linux/poky.git/meta/lib/oe, branch 5.2_M3

lib: spdx30_tasks: Handle patched CVEs

2025-03-08T18:08:04+00:00

The code to iterate over patched CVEs (e.g. those patched by a .patch file in SRC_URI) was accidentally omitted when writing the SPDX 3 handling. Add it in now [YOCTO #15789] (From OE-Core rev: 1ff496546279d8a97df5ec475007cfb095c2a0bc) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib/oe/elf.py: Add loongarch64 architecture definition for musl

2025-03-07T11:13:24+00:00

Add the ELF definition for the loongarch64 architecture when building with musl as libc. (From OE-Core rev: c6498e4ca43dc2f8bc326bc6b6dbc8fd7f0bef79) Signed-off-by: Xiaotian Wu Signed-off-by: Richard Purdie

lib: sbom30: Add action statement for affected VEX statements

2025-03-06T16:33:20+00:00

VEX Affected relationships have a mandatory action statement that indicates the mitigation for a vulnerability. Since we don't track this add a statement indicating that no mitigation is known. (From OE-Core rev: 39545c955474a43d11a45d74a88a5999b02cb8b3) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib/package/utils: Improve multiprocess_launch argument passing

2025-02-28T07:49:18+00:00

The current code for multiple argument passing is horrible. Tweak the multiprocess_launch function to only convert to a tuple if it isn't already one, which means we can then use function arguments in a standard way. (From OE-Core rev: 7c99f90079e722764ebdc30e8d0e781454b3a51a) Signed-off-by: Richard Purdie

spdx30: Improve os.walk() handling

2025-02-18T11:56:03+00:00

There have been errors seen when assembling root file system SPDX documents where they will references files that don't exist in the package SPDX. The speculation is that this is caused by os.walk() ignoring errors when walking, causing files to be omitted. Improve the code by adding an error handler to os.walk() to report errors when they occur. In addition, sort the files and directories while walking to ensure consistent ordering of the file SPDX IDs. (From OE-Core rev: 86b581e80637cd8136ce7a7e95db94d9553d2f60) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

spdx30: Include files in rootfs

2025-02-05T12:49:55+00:00

Adds a "contains" relationship that relates the root file system package to the files contained in it. If a package provides a file with a matching hash and path, it will be linked, otherwise a new File element will be created (From OE-Core rev: e6fe754aef93e834e5226c8b13fdf75e03080ba2) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib/oe/sbom30: Fix SHA256 hash dictionary

2025-02-05T12:49:55+00:00

Fixes a bug in the code that created the hash dictionary that was accidentally excluding items with a SHA256 hash instead of including them (From OE-Core rev: 90765467e42241d8b572d035389d7062a0316a9f) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie

lib/spdx30_tasks: support directories deployed by image recipes

2025-01-29T15:52:58+00:00

create_image_spdx() implementation assumes that image is indeed a file. If image recipe deploys a directory (for example, which contains an hierarchy of flash artifacts, that is used by SoC vendor-specific flashing tool) which follows ${IMAGE_NAME}.${IMAGE_TYPE} naming scheme, create_image_spdx() function will fail after trying to hash a directory: *** 0002:do_create_image_spdx(d) 0003: File: '.../meta/classes-recipe/create-spdx-image-3.0.bbclass', lineno: 48, function: do_create_image_spdx 0044:addtask do_create_rootfs_spdx_setscene 0045: 0046:python do_create_image_spdx() { 0047: import oe.spdx30_tasks *** 0048: oe.spdx30_tasks.create_image_spdx(d) 0049:} 0050:addtask do_create_image_spdx after do_image_complete do_create_rootfs_spdx before do_build 0051:SSTATETASKS += "do_create_image_spdx" ... File: '.../bitbake/lib/bb/utils.py', lineno: 536, function: _hasher 0532: 0533:def _hasher(method, filename): 0534: import mmap 0535: *** 0536: with open(filename, "rb") as f: 0537: try: 0538: with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm: 0539: for chunk in iter(lambda: mm.read(8192), b''): 0540: method.update(chunk) Exception: IsADirectoryError: [Errno 21] Is a directory: '...' (From OE-Core rev: a0d63082a4db375a55586c7864e280cd8f45ff7b) Signed-off-by: Igor Opaniuk Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

classes/spdx-common: Fix patch error for recipes that inherit dos2unix.

2025-01-29T10:40:41+00:00

While SPDX_INCLUDE_SOURCES = "1", do_create_spdx error happens for these recipes inherit dos2unix Refer [1] to fix the issue [1] https://git.openembedded.org/openembedded-core/commit/?id=2ceda7c90c0087f52693c54d5ccab143b27f4d21 (From OE-Core rev: 7051bfb8ff67a6f0c394ce0f559eb53a05cde472) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

classes/recipes: Switch virtual/XXX-gcc to virtual/cross-cc (and c++/binutils)

2025-01-21T23:09:33+00:00

The idea of the base class dependency is to say "yes, I need a C cross compiler" and this was never meant to be gcc specific. Looking at the codebase, whilst we code triplets into this, it does overcomplicate things as there are only ever limited, "target", "sdk" and the class extended versions like mutlilib. After much thought, we can simplify this to virtual/cross-cc and virtual/nativesdk-cross-cc. This lets us remove the "gcc" specific element as well as removing the over complicated triplet usage. At the same time, change the much less widely used "g++" variant to "c++" for similar reasons and remove the triplet from virtual/XXX-binutils too. Backwards compatibility mappings could be left but are just going to confuse things in future so we'll just require users to update. This simplification, whilst disruptive for any toolchain focused layers, will make improved toolchain selection in the future much easier. Since we no longer have overlapping variables, some code for that can just be removed. The class extension code does need to start remapping some variables but not the crosssdk target recipe names. This patch is in two pieces, this one handles the renaming with the functional changes separate in a second for easier review even if this breaks bisection. (From OE-Core rev: 4ccc3bc8266c327bcc18c9a3faf7536210dfb9f0) Signed-off-by: Richard Purdie