diff options
| author | Daniel Turull <daniel.turull@ericsson.com> | 2025-06-19 10:47:36 +0200 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2025-07-07 07:42:58 -0700 |
| commit | 2366605a35443565e259d03791d7b662c6ea03e2 (patch) | |
| tree | 96c219df0c6c47d1bf0342b4bfbc39bcee4d682f /scripts/lib/scriptpath.py | |
| parent | 5b7a6dec8542968b5062e4da407e322dda50326b (diff) | |
| download | poky-2366605a35443565e259d03791d7b662c6ea03e2.tar.gz | |
spdx: add option to include only compiled sources
When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the
source code files that are used during compilation.
It uses debugsource information generated during do_package.
This enables an external tool to use the SPDX information to disregard
vulnerabilities that are not compiled.
As example, when used with the default config with linux-yocto, the spdx size is
reduced from 156MB to 61MB.
Tested with bitbake world on oe-core.
(From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968)
Adapted to existing files for create-spdx-2.2
CC: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
CC: Joshua Watt <JPEWhacker@gmail.com>
(From OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'scripts/lib/scriptpath.py')
0 files changed, 0 insertions, 0 deletions