linux/poky.git/meta/classes/create-spdx.bbclass, branch yocto-4.0.1

create-spdx: delete virtual/kernel dependency to fix FreeRTOS build

2022-05-04T12:07:34+00:00

When building FreeRTOS this dependency generates an error because bitbake cannot find any provider for "virtual/kernel". >From a dependency analysis the task is executed independently from this so it can be safely removed. This patch has been discussed in this ML thread: https://lists.openembedded.org/g/openembedded-core/topic/90602531 (From OE-Core rev: ec31ce4751e45e98730165d64eb74fc98eab8c85) Signed-off-by: Davide Gardenal Signed-off-by: Richard Purdie (cherry picked from commit 1c02b768a71ec88bfe1cc0c4443683de8b66056e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

create-spdx: fix error when symlink cannot be created

2022-04-28T16:07:18+00:00

If IMAGE_NAME and IMAGE_LINK_NAME are the same an exception is raised in image_combine_spdx because it cannot create a symlink with the same exact path of the original file. In that case there is no point in creating a link in the first place. Refactor image_combine_spdx to avoid code duplication (From OE-Core rev: dfb49be6b586e3901a4398b46c914d80dcdd029b) Signed-off-by: Davide Gardenal Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 88f76bba705007a7fcda506c79f743060d8f2e52) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

create-spdx: Avoid regex warning by quoting correctly

2022-03-29T14:59:29+00:00

create-spdx.bbclass:43: DeprecationWarning: invalid escape sequence \W lic_regex = re.compile(b'^\W*SPDX-License-Identifier:\s*([ \w\d.()+-]+?)(?:\s+\W*)?$', re.MULTILINE) (From OE-Core rev: 5dfb26d45f69c4d5dc4b6fcef084b830ef9dbf4c) Signed-off-by: Richard Purdie Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

create-spdx.bbclass: Simplify extraction of license text

2022-03-24T17:45:29+00:00

There is no reason to first search for all available licenses using avail_licenses() and then search through the same paths looking for the actual license texts. Just look for the license texts directly instead. (From OE-Core rev: 59eb405a80f0a0acf9b754b2b78399bacb0094ae) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

create-spdx: Use function rather than AVAILABLE_LICENSES

2022-03-16T10:31:41+00:00

We can directly call the function rather than using the variable indirection. As this is the last user of the variable, it then allows removal of it in a followup patch. (From OE-Core rev: 3ed84651b2f4eff9409bfecba2a080e244124880) Signed-off-by: Richard Purdie

create-spdx.bbclass: Remove an unnecessary path from do_create_spdx[dirs]

2022-03-15T08:40:09+00:00

There is no reason to include a path in foo[dirs] if it is also in foo[cleandirs] (except if it is the last path in foo[dirs]). (From OE-Core rev: cb30a6cfa58072bbf5f5def36103fbcac920e168) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

create-spdx: add support for SDKs

2022-02-25T12:41:23+00:00

Currently, SPDX SBOMs are only created for images. Add support for SDKs. (From OE-Core rev: c3acbb936a339636153903daf127eec9f36de79b) Signed-off-by: Andres Beltran Signed-off-by: Richard Purdie

create-spdx: Get SPDX-License-Identifier from source

2022-02-12T17:05:35+00:00

This patch will read the begining of source files and try to find the SPDX-License-Identifier to populate the licenseInfoInFiles field for each source file. This does not populate licenseConcluded at this time, nor rolls it up to package level. We read as binary file since some source code seem to have some binary characters, the license is then converted to ascii strings. (From OE-Core rev: 51e5f328635eb022143178c3169bae719509697a) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

classes/create-spdx: Remove unnecessary package

2022-02-07T10:08:59+00:00

A superfluous package was being created, but it was never used. (From OE-Core rev: ddfa61f691fc51c1968e8f1ff43f69dccd1632ee) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/create-spdx: Add packageSupplier field

2022-02-07T10:08:59+00:00

Per NIST SBoM recommendations, include the Package Supplier field for all SPDX packages that are created. This field should generally be set to the person or organization that is performing the build, since they would be considered the "supplier" of the SPDX packages. (From OE-Core rev: ca48349501e0ec93dc2448d064e1567fca390bf5) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie