (From OE-Core rev: 19c61ec3986213b336d965d90b1329085e7d6179) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Speed up hash calculationsJoshua Watt2021-09-031-33/+16
| | | | | | | | | | Use the bb.utils.sha* utilities to hash files since they are much faster than the loops we were rolling ourselves (From OE-Core rev: a6d9de5350937c7e25899491db59f473345f0b69) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Fix up license reportingJoshua Watt2021-09-031-8/+47
| | | | | | | | | | | | | | | | | | Licenses reported in the SPDX documents should be either: A) A valid SPDX identifier cross referenced from the SPDX license database B) A "LicenseRef" to a license described in the SPDX document The licensing code will now add a placeholder extracted license with corresponding "LicenseRef" for any licenses that are not matched to the SPDX database Parenthesis in the license expression are now handled correctly (From OE-Core rev: 28d9d035c0ff8fcaf28bc96a976a43a602a47e94) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: extend DocumentRef to include nameSaul Wold2021-09-031-2/+2
| | | | | | | | | | | | | This will create a more uniq DocumentRef, which will allow the individual spdx files to be merged into a single SBOM file reflecting the image. Do the same with the runtime dependencies also (From OE-Core rev: df7c88a48621d32c02f328eedc314f10d475b758) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Fix another creatorJoshua Watt2021-09-031-2/+2
| | | | | | | | | Fixes another creator that was missed earlier (From OE-Core rev: 046c05fec9fc5162d7a14971ed1402d86605d229) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add NOASSERTION for unknown debug sourcesJoshua Watt2021-09-031-20/+16
| | | | | | | | | | If a debug source cannot be found, mark it as NOASSERTION so that other tools at least know we were unable to locate it. (From OE-Core rev: 0e6bdd3f208c50153087c2baca67e9fd64a458d0) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add runtime dependency mappingJoshua Watt2021-09-031-1/+178
| | | | | | | (From OE-Core rev: 82f3229bce41dc101c79865033432161dac269d8) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add index to DEPLOYDIRJoshua Watt2021-09-031-2/+11
| | | | | | | | | Add the index to DEPLOYDIR in addition to adding it to the SPDX archive (From OE-Core rev: 374dc08c0f22e98a267676f71308592d17f77d64) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add SHA1 to index fileJoshua Watt2021-09-031-1/+2
| | | | | | | (From OE-Core rev: ebfe78ad26b643ce0fb22ba5b3ede43da4a78987) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Change creatorJoshua Watt2021-09-031-6/+6
| | | | | | | | | Update the creator name since this no longer lives in meta-doubleopen (From OE-Core rev: 6fdea64ef53eb4de3d0e58e70ae6b391fdff6cd0) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add classJoshua Watt2021-09-031-0/+679
Adds a class as a first attempt to create SPDX SBoM documents during the build. This initial work was influenced by [meta-doubleopen][1], although almost completely rewritten. [1]: https://github.com/doubleopen-project/meta-doubleopen (From OE-Core rev: 78c79821ae7e2f060b9a74ea9aefce98102bb00e) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-14 15:00:19 +0000