linux/poky.git/meta/lib/oe/spdx.py, branch nanbield

classes/create-spdx-2.2: Report downloads as separate packages

2023-02-19T07:47:53+00:00

Moves the downloaded items from SRC_URI into separate packages in the recipe document. This is much better than the previous implementation because: 1) It can report multiple download locations in SRC_URI, instead of just the first one reported. 2) It prevents the assumption that the source files listed in the recipe are the exact file from the source URL; in particular, files that come from file:// SRC_URI entries, and source files that have been patched were problematic, since these aren't from the upstream source. 3) It allows the checksums to be specified (From OE-Core rev: 1dd4369b3638637a2cbba2a3c37c6b6f4df335cd) Signed-off-by: Joshua Watt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lib: Add copyright statements to files without one

2022-08-12T11:00:43+00:00

Where there isn't a copyright statement, add one to make it explicit. Also add license identifiers as MIT if there isn't one. (From OE-Core rev: bb731d1f3d2a1d50ec0aed864dbca54cf795b040) Signed-off-by: Richard Purdie

create-spdx: Fix supplier field

2022-07-28T13:43:21+00:00

The correct field name is "supplier" according to SPDX schema. The "supplier" field translates to "PackageSupplier", but that's for tag-value format. (From OE-Core rev: ca8db0e0a2860ac1e3f537471fa71b43c3be0a58) Signed-off-by: Mihai Lindner Signed-off-by: Richard Purdie

spdx: Add set helper for list properties

2022-02-07T10:08:59+00:00

This adds the set helper for list properties to allow list members to be replaced with a new list. This is necessary as it is (currently) the only way to replace the default value for a list member. (From OE-Core rev: 8280b857c510646cd10167dd2ea9a0c2d5f1e800) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

spdx.py: Add annotation to relationship

2021-10-28T13:16:31+00:00

Having annotations on relationship can provide additional information about the relationship such as how it was derived. (From OE-Core rev: d98585aa89e1d3819f8139a07fb7376ef89b37f8) Signed-off-by: Saul Wold Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

lib/oe/spdx.py: Add comments

2021-09-28T16:55:04+00:00

Adds several comments to this file to explain the intention and how it should be used (From OE-Core rev: 0be0ba70e68b57a3617d3c1ea4b6233b37d5d648) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

spdx.py: Add SPDXAnnotation Object

2021-09-28T16:55:04+00:00

This is added to allow the create-spdx code to create annotations that store values properly according to the SPDX Specification. Initialy they will be used to track if a recipe is a native type. (From OE-Core rev: 8db551bba619f3b3612c59270043148214a462cc) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

classes/create-spdx: Fix up license reporting

2021-09-03T08:53:28+00:00

Licenses reported in the SPDX documents should be either: A) A valid SPDX identifier cross referenced from the SPDX license database B) A "LicenseRef" to a license described in the SPDX document The licensing code will now add a placeholder extracted license with corresponding "LicenseRef" for any licenses that are not matched to the SPDX database Parenthesis in the license expression are now handled correctly (From OE-Core rev: 28d9d035c0ff8fcaf28bc96a976a43a602a47e94) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

classes/create-spdx: Add class

2021-09-03T08:53:28+00:00

Adds a class as a first attempt to create SPDX SBoM documents during the build. This initial work was influenced by [meta-doubleopen][1], although almost completely rewritten. [1]: https://github.com/doubleopen-project/meta-doubleopen (From OE-Core rev: 78c79821ae7e2f060b9a74ea9aefce98102bb00e) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie