linux/poky.git/meta/classes/create-spdx.bbclass, branch honister

create-spdx: Fix key errors in do_create_runtime_spdx

2021-11-24T21:12:50+00:00

Currently, the do_create_runtime_spdx task fails with a Key Error if a dependency is not contained in the package providers dictionary. Add a check before using "dep" as a key in "providers". (From OE-Core rev: ac9b387c5e19386ce3c5cd88b42dad24d25b0f70) Signed-off-by: Andres Beltran Signed-off-by: Richard Purdie (cherry picked from commit 140ce5ef5e8f10251091660e3ef76f315f409076) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create-spdx: Protect against None from LICENSE_PATH

2021-11-24T21:12:50+00:00

If LICENSE_PATH is not set, then the split() will fail on a NoneType. (From OE-Core rev: 123ee0fc0d1470427cc563f512f621e0172cc232) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie (cherry picked from commit d6260decae6d2654f6e058f12ca02d582a8ef5a4) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create_spdx: ensure is_work_shared() is unique

2021-11-24T21:12:50+00:00

There is a function with the same name is_work_shared() in the archiver class this causes a conflict when both classes are included. Use work-shared as the check in WORKDIR to allow for other packages beyond the kernel and gcc that use a common shared-work source directory. (From OE-Core rev: 1d350fd2a0db57617fbc62eb1d65f3ffa2667551) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie (cherry picked from commit 18eab77ee65c73b17225e69c7ba446ab1c69fa92) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create-spdx: Set the Organization field via a variable

2021-11-15T11:56:16+00:00

Currently, the "Organization" field for SBOMs is hard-coded in create-spdx. Create a new variable SPDX_ORG to make this field more generic. (From OE-Core rev: e370039febe601127347da977ff9b7e5c7470315) Signed-off-by: Andres Beltran Signed-off-by: Richard Purdie (cherry picked from commit f239814f3f5d9bd54de54b0f2a5081067336e32b) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create-spdx: cross recipes are native also

2021-11-08T23:41:00+00:00

Recipes that inherit cross should also be categorized as isNative (From OE-Core rev: 9edd5e3eeec447a1d90ebbfc681c84d7047933ec) Signed-off-by: Saul Wold Signed-off-by: Alexandre Belloni (cherry picked from commit ee113e3894deb1cfb18622085a3fe0600e1ef01d) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create-spdx: add create_annotation function

2021-11-08T23:41:00+00:00

This allows code reuse and future usage with relationship annotations (From OE-Core rev: a56b50ada5d1aba57e901684af6a3761f74f6674) Signed-off-by: Saul Wold Signed-off-by: Alexandre Belloni (cherry picked from commit 1f8fdb7dc9d02d0ee3c42674ca16e03f0ec18cba) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

create-spdx: Use SPDXAnnotation to track native recipes

2021-09-28T16:55:04+00:00

Create a small function that checks for 'isNative' as part of an Annotation When the collect_dep_sources() runs, it collects sources from both native and non-native recipes. Later when the GENERATED_FROM matching occurs it may find the file (via checksum) from the native recipe since it's the same checksum as the target file. The that are generated DocumentRefs point to the native recipe rather than the target recipe DocumentRef. (From OE-Core rev: ba5ec03986a0bce8dccbc381fd34e44b8a135e66) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

create-spdx.bbclass: Search all license directories for licenses

2021-09-16T08:50:34+00:00

Before, even if the code was seemingly written to search through all licenses in ${COMMON_LICENSE_DIR} and ${LICENSE_PATH}, it would actually bail out after only searching ${COMMON_LICENSE_DIR} due to the exception handling. Also refrain from using f-strings. (From OE-Core rev: f58d54b31a1ddb4e60eb07365bfb7dfe78ed56af) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

create-spdx: handle CLOSED license

2021-09-10T08:25:38+00:00

The special CLOSED license means that this is closed source code with no other licensing assertions. It's not a generic license in oe-core, and not a SPDX license, so transform it to NONE explicitly. (From OE-Core rev: b71bfba1b5076ad1b9a10c08ef0e3393ccbed92a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

create-spdx: remove trailing comma

2021-09-08T14:32:55+00:00

The trailing comma turns ref_id into an object instead of a string when added to the relationship table. (From OE-Core rev: ec20e1a0e0ba61a7615b361bfc9d9dc58a91f9b3) Signed-off-by: Saul Wold Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie