linux/poky.git/meta/lib, branch yocto-5.0.14

oeqa: spdx: Add tar test for SPDX 2.2

2025-11-14T14:45:30+00:00

The base-files test for SPDX 2.2 did not give good coverage, since base-files doesn't have any dependencies. Add building tar as another test which more fully exercises the code (From OE-Core rev: 2c299c17ef1a97505fd7de8d3ebc9de25fb838fc) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

spdx30_tasks: adapt CVE handling to new cve-check API

2025-11-14T14:45:30+00:00

Changes to cve-check (see poky commit fb3f440b7d8, "cve-check: annotate CVEs during analysis") modified the get_patched_cves() API to return a set of CVE IDs instead of a dictionary of CVE metadata. The SPDX 3 backport still expected a dictionary and attempted to call .items(), leading to: AttributeError: 'set' object has no attribute 'items' This patch updates the SPDX3 code to iterate directly over the CVE IDs and use `oe.cve_check.decode_cve_status()` to retrieve the mapping, detail, and description for each CVE. This restores compatibility with the updated CVE API and matches the behavior of SPDX3 handling on Walnascar. A warning is logged if a CVE has missing or unknown status. (From OE-Core rev: 55fdeea44ffbecb705f7900bfa85ab88e1191878) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Steve Sakoman

spdx 3.0: Rework how SPDX aliases are linked

2025-11-14T14:45:30+00:00

The SPDX code needs to be able to look up an Element by its SPDX ID, locating the file that (should) contain the SPDX ID and opening it for parsing. Previously, the code would do this be hashing each Element SPDX ID and Alias, and the creating a symbolic link to the file that contains the element with a name of the hash. This worked well as it was possible to look up any arbitrary SPDX ID or alias by simply hashing it and following the symbolic link to get the file. However, the down side of this approach is that it creates a lot of symbolic links, since it will make one or two per Element in the document. This can be a problem when using SPDX_INCLUDE_SOURCES, for example. This change reworks this strategy so that the only Element that gets a symbolic link based on the hash is the singular SpdxDocument that is create for each file. All other Elements are assigned an alias with a special prefix that encodes the hash of SpdxDocument alias. Thus, when attempting to look up an arbitrary alias, the code sees the special prefix, extract the hash, opens the file based on the symlink with that hash name, then finds the matching Element in the file. This drastically reduces the number of symbolic links by making only one per file. This also means that the custom link extension can be removed since it is now superfluous. (From OE-Core rev: 551433c7a1eddf5090c87a243ea104bf091992b0) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit 838d64c09657ac53175737fc4e7fd6f01f3dcf47) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Steve Sakoman

lib: oeqa: spdx: Add tests for extra options

2025-11-14T14:45:30+00:00

Adds a test for several of the extra options provided by the SPDX classes. In particular, these are the options that can produce non-reproducible results, so are not enabled by default in OE core. This test takes care to configure the build so that the tests do run in a reproducible manner so that pre-built test objects can be pulled from sstate (From OE-Core rev: 72ee311d4f74499674a29223fb02d4e774097a54) Signed-off-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 14f534f15f7fe6362723d7f064d39783c5bd758f) Signed-off-by: Kamel Bouhara (Schneider Electric) Signed-off-by: Steve Sakoman

oeqa/selftest: Add SPDX 3.0 include source case for work-share

2025-11-14T14:45:30+00:00

Build gcc and check gcc-14.2.0/README in objset is available $ oe-selftest -r spdx.SPDX30Check.test_gcc_include_source ... 2024-10-26 01:24:57,063 - oe-selftest - INFO - test_gcc_include_source (spdx.SPDX30Check.test_gcc_include_source) 2024-10-26 01:28:24,204 - oe-selftest - INFO - The spdxId of gcc-14.2.0/README in gcc.spdx.json is http://spdx.org/spdxdocs/gcc-f2eaeb0d-b54b-53ba-899a-8c36c21139bf/88d5068ffd41e5ea6b4e0dd390b23bf499bb2b6674a41e09eaf2a887eced16c8/sourcefile/42 2024-10-26 01:28:26,369 - oe-selftest - INFO - ... ok 2024-10-26 01:28:33,315 - oe-selftest - INFO - ---------------------------------------------------------------------- 2024-10-26 01:28:33,316 - oe-selftest - INFO - Ran 1 test in 216.457s 2024-10-26 01:28:33,316 - oe-selftest - INFO - OK 2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS: 2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS - spdx.SPDX30Check.test_gcc_include_source: PASSED (209.31s) 2024-10-26 01:28:45,260 - oe-selftest - INFO - SUMMARY: 2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest () - Ran 1 test in 216.457s 2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=1, skipped=0, failures=0, errors=0) (From OE-Core rev: 45f3039a4f0fcea208e317ed7134458f7aa7a4cc) Signed-off-by: Hongxu Jia Reviewed-by: Joshua Watt Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit ccd6dde301dc8c45c8f901ebd4676b488d638b08) Signed-off-by: Steve Sakoman

selftest: spdx: Add SPDX 3.0 test cases

2025-11-14T14:45:30+00:00

Adds test cases for SPDX 3.0. Reworks the SPDX 2.2 test setup so it can also be run even if the default is SPDX 3.0 (From OE-Core rev: e182f76a866d4d750d2baf7b56ffebead5264de2) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit b1d2309b3ab0fd8b0d8c4dfa59f50c85074bbd3b) Signed-off-by: Steve Sakoman

selftest/spdx: Fix for SPDX_VERSION addition

2025-11-14T14:45:30+00:00

Update the test for the addition of SPDX_VERSION to the deploy path. (From OE-Core rev: d75bfbaf69292f80cacc5b8d6cbff03418a34ebc) Signed-off-by: Richard Purdie (cherry picked from commit 055e8c21908127722abad9e992d6408d8697a119) Signed-off-by: Steve Sakoman

lib: oe: license: Add missing import

2025-11-14T14:45:29+00:00

The code in this file uses oe.qa, but it was not imported resulting an an exception when a license error was detected (From OE-Core rev: f8aa42faa3640d0414745ae32b00a37b2f5d638b) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit e44cb7c5b7281d614ed51fdec06dad0a7211528a) Signed-off-by: Steve Sakoman

lib/license: Move package license skip to library

2025-11-14T14:45:29+00:00

Moves the code that skips packages with incompatible licenses to the library code so that it can be called in other locations (From OE-Core rev: 4f7a047c4a1e14bbb3bf593764aace1e25bcd4a4) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit 86eb409e3c1b30110869ec5a0027ae2d48bbfe7f) Signed-off-by: Steve Sakoman

classes-global/license: Move functions to library code

2025-11-14T14:45:29+00:00

Moves several of the functions in license.bbclass to be library code New function dependencies were manually verified using bitbake-dumpsigs to ensure that bitbake identified the same dependencies even though they are now in library code (although the new function names mean that the task hashes still change) (From OE-Core rev: 5e220e20833fd800687b05c8f5cef602dfc47202) Signed-off-by: Joshua Watt Signed-off-by: Richard Purdie (cherry picked from commit 0333e04e353991260c5f67a72f80f3ab9dcf526a) Signed-off-by: Steve Sakoman