linux/poky.git/meta/lib/oe/sbom30.py, branch walnascar

lib: sbom30: Add action statement for affected VEX statements

2025-03-06T16:33:20+00:00

VEX Affected relationships have a mandatory action statement that indicates the mitigation for a vulnerability. Since we don't track this add a statement indicating that no mitigation is known. (From OE-Core rev: 39545c955474a43d11a45d74a88a5999b02cb8b3) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib/oe/sbom30: Fix SHA256 hash dictionary

2025-02-05T12:49:55+00:00

Fixes a bug in the code that created the hash dictionary that was accidentally excluding items with a SHA256 hash instead of including them (From OE-Core rev: 90765467e42241d8b572d035389d7062a0316a9f) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib: spdx: Upgrade to final 3.0.1 release

2025-01-20T13:38:59+00:00

The 3.0.1 release of SPDX has been officially released with a few minor modifications. Regenerate the bindings to use this version. (From OE-Core rev: 54233a7d6fe414d22449fb02fac26b66a820b17a) Signed-off-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

meta/lib/oe/sbom30.py: set alias for scan declared licenses

2025-01-08T12:50:14+00:00

when using SPDX_INCLUDE_SOURCES, it calls scan_declared_licenses to scan licenses from source file, set alias for the newly added license and and license alias to hasDeclaredLicense relationship $ echo 'MACHINE = "qemux86-64"' >> conf/local.conf $ echo 'SPDX_INCLUDE_SOURCES = "1"' >> conf/local.conf $ bitbake shadow $ vim tmp/deploy/spdx/3.0.1/corei7-64/recipes/recipe-shadow.spdx.json Before this commit ... { "type": "Relationship", ... "from": "http://spdx.org/spdxdocs/shadow-10e66933-65cf-5a2d-9a1d-99b12a405441/d0cdb0d02e54d55e52fccf8631f8290b161ad43fe31fffe09e8e25041d2280cf/sourcefile/11048", "relationshipType": "hasDeclaredLicense", "to": [ "http://spdx.org/spdxdocs/shadow-10e66933-65cf-5a2d-9a1d-99b12a405441/d0cdb0d02e54d55e52fccf8631f8290b161ad43fe31fffe09e8e25041d2280cf/license/3_24_0/BSD-3-Clause", ] }, ... After this commit ... { "type": "Relationship", ... "from": "http://spdx.org/spdxdocs/shadow-10e66933-65cf-5a2d-9a1d-99b12a405441/d0cdb0d02e54d55e52fccf8631f8290b161ad43fe31fffe09e8e25041d2280cf/sourcefile/11048", "relationshipType": "hasDeclaredLicense", "to": [ "http://spdxdocs.org/openembedded-alias/by-doc-hash/cc72db638e3f8e283e722af0ecc77d19f93cc6736700ee76477e3773b6b07b05/shadow/UNIHASH/license/3_24_0/BSD-3-Clause" ] }, ... (From OE-Core rev: 1f109e22dd22e6071685a8e55bdfe3069bc8fadb) Signed-off-by: Hongxu Jia Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

meta/lib/oe/sbom30.py: fix alias in simplelicensing_customIdToUri not extracted

2025-01-08T12:49:00+00:00

After commit [spdx 3.0: Rework how SPDX aliases are linked] applied, it set license_text_map with SPDX alias other than actual ID The property of simplelicensing_customIdToUri is ListProp(ObjectProp(DictionaryEntry))), and class DictionaryEntry has key and value, the property of value is StringProp other than ObjectProp in which could not support to decode/extract SPDX alias with actual ID in image jsonld file ----------- "simplelicensing_customIdToUri": [ { "type": "DictionaryEntry", "key": "LicenseRef-PD", "value": "http://spdxdocs.org/openembedded-alias/by-doc-hash/d53e90e23b12c4ad640809a74a810e86f31c76cdbdf36487712d22a33d53362a/sqlite3-native/UNIHASH/license-text/PD" } ], ----------- Add special code in the linking to manually go through all of the simplelicensing_customIdToUri DictionaryEntry items and resolve any aliases to actual objects ----------- "simplelicensing_customIdToUri": [ { "type": "DictionaryEntry", "key": "LicenseRef-PD", "value": "http://spdx.org/spdxdocs/sqlite3-native-e5cc0672-d8dd-57e8-a2df-fe4615831fda/162c62b5b011cd3f82f413b3dae4d6d1542201552c964d5ce69fe170e0720b85/license-text/PD" } ] ----------- Suggested-by: Joshua Watt (From OE-Core rev: f16c2eae5a7e1a483e1d537d8711d83fede75691) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

meta/lib/oe/sbom30.py: correct alias

2025-01-08T12:49:00+00:00

After commit [spdx 3.0: Rework how SPDX aliases are linked] applied, it added extra "/" to namespace, which causing the replacement of UNIHASH missing a "/" http://spdxdocs.org/openembedded-alias/by-doc-hash/0b308e4b9ad979f642d8787c61f76c31bdcad04837eeaaf8bc383f33f99bbeb8/flex-nativeUNIHASH/build/recipe After applying this commit to remove "/" from namespace. http://spdxdocs.org/openembedded-alias/by-doc-hash/0b308e4b9ad979f642d8787c61f76c31bdcad04837eeaaf8bc383f33f99bbeb8/flex-native/UNIHASH/build/recipe (From OE-Core rev: 708cbf00d46169ca05660b1f9f3e0653b499e9ef) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

spdx 3.0: Rework how SPDX aliases are linked

2024-12-12T12:55:56+00:00

The SPDX code needs to be able to look up an Element by its SPDX ID, locating the file that (should) contain the SPDX ID and opening it for parsing. Previously, the code would do this be hashing each Element SPDX ID and Alias, and the creating a symbolic link to the file that contains the element with a name of the hash. This worked well as it was possible to look up any arbitrary SPDX ID or alias by simply hashing it and following the symbolic link to get the file. However, the down side of this approach is that it creates a lot of symbolic links, since it will make one or two per Element in the document. This can be a problem when using SPDX_INCLUDE_SOURCES, for example. This change reworks this strategy so that the only Element that gets a symbolic link based on the hash is the singular SpdxDocument that is create for each file. All other Elements are assigned an alias with a special prefix that encodes the hash of SpdxDocument alias. Thus, when attempting to look up an arbitrary alias, the code sees the special prefix, extract the hash, opens the file based on the symlink with that hash name, then finds the matching Element in the file. This drastically reduces the number of symbolic links by making only one per file. This also means that the custom link extension can be removed since it is now superfluous. (From OE-Core rev: 838d64c09657ac53175737fc4e7fd6f01f3dcf47) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib: oeqa: spdx: Add tests for extra options

2024-12-05T17:07:10+00:00

Adds a test for several of the extra options provided by the SPDX classes. In particular, these are the options that can produce non-reproducible results, so are not enabled by default in OE core. This test takes care to configure the build so that the tests do run in a reproducible manner so that pre-built test objects can be pulled from sstate (From OE-Core rev: 14f534f15f7fe6362723d7f064d39783c5bd758f) Signed-off-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

lib: sbom30: Fix agent reference

2024-12-05T17:07:10+00:00

When a agent reference was being used, the code was not using the correct base variable to look up the agent (From OE-Core rev: f3f13f48e214b25cf302b8ce397b630f5aa283fa) Signed-off-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

lib: sbom30: Fix import handling

2024-12-05T17:07:10+00:00

Fixes a bug in the way that imports where being handled, due to a misspelled variable (From OE-Core rev: 10e2a1fbcf4828f3a6c7fd327976fefa3ffb252e) Signed-off-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie