linux/poky.git/meta/lib/oe, branch scarthgap

spdx30_tasks: fix condition in create_spdx

2026-05-04T12:57:30+00:00

Considering that *detail* is an actual variable, not a string, remove the quotes to make the 'in' statement coherent. (From OE-Core rev: 8071a93c6b619dc9fcc2a7f1bcf94994499defbe) Signed-off-by: João Marcos Costa (Schneider Electric) Reviewed-by: Joshua Watt Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

spdx: add option to include only compiled sources

2026-04-02T12:41:54+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for SPDX3.0 Tested with: - bitbake world on oe-core - oe-selftest --run-tests spdx.SPDX30Check Regarding SPDX2.2, the respective backport was already performed in OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b (From OE-Core rev: 1c7dfab26d69a87bb026e05b3bbf6a266858c0d1) Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

lsb.py: strip ' from os-release file

2026-03-25T17:34:13+00:00

In gentoo the file looks like this: NAME='Gentoo' ID='gentoo' PRETTY_NAME='Gentoo Linux' VERSION='2.18' VERSION_ID='2.18' HOME_URL='https://www.gentoo.org/' SUPPORT_URL='https://www.gentoo.org/support/' BUG_REPORT_URL='https://bugs.gentoo.org/' ANSI_COLOR='1;32' ' were added with: https://github.com/gentoo/gentoo/commit/2f590e35c9d3d13d5673163527120b2de97fdc80 before that the os-release file looked like this: NAME=Gentoo ID=gentoo PRETTY_NAME="Gentoo Linux" ANSI_COLOR="1;32" HOME_URL="https://www.gentoo.org/" SUPPORT_URL="https://www.gentoo.org/support/" BUG_REPORT_URL="https://bugs.gentoo.org/" VERSION_ID="2.18" The ' is stripped from the ID later in distro_identifier with: # Filter out any non-alphanumerics and convert to lowercase distro_id = re.sub(r'\W', '', distro_id).lower() but not from version which results in a weird NATIVELSBSTRING like: NATIVELSBSTRING = "gentoo-'2.18'" And similarly the directory name in sstate-cache: oe-core $ ls -d sstate-cache/gentoo-* "sstate-cache/gentoo-'2.18'" sstate-cache/gentoo-2.18 (From OE-Core rev: 9906255a99f13bf6feefca11e8305364efce6450) Signed-off-by: Martin Jansa Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 55f82653deb1ea8f1304fcba4d588bd55695b616) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

spdx30_tasks: Exclude 'doc' when exporting PACKAGECONFIG to SPDX

2026-02-27T17:45:06+00:00

Currently when generating an SBOM, all packages have the 'doc' feature indicated as disabled. This is in fact *not* a feature that was declared in the recipe, but instead the documentation of the PACKAGECONFIG variable. But to be safe, if somehow a feature is named 'doc' and enabled, do not exclude it when exporting PACKAGECONFIG features to SPDX. (From OE-Core rev: 87de87206b71bb165b946d5f4f6e9e5395292179) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 933394adcb0d2db66ef7e0656a464241e58ec2e7) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX

2025-12-31T15:49:31+00:00

Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes PACKAGECONFIG features to be recorded in the SPDX document as build parameters. Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG: and value enabled or disabled, depending on whether the feature is active in the current build. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. In particular, it allows consumers of the SBOM to identify enabled/disabled features that may affect security posture or feature set. Reviewed-by: Joshua Watt (From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4) Signed-off-by: Steve Sakoman

Revert "lib/oe/go: document map_arch, and raise an error on unknown architecture"

2025-12-17T16:48:38+00:00

This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1. This introduced a breaking change which is not suitable for backport to stable LTS branches. (From OE-Core rev: 2b3d2b671a149cbeea2bdc9ba42192da2015c3b7) Signed-off-by: Peter Marko Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

cve-check: extract extending CVE_STATUS to library function

2025-12-01T15:34:55+00:00

The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman

spdx30: provide all CVE_STATUS, not only Patched status

2025-12-01T15:34:55+00:00

In scarthgap, the `oe.cve_check.get_patched_cves()` method only returns CVEs with a "Patched" status. We want to retrieve all annotations, including those with an "Ignored" status. Therefore, to avoid modifying the current API, we integrate the logic for retrieving all CVE_STATUS values directly into `spdx30_task`. (From OE-Core rev: 9a204670b1c0daedf1ed8ff944f8e5443b39c8f7) Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Steve Sakoman

Revert "spdx: Update for bitbake changes"

2025-12-01T15:34:54+00:00

This reverts part of commit 4859cdf97fd9a260036e148e25f0b78eb393df1e. Modification of meta/classes/create-spdx-2.2.bbclass is not backported, so no need to consider it. In the commit, it updates spdx according to bitbake change. But the bitbake commit * 2515fbd10 fetch: Drop multiple branch/revision support for single git urls doesn't backport for scarthgap. So revert the other parts of the commit 4859cdf97fd9a260036e148e25f0b. (From OE-Core rev: f3bfb98d1cf928678d9931308c116e9e6ec64ba5) Signed-off-by: Kai Kang Signed-off-by: Steve Sakoman

lib/oe/go: document map_arch, and raise an error on unknown architecture

2025-11-26T15:50:35+00:00

Add a comment explaining what this function does and where the values come from. If the architecture isn't know, instead of returning an empty string which could fail mysteriously, raise a KeyError so it fails quickly. (From OE-Core rev: 025414c16319b068df1cd757ad9a3c987a6b871d) (From OE-Core rev: e6de433ccb2784581d6c775cce97f414ef9334b1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman