oe-go-mod-fetcher + go-mod-discovery: add --build-target license-scan filter

The license-scan filter previously had two tiers — walk GOMODCACHE for
unpacked module dirs, falling back to `go list -m all` (the MVS set).
For recipes whose do_compile builds multiple binaries spanning a wider
import graph than the discovery step's single GO_MOD_DISCOVERY_BUILD_TARGET
(incus: 8 cmd/* binaries vs the single ./cmd/incus-migrate used by
discovery), the GOMODCACHE walk under-includes and the MVS fallback
over-includes — producing go-mod-licenses.inc entries that point to
modules bitbake never unpacks, which then trip do_populate_lic's
"invalid file" QA gate.

Add a tier-0 filter: when a recipe declares its full set of build
targets via the new GO_MOD_DISCOVERY_LICENSE_TARGETS variable, the
generator runs `go list -deps` on those targets and uses the union
of their imported modules as the filter set. This is the most accurate
signal for "what bitbake will unpack at build time" — equivalent to
what go build would resolve before bitbake's do_unpack runs.

Mechanism:

  - oe-go-mod-fetcher.py: new --build-target flag (repeatable) and
    _get_imported_modules() helper. Repeats over `action='append'`
    so the per-target paths survive shell word-splitting in the bbclass
    invocation without quoting tricks.
  - go-mod-discovery.bbclass: when GO_MOD_DISCOVERY_LICENSE_TARGETS is
    set, loop over its values and emit --build-target for each. The
    list is space-separated in the recipe; the bbclass loop keeps
    each target as its own shell word.

Tier order is now:

  1. --build-target (this commit): `go list -deps` on declared targets
  2. GOMODCACHE walk (existing): modules unpacked by the discovery build
  3. `go list -m all` MVS-selected set (existing): full module graph
  4. No filter (existing): all go.sum entries

Recipes without GO_MOD_DISCOVERY_LICENSE_TARGETS see no behavior change —
verified against cosign via a real bitbake -c discover_and_generate run
(zero diff vs HEAD on its sidecars). Incus's go-mod-licenses.inc drops
from 418 (MVS fallback) to 176 lines once the new tier is wired up,
matching the build's actual ~170 unpacked modules.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/classes/go-mod-discovery.bbclass b/classes/go-mod-discovery.bbclass
index 9609ee35..3d58811c 100644
--- a/classes/go-mod-discovery.bbclass
+++ b/classes/go-mod-discovery.bbclass
@@ -79,6 +79,18 @@
 #                                   Default: "${FILE_DIRNAME}" (recipe's directory)
 #
 #   GO_MOD_DISCOVERY_SKIP_LICENSES - Set to "1" to skip license scanning
+#
+#   GO_MOD_DISCOVERY_LICENSE_TARGETS - Space-separated list of go build
+#                                      targets used by the recipe's
+#                                      do_compile. When set, the license
+#                                      scan filter is derived from
+#                                      `go list -deps` on these targets
+#                                      (the most accurate filter). Useful
+#                                      when do_compile builds multiple
+#                                      binaries with a wider import graph
+#                                      than the discovery's single
+#                                      BUILD_TARGET. Falls back to the
+#                                      GOMODCACHE walk when unset.
 #                                    Default: "" (scan enabled)
 #
 # WORKFLOW EXAMPLES:
@@ -421,6 +433,15 @@ Or run 'bitbake ${PN} -c show_upgrade_commands' to see manual options."
     LICENSE_FLAGS=""
     if [ "${GO_MOD_DISCOVERY_SKIP_LICENSES}" != "1" ]; then
         LICENSE_FLAGS="--scan-licenses --common-license-dir ${COMMON_LICENSE_DIR} --discovery-cache ${GO_MOD_DISCOVERY_DIR}/cache"
+        # If the recipe declares its full set of build targets (used by its
+        # own do_compile), pass each one through so the license scan can
+        # scope the filter via `go list -deps` rather than the discovery's
+        # single BUILD_TARGET-derived GOMODCACHE walk. Use repeated
+        # --build-target flags so the values survive shell word-splitting
+        # without quoting tricks.
+        for target in ${GO_MOD_DISCOVERY_LICENSE_TARGETS}; do
+            LICENSE_FLAGS="${LICENSE_FLAGS} --build-target ${target}"
+        done
     fi
 
     python3 "${FETCHER_SCRIPT}" \