linux/poky.git/meta/classes/create-spdx.bbclass, branch uninative-3.6

create-spdx: Avoid regex warning by quoting correctly

2022-03-29T14:59:29+00:00

create-spdx.bbclass:43: DeprecationWarning: invalid escape sequence \W lic_regex = re.compile(b'^\W*SPDX-License-Identifier:\s*([ \w\d.()+-]+?)(?:\s+\W*)?$', re.MULTILINE) (From OE-Core rev: 5dfb26d45f69c4d5dc4b6fcef084b830ef9dbf4c) Signed-off-by: Richard Purdie Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

create-spdx.bbclass: Simplify extraction of license text

2022-03-24T17:45:29+00:00

There is no reason to first search for all available licenses using avail_licenses() and then search through the same paths looking for the actual license texts. Just look for the license texts directly instead. (From OE-Core rev: 59eb405a80f0a0acf9b754b2b78399bacb0094ae) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

create-spdx: Use function rather than AVAILABLE_LICENSES

2022-03-16T10:31:41+00:00

We can directly call the function rather than using the variable indirection. As this is the last user of the variable, it then allows removal of it in a followup patch. (From OE-Core rev: 3ed84651b2f4eff9409bfecba2a080e244124880) Signed-off-by: Richard Purdie

create-spdx.bbclass: Remove an unnecessary path from do_create_spdx[dirs]

2022-03-15T08:40:09+00:00

There is no reason to include a path in foo[dirs] if it is also in foo[cleandirs] (except if it is the last path in foo[dirs]). (From OE-Core rev: cb30a6cfa58072bbf5f5def36103fbcac920e168) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

create-spdx: add support for SDKs

2022-02-25T12:41:23+00:00

Currently, SPDX SBOMs are only created for images. Add support for SDKs. (From OE-Core rev: c3acbb936a339636153903daf127eec9f36de79b) Signed-off-by: Andres Beltran Signed-off-by: Richard Purdie

create-spdx: Get SPDX-License-Identifier from source

2022-02-12T17:05:35+00:00

This patch will read the begining of source files and try to find the SPDX-License-Identifier to populate the licenseInfoInFiles field for each source file. This does not populate licenseConcluded at this time, nor rolls it up to package level. We read as binary file since some source code seem to have some binary characters, the license is then converted to ascii strings. (From OE-Core rev: 51e5f328635eb022143178c3169bae719509697a) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

classes/create-spdx: Remove unnecessary package

2022-02-07T10:08:59+00:00

A superfluous package was being created, but it was never used. (From OE-Core rev: ddfa61f691fc51c1968e8f1ff43f69dccd1632ee) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/create-spdx: Add packageSupplier field

2022-02-07T10:08:59+00:00

Per NIST SBoM recommendations, include the Package Supplier field for all SPDX packages that are created. This field should generally be set to the person or organization that is performing the build, since they would be considered the "supplier" of the SPDX packages. (From OE-Core rev: ca48349501e0ec93dc2448d064e1567fca390bf5) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

create-spdx: Add kernel work-shared source

2022-01-13T13:57:26+00:00

Since the kernel source is stored in work-shared, we need to add it to the search path so the kernel and kernel-modules source code can be found correctly. (From OE-Core rev: 93a94890b9f2679945e96973937b209aa12302b7) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

classes/create-spdx: handle if IMAGE_LINK_NAME is empty

2022-01-11T15:48:11+00:00

If IMAGE_LINK_NAME is set to "" (supported in other classes) then skip creating symlinks for the spdx manifest files. (From OE-Core rev: c2d5e2dbbba78d8d7036f6418360b2e84bcdc169) Signed-off-by: Paul Eggleton Signed-off-by: Richard Purdie