summaryrefslogtreecommitdiffstats
path: root/meta/lib/oe/spdx.py
Commit message (Collapse)AuthorAgeFilesLines
* classes/create-spdx-2.2: Report downloads as separate packagesJoshua Watt2023-02-191-0/+13
| | | | | | | | | | | | | | | | | | | | Moves the downloaded items from SRC_URI into separate packages in the recipe document. This is much better than the previous implementation because: 1) It can report multiple download locations in SRC_URI, instead of just the first one reported. 2) It prevents the assumption that the source files listed in the recipe are the exact file from the source URL; in particular, files that come from file:// SRC_URI entries, and source files that have been patched were problematic, since these aren't from the upstream source. 3) It allows the checksums to be specified (From OE-Core rev: 1dd4369b3638637a2cbba2a3c37c6b6f4df335cd) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib: Add copyright statements to files without oneRichard Purdie2022-08-121-0/+2
| | | | | | | | | Where there isn't a copyright statement, add one to make it explicit. Also add license identifiers as MIT if there isn't one. (From OE-Core rev: bb731d1f3d2a1d50ec0aed864dbca54cf795b040) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Fix supplier fieldMihai Lindner2022-07-281-1/+1
| | | | | | | | | | | The correct field name is "supplier" according to SPDX schema. The "supplier" field translates to "PackageSupplier", but that's for tag-value format. (From OE-Core rev: ca8db0e0a2860ac1e3f537471fa71b43c3be0a58) Signed-off-by: Mihai Lindner <mihai.lindner@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx: Add set helper for list propertiesJoshua Watt2022-02-071-1/+4
| | | | | | | | | | | This adds the set helper for list properties to allow list members to be replaced with a new list. This is necessary as it is (currently) the only way to replace the default value for a list member. (From OE-Core rev: 8280b857c510646cd10167dd2ea9a0c2d5f1e800) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx.py: Add annotation to relationshipSaul Wold2021-10-281-1/+5
| | | | | | | | | | | Having annotations on relationship can provide additional information about the relationship such as how it was derived. (From OE-Core rev: d98585aa89e1d3819f8139a07fb7376ef89b37f8) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/oe/spdx.py: Add commentsJoshua Watt2021-09-281-0/+57
| | | | | | | | | | Adds several comments to this file to explain the intention and how it should be used (From OE-Core rev: 0be0ba70e68b57a3617d3c1ea4b6233b37d5d648) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* spdx.py: Add SPDXAnnotation ObjectSaul Wold2021-09-281-0/+7
| | | | | | | | | | | | This is added to allow the create-spdx code to create annotations that store values properly according to the SPDX Specification. Initialy they will be used to track if a recipe is a native type. (From OE-Core rev: 8db551bba619f3b3612c59270043148214a462cc) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Fix up license reportingJoshua Watt2021-09-031-0/+8
| | | | | | | | | | | | | | | | | | Licenses reported in the SPDX documents should be either: A) A valid SPDX identifier cross referenced from the SPDX license database B) A "LicenseRef" to a license described in the SPDX document The licensing code will now add a placeholder extracted license with corresponding "LicenseRef" for any licenses that are not matched to the SPDX database Parenthesis in the license expression are now handled correctly (From OE-Core rev: 28d9d035c0ff8fcaf28bc96a976a43a602a47e94) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: Add classJoshua Watt2021-09-031-0/+263
Adds a class as a first attempt to create SPDX SBoM documents during the build. This initial work was influenced by [meta-doubleopen][1], although almost completely rewritten. [1]: https://github.com/doubleopen-project/meta-doubleopen (From OE-Core rev: 78c79821ae7e2f060b9a74ea9aefce98102bb00e) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>