linux/poky.git/meta/lib, branch 5.3_M1

spdx: add option to include only compiled sources

2025-06-17T22:38:18+00:00

When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. Tested with bitbake world on oe-core. CC: Quentin Schulz CC: Joshua Watt CC: Peter Marko (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Signed-off-by: Daniel Turull Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

wic: Update after plugin name changes

2025-06-16T16:57:30+00:00

Update the plugin names to account for the "-" to "_" plugin name change. (From OE-Core rev: afa1b5c9f6ed17c021e37a54d0d6abee50a60bf9) Signed-off-by: Richard Purdie

oe/license_finder: support extra hashes being passed to find_licenses

2025-06-16T16:57:30+00:00

When using the license finder the caller might know some more license hashes, for example if it is updating existing metadata. Allow the caller to pass more hashes that can be used when identifying licenses. (From OE-Core rev: 9011bc307fcdccb144b75d77b36bbc5c8d4bd96d) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: rewrite license checksum loading, scan more licenses

2025-06-16T16:57:30+00:00

Rewrite the license checksum generation and loading of CSV files to be clearer. This also expands the scan of COMMON_LICENSE_DIR to include LICENSE_PATH, which can be extended by layers to provide more license texts. (From OE-Core rev: 417240ba7a9b3985530988940a222b079b503b64) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: don't return the "crunched" license text in crunch_license

2025-06-16T16:57:30+00:00

crunch_license() will perform some basic text manipulation to try and canonicalise the license texts. It also returns the new license text but none of the callers use this, and as a slightly mangled version of the original it has no real purpose. Remove this return value and clean up the callers. (From OE-Core rev: 34603ed3b4919dcfba19ef57db11a6d3bb2704f1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: remove unused arguments in get_license_md5sums

2025-06-16T16:57:30+00:00

get_license_md5sums() has two optional arguments: - static_only: if set, don't checksum the licenses in COMMON_LICENSE_DIR - linenumbers: if set, the CSV file can contain begin/end/md5 values as used in LIC_FILES_CHKSUM. Neither of these are used and complicate the logic, so remove them. (From OE-Core rev: 148e501bd4fe65e7bed68d086ba98180a9b2483c) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: consolidate hash->license maps

2025-06-16T16:57:30+00:00

There are two locations where mappings of checksums to license names are: the license-hashes.csv file and a hard-coded set of assignments in the code. There's no need for two, so remove the assignments and move the hashes into the CSV file. (From OE-Core rev: a775c6cb5a2bf1f30a94ba3b88af9aa491e98b1a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: add first_only argument to find_licenses()

2025-06-16T16:57:30+00:00

It may be desired to find only the "top-level" license file instead of every potential candidate, so add a first_only argument (defaulting to False to preserve existing behaviour) to return just the first license found. (From OE-Core rev: 995936ffda02a1def1863490ec315783a7470c72) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

oe/license_finder: skip .sh files when looking for licenses

2025-06-16T16:57:30+00:00

Shell scripts are not licenses, so skip them. (From OE-Core rev: 0ce9ad80d3b90edc1d1e690763e8f3d9f0cd523d) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

lib/oe/license_finder: extract license finding code from recipetool

2025-06-16T16:57:30+00:00

This code is 99% identical to the original code in recipetool/create.py, but with two minor changes: - The implicit recipetool logger is changed to an explicit logger - The CSV of license hashes is moved to meta/files/ (From OE-Core rev: b132652c6e520121c6b0e7e873b0d33ede0309b5) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie