linux/poky.git/meta/classes, branch walnascar

classes/spdx-*.bbclass: move spdx2 specific variables out of spdx-common class

2025-03-28T11:19:40+00:00

Setting SPDX_ARCHIVE_SOURCES and SPDX_ARCHIVE_PACKAGED makes no difference when using the spdx-3.0 class. Move these two in the spdx-2.0 class since they are only used there. (From OE-Core rev: 8ce06538c9cde0f09909a5a2e61ec10b0d35df49) Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie

spdx3: support to override the version of a package in SBOM 3

2025-03-24T17:29:16+00:00

By default, still use ${PV} as the the version of a package in SBOM 3 $ bitbake acl $ jq . tmp/deploy/spdx/3.0.1/core2-64/packages/package-acl.spdx.json ... { "type": "software_Package", ... "name": "acl", "software_packageVersion": "2.3.2" }, ... Support to override it by setting SPDX_PACKAGE_VERSION, such as set SPDX_PACKAGE_VERSION = "${EXTENDPKGV}" in local.conf to append PR to software_packageVersion in SBOM 3 $ echo 'SPDX_PACKAGE_VERSION = "${EXTENDPKGV}"' >> conf/local.conf $ bitbake acl $ jq . tmp/deploy/spdx/3.0.1/core2-64/packages/package-acl.spdx.json ... { "type": "software_Package", ... "name": "acl", "software_packageVersion": "2.3.2-r0" }, ... (From OE-Core rev: e6ff5f4d870624795bd36572f5c2bfeec90d83ce) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

classes: create-spdx-2.2: Fix dependency handling

2025-03-24T17:29:16+00:00

The common SPDX code was changed to return a dataclass for dependency information instead of a namedtuple, but the SPDX 2.2 was missed to account for this. Correct the SPDX 2.2 code to correctly handle the new datatype (From OE-Core rev: 79a03abd37839973996efc957d44614edcbd6b87) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

buildhistory: Update for bitbake changes

2025-03-20T13:50:40+00:00

Bitbake is dropping the need for fetcher name iteration and multiple revisions per url. Update the code to match (removal of the for loop). (From OE-Core rev: 571e8c6730eb5b89f732d879487ae578ef04aaee) Signed-off-by: Richard Purdie

spdx: Update for bitbake changes

2025-03-20T13:50:40+00:00

Bitbake is dropping the need for fetcher name iteration and multiple revisions per url. Update the code to match (removal of the for loop). (From OE-Core rev: 4859cdf97fd9a260036e148e25f0b78eb393df1e) Signed-off-by: Richard Purdie

buildhistory.bbclass: Do not create annotated tags if tag.gpgSign is set

2025-03-19T12:09:06+00:00

If tag.gpgSign is configured in Git's configuration, then creating the build-minus-X tags will fail (if Git's core.editor is not configured) or it will hang (when trying to open the editor). This is beacause tag.gpgSign causes git tag to create annotated tags. To avoid this, specify --no-sign as argument to git tag. (From OE-Core rev: 7595a0a63a933af9dd9d1e458dc34a4ba80d9eae) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

devtool-source.bbclass: Do not create annotated tags if tag.gpgSign is set

2025-03-19T12:09:06+00:00

If tag.gpgSign is configured in Git's configuration, then creating the devtool-patched tag will fail (if Git's core.editor is not configured) or it will hang (when trying to open the editor). This is beacause tag.gpgSign causes git tag to create annotated tags. To avoid this, specify --no-sign as argument to git tag. (From OE-Core rev: 5dba8d0b6c940934375eea9af37e7c4856b51c96) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

cve-check: change the default feed

2025-03-19T10:07:30+00:00

Move to the FKIE feed by default, as it is showing better stability than NVD2. Content of the feed should be the same. (From OE-Core rev: 10580a6d36aa1366732f9c030345bd4590eb9f74) Signed-off-by: Marta Rybczynska Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

lib: Fix dependencies on SPDX code

2025-03-11T21:29:50+00:00

The SPDX library code was being ignored from taskhash calculations due to accidentally being omitted from BBIMPORTS. This meant that changes in the code or dependent variables would not cause the task to rebuild correctly. In order to add spdx_common, convert the `Dep` object from a named tuple to a frozen dataclass. These function more or less equivalently, but the bitbake code parser cannot handle named tuples. Finally, the vardepsexclude that used to be present on the recipe tasks needs to be moved to the python code in order for the variables to be correctly ignored. Several unused exclusions were removed (From OE-Core rev: eb597bf61cbcb0a4d43149404c93eec0894fb4c7) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

cve-check.bbclass: Mitigate symlink related error

2025-02-18T12:04:03+00:00

According to Yocto reference manual, in description of the IMAGE_LINK_NAME variable, it is said that It is possible to set this to "" to disable symlink creation, however, you also need to set :term:`IMAGE_NAME` to still have a reasonable value e.g.:: IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" However, when using following additions in local.conf file: INHERIT += "cve-check" IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" the implicit symlink creation in cve_check_write_rootfs_manifest leads to following build failure $ bitbake core-image-minimal core-image-base ... ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.json (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME has not been set to empty string. (From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1) Signed-off-by: Niko Mauno Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie