linux/poky.git/meta/classes, branch scarthgap

archiver: Don't try to preserve all attributes when copying files

2026-05-04T12:57:33+00:00

Similar to https://git.openembedded.org/bitbake/commit/?id=2f35dac0c821ab231459922ed98e1b2cc599ca9a there is a problem in this code when copying from an NFS mount. We currently use cp -p, which is a shortcut for --preserve=mode,ownership,timestamps. We shouldn't need to preserve mode/ownership, only timestamps. Update the code in the same way the bitbake fetcher was fixed for consistency. This fixes build failures on OpenSUSE 16.0. (From OE-Core rev: 6ffd2c303d23b51a0a11f56e2e89c5a19596d228) Signed-off-by: Richard Purdie (cherry picked from commit 6e8313688fa994c82e4c846993ed8da0d1f4db0e) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

spdx: add option to include only compiled sources

2026-04-02T12:41:54+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for SPDX3.0 Tested with: - bitbake world on oe-core - oe-selftest --run-tests spdx.SPDX30Check Regarding SPDX2.2, the respective backport was already performed in OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b (From OE-Core rev: 1c7dfab26d69a87bb026e05b3bbf6a266858c0d1) Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

classes/buildhistory: Do not sign buildhistory commits

2026-02-27T17:45:06+00:00

This change adds the --no-gpg-sign option to prevent buildhistory commits from failing due to GPG signing issues. Depending on the setup, buildhistory may fail to create a commit if the user has the commit.gpgsign option enabled. For example, if the user creates a signing key that requires a password, the commit won't be created and will fail with the following error: / |error: Enter passphrase: Load key "/home//.ssh/id_ed25519": |incorrect passphrase supplied to decrypt private key? |fatal: failed to write commit object \ The bitbake command won't fail, but buildhistory won't have a commit. Also, the commit may silently fail when building inside a container due to missing packages or issues with accessing the GPG agent. This is similar to [1], and signing the buildhistory commit should be avoided to prevent such issues. 1 - https://git.openembedded.org/openembedded-core/commit/?id=7595a0a63a933af9dd9d1e458dc34a4ba80d9eae (From OE-Core rev: 667cd853a231f1fe884ba83ada2ad6cecb1c41cd) Signed-off-by: Fabio Berton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit a5e18714aee52db898aaf9d222fb5a4168bde96e) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

go-vendor: Fix absolute paths issue

2026-02-27T17:45:06+00:00

When building with the class, avoid errors like: "sstate found an absolute path symlink /xxx/vendor pointing at /xxx/import/vendor. Please replace this with a relative link." Use relative symlinks instead. (From OE-Core rev: 2ef214747b648733308958b5750c6c053ac49246) Signed-off-by: Richard Purdie Signed-off-by: Thomas Vandenabeele (cherry picked from commit fc4f589cc7a8e5feba7940ccb244a74bd5f96371) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

meta/classes: fix missing vardeps for CVE status variables

2026-02-16T09:52:35+00:00

Several CVE helper functions (get_patched_cves() and decode_cve_status()) implicitly depend on the CVE_STATUS and CVE_CHECK_STATUSMAP variables, but these were not declared in the vardeps of their callers. On Scarthgap, the upstream fix (2cc43c72ff28aa39a417dd8d57cd7c8741c0e541) cannot be cherry-picked cleanly, as it also requires BitBake changes. As a workaround, explicitly add CVE_STATUS and CVE_CHECK_STATUSMAP to the vardeps of all tasks invoking these helpers, ensuring correct task re-execution when CVE status changes. This keeps CVE-related metadata generation consistent without requiring BitBake modifications. (From OE-Core rev: 111e1f2febade3c34649f33676f7f7e7cc8e0bd0) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX

2025-12-31T15:49:31+00:00

Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes PACKAGECONFIG features to be recorded in the SPDX document as build parameters. Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG: and value enabled or disabled, depending on whether the feature is active in the current build. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. In particular, it allows consumers of the SBOM to identify enabled/disabled features that may affect security posture or feature set. Reviewed-by: Joshua Watt (From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4) Signed-off-by: Steve Sakoman

kernel.bbclass: Add task to export kernel configuration to SPDX

2025-12-31T15:49:31+00:00

Introduce a new bitbake task do_create_kernel_config_spdx that extracts the kernel configuration from ${B}/.config and exports it into the recipe's SPDX document as a separate build_Build object. The kernel config parameters are stored as SPDX DictionaryEntry objects and linked to the main kernel build using an ancestorOf relationship. This enables the kernel build's configuration to be explicitly captured in the SPDX document for compliance, auditing, and reproducibility. The task is gated by SPDX_INCLUDE_KERNEL_CONFIG (default = "0"). Reviewed-by: Joshua Watt (From OE-Core rev: 1fff29a0428778929ffa530482ebf7db95f1e0ae) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 228a968e7c47d811c06143279bdb0f9c5f374bef) Signed-off-by: Steve Sakoman

classes/create-spdx-2.2: Define SPDX_VERSION to 2.2

2025-12-17T16:48:37+00:00

SPDX_VERSION is used in DEPLOY_DIR_SPDX but if is not defined, will default to SPDX-1.1 Define SPDX_VERSION to have the correct deploy path, to align with master branch behaviour. The change in path was introduced in 8996d0899d CC: Kamel Bouhara (Schneider Electric) CC: JPEWhacker@gmail.com (From OE-Core rev: 04cc49593a0ba2c51e4f4d477d4587079735b624) Signed-off-by: Daniel Turull Signed-off-by: Steve Sakoman

vex: fix rootfs manifest

2025-12-01T15:34:55+00:00

Rootfs VEX file is created by gathering files from CVE_CHECK_DIR (deploy directory), however recipes generate the files only in CVE_CHECK_DIR (log directory). This make the rootfs VEX be always empty without any message. The code is copied from cve_check class, which writes to both, so let keep them aligned and make also vex write both files. Also add a warning for case that a cve file would be still missing. (From OE-Core rev: 7493eeed6d53bc704f558a0ccf8a0b5195381873) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit ee6541d0940c65685aaafd7d41a59a9406392e7d) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman

spdx: extend CVE_STATUS variables

2025-12-01T15:34:55+00:00

If spdx is generated without inheriting cve/vex classes (which is poky default), only explicitly set CVE_STATUS fields are handled. Calculated ones (e.g. from CVE_STATUS_GROUPS) are ignored. Fix this by expanding the CVE_STATUS in spdx classes. (From OE-Core rev: 23a4e02542252657fa45fd4a605aec0af9178e0b) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit ead9c6a8770463c21210a57cc5320f44f7754dd3) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman