linux/poky.git/meta/classes/create-spdx-2.2.bbclass, branch 5.2_M2

create-spdx: support line numbers

2025-01-23T12:14:29+00:00

LIC_FILES_CHKSUM supports begin-/endline for licenses included in for instance header files. This patch adds support for line numbers to NO_GENERIC_LICENSE, too. (From OE-Core rev: 8e7ee19fc9e74cf042880f4bc317782482ba6f66) Signed-off-by: Denis Osterland-Heim Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton

create-spdx-{2.2,3.0}: fix do_create_spdx dependency while spdx include sources

2024-11-01T12:07:12+00:00

Call function ${@create_spdx_source_deps(d)} or ${create_spdx_source_deps(d)} along with addtask not working, use task do_create_spdx flag 'depends' to instead Move function create_spdx_source_deps to spdx-common.bbclass for both of create-spdx-2.2.bbclass and create-spdx-3.0.bbclass (From OE-Core rev: dda4b7ccd416ef370634babd150e944f2aa9116e) Signed-off-by: Hongxu Jia Reviewed-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

spdx 3.0: Map gitsm URI to git

2024-09-30T16:07:18+00:00

"gitsm" is not a recognized URI protocol (outside of bitbake), so map it to "git" when writing. This should be OK since we report all of the submodule source code (if enabled), and it's still possible for 3rd party analyzers to determine that submodules are in use by looking at .gitmodules. The code to do the mapping is moved to a common location so it covers SPDX 2.2 also [YOCTO #15582] (From OE-Core rev: 6ecf89c75b1a74515266085acc5d3621a0fb2fa1) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

sdpx: Avoid loading of SPDX_LICENSE_DATA into global config

2024-08-07T14:47:15+00:00

Loading a load of json files into a memory structure and stashing in a bitbake variable is relatively anti-social making bitbake -e output hard to read for example as well as other potential performance issues. Defer loading of that data until it is actually needed/used in a funciton where it is now passed as a parameter. (From OE-Core rev: 6f21cc9598178288784ff451ab3c40b174c0ef3e) Signed-off-by: Richard Purdie

create-spdx-*: Support multilibs via SPDX_MULTILIB_SSTATE_ARCHS

2024-07-26T11:28:42+00:00

When a create-spdx-* classes is processing documents, it needs to find the document in a path that is related to the SSTATE_ARCH when a packge is generated. The SSTATE_ARCH can be affected by multilib configurations, resulting is something like armv8a-mlib. When the image (or SDK) is being generated and the components are collected, the system has no knowledge of the multilib arch and will fail to find it, such as: ERROR: meta-toolchain-1.0-r0 do_populate_sdk: No SPDX file found for package libilp32-libgcc-dbg, False sstate:libilp32-libgcc:armv8a-ilp32-mllibilp32-elf:14.1.0:r0:armv8a-ilp32:12: sstate:libilp32-libgcc::14.1.0:r0::12: Adding in the new SPDX_MULTILIB_SSTATE_ARCHS will provide a full set of SSTATE_ARCHS including ones that contain the multilib extension which will allow create-spdx-* to correctly find the document it is looking for. This would also be valuable to any other function doing a similar search through SSTATE_ARCH that may have been extended with multilib configurations. (From OE-Core rev: f1499c36c1054fc90f7b7268cc95285f2eca72f7) Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie

create-sdpx-2.2.bbclass: Switch from exists to isfile checking debugsrc

2024-07-18T16:21:39+00:00

While debugsrc is almost always a file (or link), there are apparently cases where a directory could be returned from the dwarfsrcfiles processing. When this happens, the hashing fails and an error results when building the SPDX documents. (From OE-Core rev: 02e262c291c0b2066132b4cb2ca5fda8145284a9) Signed-off-by: Mark Hatle Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie

classes/spdx-common: Move to library

2024-07-16T13:55:53+00:00

Moves the bulk of the code in the spdx-common bbclass into library code (From OE-Core rev: 3f9b7c7f6b15493b6890031190ca8d1a10f2f384) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/create-spdx-2.2: Handle empty packages

2024-07-13T22:28:31+00:00

When combining an SPDX document, the package list might be empty (e.g. a baremetal image). Handle this case instead of erroring out (From OE-Core rev: baf4e360f6e65a5e9aff2def69d2a720f38f92b2) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/create-spdx-2.2: Handle SemVer License List Versions

2024-07-02T21:29:13+00:00

SPDX transitioned the license list to use SemVer visioning, (e.g. "MAJOR.MINOR.MICRO"), but SPDX 2 only allows "MAJOR.MINOR". For maximum compatibility, only keep the first two version numbers and discard the rest which allows it to work with either scheme (From OE-Core rev: 8757a5eaeaf2b9d7345212d003e5622289b123e6) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/spdx-common: Move SPDX_SUPPLIER

2024-06-27T12:03:35+00:00

Move the SPDX_SUPPLIER variable to create-spdx-2.2 since it's format only has meaning in SPDX 2.2 (SPDX 3 uses SPDX_PACKAGE_SUPPLIER with a different format) (From OE-Core rev: 628c1e04072178d2c8095e53d5f6600c45a2679f) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie