summaryrefslogtreecommitdiffstats
path: root/meta/lib
Commit message (Collapse)AuthorAgeFilesLines
* oeqa/selftest: oe-selftest: Add SPDX tests for kernel config and PACKAGECONFIGKamel Bouhara (Schneider Electric)2025-12-311-0/+57
| | | | | | | | | | | | | | | Add test_kernel_config_spdx and test_packageconfig_spdx to verify SPDX document generation includes kernel configuration and package feature metadata when enabled. (From OE-Core rev: a172a0e8d543796ee78bb66650726168352f1cdf) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2f0ab110d7521510c60e0493ef3cb021130758cd) Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDXKamel Bouhara (Schneider Electric)2025-12-311-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes PACKAGECONFIG features to be recorded in the SPDX document as build parameters. Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG:<feature> and value enabled or disabled, depending on whether the feature is active in the current build. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. This makes the build-time configuration more transparent in SPDX output and improves reproducibility tracking. In particular, it allows consumers of the SBOM to identify enabled/disabled features that may affect security posture or feature set. Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> (From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "lib/oe/go: document map_arch, and raise an error on unknown ↵Peter Marko2025-12-171-5/+1
| | | | | | | | | | | | | | | architecture" This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1. This introduced a breaking change which is not suitable for backport to stable LTS branches. (From OE-Core rev: 2b3d2b671a149cbeea2bdc9ba42192da2015c3b7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: extract extending CVE_STATUS to library functionBenjamin Robin (Schneider Electric)2025-12-011-0/+22
| | | | | | | | | | | | | | | | | | | The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and CVE_STATUS_GROUPS is used on multiple places. Create a library function to have the code on single place and ready for reuse by additional classes. Conflicts: meta/classes/cve-check.bbclass meta/lib/oe/cve_check.py (From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30: provide all CVE_STATUS, not only Patched statusBenjamin Robin (Schneider Electric)2025-12-011-14/+17
| | | | | | | | | | | | | In scarthgap, the `oe.cve_check.get_patched_cves()` method only returns CVEs with a "Patched" status. We want to retrieve all annotations, including those with an "Ignored" status. Therefore, to avoid modifying the current API, we integrate the logic for retrieving all CVE_STATUS values ​​directly into `spdx30_task`. (From OE-Core rev: 9a204670b1c0daedf1ed8ff944f8e5443b39c8f7) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "spdx: Update for bitbake changes"Kai Kang2025-12-012-63/+64
| | | | | | | | | | | | | | | | | | | | | This reverts part of commit 4859cdf97fd9a260036e148e25f0b78eb393df1e. Modification of meta/classes/create-spdx-2.2.bbclass is not backported, so no need to consider it. In the commit, it updates spdx according to bitbake change. But the bitbake commit * 2515fbd10 fetch: Drop multiple branch/revision support for single git urls doesn't backport for scarthgap. So revert the other parts of the commit 4859cdf97fd9a260036e148e25f0b. (From OE-Core rev: f3bfb98d1cf928678d9931308c116e9e6ec64ba5) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/buildepoxy: skip test in eSDKPeter Marko2025-11-261-0/+4
| | | | | | | | | | | | | | Currently meson inside eSDKs only works with fully populated eSDKs, but our testing uses minimal eSDKS, so skip the test if the eSDK is a minimal build. A bug has been filed to resolve this. This is minimal change extracted from OE-Core commit which has this only as a minor comment: 575e0bf52db0467d88af4b5fe467b682f10ca62a (From OE-Core rev: 7cfacaee1b3319e561036512a849e762d0f68a5e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa: drop unnecessary dependency from go runtime testsPeter Marko2025-11-261-2/+0
| | | | | | | | | The tests do not use scp command, so openssh-scp is not needed. (From OE-Core rev: 4e10e7848cb10307f133f181b41563c995df032a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa: fix package detection in go sdk testsPeter Marko2025-11-261-4/+4
| | | | | | | | | | | | | | | | | | | | | | | The test are skipped if architecture contains dash because TARGET_ARCH contains underscore while package name contains dash. Here the translation needs to be done. Note that poky distro default arch has dash: MACHINE="qemux86-64" TARGET_ARCH="x86_64" ERROR: Nothing PROVIDES 'go-cross-canadian-x86_64'. Close matches: gcc-cross-canadian-x86-64 gdb-cross-canadian-x86-64 go-cross-canadian-x86-64 TRANSLATED_TARGET_ARCH="x86-64" Quoting meta/classes-recipe/cross-canadian.bbclass: TRANSLATED_TARGET_ARCH is added into PN (From OE-Core rev: 82a46b70bfba7c4ce4fd20e2658b182b03e55037) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: remove duplicate arch map in sdk testOsama Abdelkader2025-11-261-26/+5
| | | | | | | | | | | | | | | ARCH_MAP is duplicating an existing map in meta/lib/oe/go.py use oe.go map_arch instead. (From OE-Core rev: c2ba36f41777d347fd5ffcd9b6862638e5f35a1b) (From OE-Core rev: 21f3a6c661307eab5530b51704c3a338013c9c5c) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: extend runtime testOsama Abdelkader2025-11-262-0/+75
| | | | | | | | | | | | | | | | extend go runtime test with a simple test file, and simple go module test to validate go compilation and execution on target. (From OE-Core rev: e3b2b9170f76f4bbdc41ea6ba7bccffc17d01968) (From OE-Core rev: bda3e3711f84394423c15f48fb4e75258fec199a) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: add sdk testOsama Abdelkader2025-11-261-0/+128
| | | | | | | | | | | | | | | | | - Add meta/lib/oeqa/sdk/cases/go.py with GoCompileTest and GoHostCompileTest classes - Test validates Go cross-compilation toolchain functionality - Includes native compilation, cross-compilation, and Go module support - Uses dynamic architecture detection for portability (From OE-Core rev: 17015f692a6bf3697a89db51bbc4673a5efa1497) (From OE-Core rev: 506f4e8c99b164673ba7d1c19e10d240f4df0376) Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib/oe/go: document map_arch, and raise an error on unknown architectureRoss Burton2025-11-261-1/+5
| | | | | | | | | | | | | | | | | Add a comment explaining what this function does and where the values come from. If the architecture isn't know, instead of returning an empty string which could fail mysteriously, raise a KeyError so it fails quickly. (From OE-Core rev: 025414c16319b068df1cd757ad9a3c987a6b871d) (From OE-Core rev: e6de433ccb2784581d6c775cce97f414ef9334b1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oe/sdk: fix empty SDK manifestsRoss Burton2025-11-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SDK manifests are generated by listing the sstate was that used, but it hardcodes that the sstate data filenames end in .tgz. This has not been the case since sstate switched to Zstd[1] in 2021, which meant that all of the tests which checked for packages existing were being skipped as the manifests were empty. For example, see a representative core-image-sato eSDK test run[2]: RESULTS - cmake.CMakeTest.test_assimp: SKIPPED (0.00s) RESULTS - gtk3.GTK3Test.test_galculator: SKIPPED (0.00s) RESULTS - kmod.KernelModuleTest.test_cryptodev: SKIPPED (0.00s) RESULTS - maturin.MaturinDevelopTest.test_maturin_develop: SKIPPED (0.00s) RESULTS - maturin.MaturinTest.test_maturin_list_python: SKIPPED (0.00s) RESULTS - meson.MesonTest.test_epoxy: SKIPPED (0.00s) RESULTS - perl.PerlTest.test_perl: SKIPPED (0.00s) RESULTS - python.Python3Test.test_python3: SKIPPED (0.00s) All of those tests should have been ran. Solve this by generalising the filename check so that it doesn't care what specfic compression algorithm is used. [1] oe-core 0710e98f40e ("sstate: Switch to ZStandard compressor support") [2] https://autobuilder.yoctoproject.org/valkyrie/#/builders/16/builds/1517/steps/15/logs/stdio (From OE-Core rev: 062a525bd36c672f372dabe8d9f0fbe355c7e58b) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* testsdk: allow user to specify which tests to runRoss Burton2025-11-262-2/+4
| | | | | | | | | | | | | | | | | | Following the usage of TEST_SUITES in testimage, add TESTSDK_SUITES to specify the list of tests to execute. By default the variable is empty, which means to run all discovered tests. This makes it easier to work on a single test without having to run all of the tests. (From OE-Core rev: 28d437c52c77889b2ede0fc2f2d6777c5b0a553d) (From OE-Core rev: a93e21419476658f24220193fb0183efeb7a184f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30: Provide software_packageUrl field in SPDX 3.0 SBOMHongxu Jia2025-11-261-0/+8
| | | | | | | | | | | | | | | | | | | | | | | Define var-SPDX_PACKAGE_URL to provide software_packageUrl field [1][2] in SPDX 3.0 SBOM, support to override with package name SPDX_PACKAGE_URL:<pkgname> Currently, the format of purl is not defined in Yocto, set empty for now until we have a comprehensive plan for what Yocto purls look like. But users could customize their own purl by setting var-SPDX_PACKAGE_URL [1] https://spdx.github.io/spdx-spec/v3.0.1/model/Software/Properties/packageUrl/ [2] https://spdx.github.io/spdx-spec/v3.0.1/annexes/pkg-url-specification/ (From OE-Core rev: c8e6953a0b6f59ffca994c440069db39e60b12d2) (From OE-Core rev: 60724efdb3a243bc796b390ad0c478584a0fb7fa) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30: fix cve status for patch files in VEXPeter Marko2025-11-261-1/+7
| | | | | | | | | | | | | | | | | | | | This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98 which adapts vex creation between function create_spdx where all changes were backported and funtion get_patched_cves where changes were not backported. CVE patches were previously ignored as they cannot be decoded from CVE_STATUS variables and each caused a warning like: WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — missing or unknown CVE status Master branch uses fix-file-included for CVE patches however since cve-check-map.conf was not part of spdx-3.0 backport, closest one available (backported-patch) was implemented. (From OE-Core rev: 8d14b2bb02861612130f02c445392f34090ba5d9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa: spdx: Add tar test for SPDX 2.2Joshua Watt2025-11-141-2/+5
| | | | | | | | | | | | The base-files test for SPDX 2.2 did not give good coverage, since base-files doesn't have any dependencies. Add building tar as another test which more fully exercises the code (From OE-Core rev: 2c299c17ef1a97505fd7de8d3ebc9de25fb838fc) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30_tasks: adapt CVE handling to new cve-check APIKamel Bouhara (Schneider Electric)2025-11-141-17/+12
| | | | | | | | | | | | | | | | | | | | | | | | | Changes to cve-check (see poky commit fb3f440b7d8, "cve-check: annotate CVEs during analysis") modified the get_patched_cves() API to return a set of CVE IDs instead of a dictionary of CVE metadata. The SPDX 3 backport still expected a dictionary and attempted to call .items(), leading to: AttributeError: 'set' object has no attribute 'items' This patch updates the SPDX3 code to iterate directly over the CVE IDs and use `oe.cve_check.decode_cve_status()` to retrieve the mapping, detail, and description for each CVE. This restores compatibility with the updated CVE API and matches the behavior of SPDX3 handling on Walnascar. A warning is logged if a CVE has missing or unknown status. (From OE-Core rev: 55fdeea44ffbecb705f7900bfa85ab88e1191878) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx 3.0: Rework how SPDX aliases are linkedJoshua Watt2025-11-141-13/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SPDX code needs to be able to look up an Element by its SPDX ID, locating the file that (should) contain the SPDX ID and opening it for parsing. Previously, the code would do this be hashing each Element SPDX ID and Alias, and the creating a symbolic link to the file that contains the element with a name of the hash. This worked well as it was possible to look up any arbitrary SPDX ID or alias by simply hashing it and following the symbolic link to get the file. However, the down side of this approach is that it creates a lot of symbolic links, since it will make one or two per Element in the document. This can be a problem when using SPDX_INCLUDE_SOURCES, for example. This change reworks this strategy so that the only Element that gets a symbolic link based on the hash is the singular SpdxDocument that is create for each file. All other Elements are assigned an alias with a special prefix that encodes the hash of SpdxDocument alias. Thus, when attempting to look up an arbitrary alias, the code sees the special prefix, extract the hash, opens the file based on the symlink with that hash name, then finds the matching Element in the file. This drastically reduces the number of symbolic links by making only one per file. This also means that the custom link extension can be removed since it is now superfluous. (From OE-Core rev: 551433c7a1eddf5090c87a243ea104bf091992b0) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 838d64c09657ac53175737fc4e7fd6f01f3dcf47) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib: oeqa: spdx: Add tests for extra optionsJoshua Watt2025-11-141-14/+104
| | | | | | | | | | | | | | | | | | Adds a test for several of the extra options provided by the SPDX classes. In particular, these are the options that can produce non-reproducible results, so are not enabled by default in OE core. This test takes care to configure the build so that the tests do run in a reproducible manner so that pre-built test objects can be pulled from sstate (From OE-Core rev: 72ee311d4f74499674a29223fb02d4e774097a54) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 14f534f15f7fe6362723d7f064d39783c5bd758f) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/selftest: Add SPDX 3.0 include source case for work-shareHongxu Jia2025-11-141-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | Build gcc and check gcc-14.2.0/README in objset is available $ oe-selftest -r spdx.SPDX30Check.test_gcc_include_source ... 2024-10-26 01:24:57,063 - oe-selftest - INFO - test_gcc_include_source (spdx.SPDX30Check.test_gcc_include_source) 2024-10-26 01:28:24,204 - oe-selftest - INFO - The spdxId of gcc-14.2.0/README in gcc.spdx.json is http://spdx.org/spdxdocs/gcc-f2eaeb0d-b54b-53ba-899a-8c36c21139bf/88d5068ffd41e5ea6b4e0dd390b23bf499bb2b6674a41e09eaf2a887eced16c8/sourcefile/42 2024-10-26 01:28:26,369 - oe-selftest - INFO - ... ok 2024-10-26 01:28:33,315 - oe-selftest - INFO - ---------------------------------------------------------------------- 2024-10-26 01:28:33,316 - oe-selftest - INFO - Ran 1 test in 216.457s 2024-10-26 01:28:33,316 - oe-selftest - INFO - OK 2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS: 2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS - spdx.SPDX30Check.test_gcc_include_source: PASSED (209.31s) 2024-10-26 01:28:45,260 - oe-selftest - INFO - SUMMARY: 2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest () - Ran 1 test in 216.457s 2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=1, skipped=0, failures=0, errors=0) (From OE-Core rev: 45f3039a4f0fcea208e317ed7134458f7aa7a4cc) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ccd6dde301dc8c45c8f901ebd4676b488d638b08) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest: spdx: Add SPDX 3.0 test casesJoshua Watt2025-11-141-9/+124
| | | | | | | | | | | | Adds test cases for SPDX 3.0. Reworks the SPDX 2.2 test setup so it can also be run even if the default is SPDX 3.0 (From OE-Core rev: e182f76a866d4d750d2baf7b56ffebead5264de2) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b1d2309b3ab0fd8b0d8c4dfa59f50c85074bbd3b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/spdx: Fix for SPDX_VERSION additionRichard Purdie2025-11-141-1/+2
| | | | | | | | | | Update the test for the addition of SPDX_VERSION to the deploy path. (From OE-Core rev: d75bfbaf69292f80cacc5b8d6cbff03418a34ebc) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 055e8c21908127722abad9e992d6408d8697a119) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib: oe: license: Add missing importJoshua Watt2025-11-141-0/+1
| | | | | | | | | | | | The code in this file uses oe.qa, but it was not imported resulting an an exception when a license error was detected (From OE-Core rev: f8aa42faa3640d0414745ae32b00a37b2f5d638b) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e44cb7c5b7281d614ed51fdec06dad0a7211528a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib/license: Move package license skip to libraryJoshua Watt2025-11-141-0/+39
| | | | | | | | | | | | Moves the code that skips packages with incompatible licenses to the library code so that it can be called in other locations (From OE-Core rev: 4f7a047c4a1e14bbb3bf593764aace1e25bcd4a4) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 86eb409e3c1b30110869ec5a0027ae2d48bbfe7f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes-global/license: Move functions to library codeJoshua Watt2025-11-141-0/+163
| | | | | | | | | | | | | | | | Moves several of the functions in license.bbclass to be library code New function dependencies were manually verified using bitbake-dumpsigs to ensure that bitbake identified the same dependencies even though they are now in library code (although the new function names mean that the task hashes still change) (From OE-Core rev: 5e220e20833fd800687b05c8f5cef602dfc47202) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0333e04e353991260c5f67a72f80f3ab9dcf526a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx30_tasks: fix FetchData attribute in add_download_filesKamel Bouhara (Schneider Electric)2025-11-141-1/+1
| | | | | | | | | | | | | | The add_download_files() function incorrectly accessed fd.name, which does not exist on FetchData objects. Change to use fd.names[0] to correctly retrieve the first filename. This fixes AttributeError during SPDX document generation. (From OE-Core rev: 17031d71cf4bc4fc19dd8a41c49b94e1f6a1edee) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* backport: SPDX 3.0 fixes and tasks from upstream version WalnascarKamel Bouhara (Schneider Electric)2025-11-145-1/+8282
| | | | | | | | | | | Backports the SPDX 3.0 support and fixes from upstream walnascar commit 49f47169953b807d430461ca33f3a2b076119712 into upstream scarthgap. (From OE-Core rev: 9c9b9545049a2f6e5c99edcb079275d29a4d1ac6) Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/selftest/devtool: Update after upstream repo changesRichard Purdie2025-11-141-4/+4
| | | | | | | | | | | | | | | The upstream changed the branch name, moving to archive/ so we need to update too. Take the opportunity to match the new location too to avoid the redirect. We could use a different branch but upstream would probably eventually rename that too so this may last longer. (From OE-Core rev: 1e0a64a1890a62e130595f46d93c8d08af9170f5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 478a645bad150f04dee1b0085c4542c2eefe7007) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/runtime/ping: don't bother trying to ping localhostMichael Haener2025-10-241-0/+7
| | | | | | | | | | | | | | | | | | | | | If SLIRP is being used instead of TAP for networking to the guest then the target IP will be localhost. There's no point in pinging localhost to see if the target is up but whilst you'd think it is harmless, in some containers ping doesn't actually have enough rights to work: ping: socktype: SOCK_RAW ping: socket: Operation not permitted ping: => missing cap_net_raw+p capability or setuid? Look at the target address and if it's localhost or 127.0.0.* return immediately. (Backport from OE-Core rev: a06ef43d2a50e16c32bd6edbdc7b32c3528687d5) (From OE-Core rev: 649147913e89cd8f7390cb17cd0be94c9710ffa6) Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main serverSteve Sakoman2025-10-131-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: b0ce480eca6397fab71082ed202c3cf9dd02456f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/cases/meta_ide.py: use use gnu mirror instead of main serverSteve Sakoman2025-10-131-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: aa7ff5a115f55c092f8ca5badad63734c8f4f5b7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lib/oe/utils: use multiprocessing from bbMartin Jansa2025-09-301-1/+2
| | | | | | | | | | | | | | | | | | Fixes build with python-3.14 It was added to bitbake in 62be9113d98fccb347c6aa0a10d5c4ee2857f8b6 and oe-core now requires latest bitbake already, so we can use this. [YOCTO #15858] (From OE-Core rev: 92369c8acf0b4d6c2ced88abbda5f5defd276ba2) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* license.py: avoid deprecated ast.StrMartin Jansa2025-09-221-2/+2
| | | | | | | | | | | | | | | | | | | | | * it's deprecated since python-3.12 and removed in 3.14 causing: openembedded-core/meta/lib/oe/license.py', lineno: 176, function: visit 0172: 0173: LicenseVisitor.__init__(self) 0174: 0175: def visit(self, node): *** 0176: if isinstance(node, ast.Str): 0177: lic = node.s 0178: 0179: if license_ok(self._canonical_license(self._d, lic), 0180: self._dont_want_licenses) == True: Exception: AttributeError: module 'ast' has no attribute 'Str' (From OE-Core rev: df9898f13c261eeac2cc343569c843bc7dcaf163) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issueDeepak Rathore2025-09-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default CONNECTIVITY_CHECK_URIS uses "https://yoctoproject.org/connectivity.html" which redirect to "https://www.yoctoproject.org/connectivity.html". Some network configurations with proxies or restricted internet access don't handle HTTP redirects properly during the sanity check phase, causing build failures with: ERROR: OE-core's config sanity checker detected a potential misconfiguration. Either fix the cause of this error or at your own risk disable the checker (see sanity.conf). Following is the list of potential problems / advisories: Fetcher failure for URL: 'https://yoctoproject.org/connectivity.html'. URL doesn't work. Updated the default URL to use the final destination directly to avoid redirect-related connectivity check failures. Also updated SDK test cases in https.py to use the corrected URL for consistency. (From OE-Core rev: bd624ebbcf4e6d7a24c4ab232ca2e138b1ac3433) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60cdf960a3560f391babd559737f1afb31fb2c5c) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* spdx: add option to include only compiled sourcesDaniel Turull2025-07-071-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | When SPDX_INCLUDE_COMPILED_SOURCES is enabled, only include the source code files that are used during compilation. It uses debugsource information generated during do_package. This enables an external tool to use the SPDX information to disregard vulnerabilities that are not compiled. As example, when used with the default config with linux-yocto, the spdx size is reduced from 156MB to 61MB. Tested with bitbake world on oe-core. (From OE-Core rev: c6a2f1fca76fae4c3ea471a0c63d0b453beea968) Adapted to existing files for create-spdx-2.2 CC: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> CC: Joshua Watt <JPEWhacker@gmail.com> (From OE-Core rev: a2866934e58fb377a73e87576c8594988a63ad1b) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* package: export debugsources in PKGDESTWORK as jsonDaniel Turull2025-07-071-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | The source information used during packaging can be use from other tasks to have more detailed information on the files used during the compilation and improve SPDX accuracy. Source files used during compilation are store as compressed zstd json in pkgdata/debugsources/$PN-debugsources.json.zstd Format: { binary1: [src1, src2, ...], binary2: [src1, src2, ...] } I checked the sstate size, and it slightly increases using core-image-full-cmdline: without patch: 2456792 KB sstate-cache/ with patch: 2460028 KB sstate-cache/ (4236 KB or 0.17%) (From OE-Core rev: c507dcb8a8780a42bfe68b1ebaff0909b4236e6b) Adaptations to match spdx in scarthgap: change BP to PF CC: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> CC: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: cba53212f5debf897752453364b9756a05c197de) Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sstatetests: Switch to new CDNRichard Purdie2025-06-051-1/+1
| | | | | | | | | | | The project is switching the way handle our CDN provision of sstate objects, update the URL accordingly. (From OE-Core rev: d1b64f190c1686f081f5ba2c4f2b320048f6a514) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fea96974f1ee6ae6dceb39e3ca8157797d81586c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* patch.py: set commituser and commitemail for addNoteChangqing Li2025-04-161-6/+8
| | | | | | | | | | | | | | | | | | When PATCHTOOL is set to 'git', and user don't setup user.name and user.email for git, do_patch fail with the following error, fix by passing -c options. CmdError("git notes --ref refs/notes/devtool append -m 'original patch: 0001-PATCH-increase-to-cpp17-version.patch' HEAD", 0, 'stdout: stderr: Author identity unknown *** Please tell me who you are. Run git config --global user.email "you@example.com" git config --global user.name "Your Name" (From OE-Core rev: 9de38ac99c2b19f549c00ea5277faf621c6f4e65) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/rust: correctly form the PATH environment variableAlexander Kanavin2025-02-121-3/+2
| | | | | | | | | | | | | | | | | | | | There were two issues here: - the path to native python was not included, so the test suite was running with host python, causing failures due to host python being given native libraries: https://autobuilder.yoctoproject.org/typhoon/#/builders/148/builds/1711/steps/12/logs/stdio (rust recipe uses native python throughout) - tmp/hosttools was listead ahead of native-sysroot/usr/bin (From OE-Core rev: 72156282059aa5a013a386eb95f89dc38726326e) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aec96b5aec8d6b4a5ae8a719ca05bb727a6197cb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/selftest/rust: skip on all MIPS platformsRoss Burton2025-02-121-5/+3
| | | | | | | | | | | | | | | | | | | | | As per "The rustc book"[1], mips*-unknown-linux-* are "tier 3" targets: Tier 3 targets are those which the Rust codebase has support for, but which the Rust project does not build or test automatically, so they may or may not work. We already skip qemumips in this selftest, but we're now also seeing failures with qemumips64 so refactor the test to skip all machines where the architecture is mips or mips64. [1] https://doc.rust-lang.org/nightly/rustc/platform-support.html (From OE-Core rev: 681f5ea8d6a5050aebfb1f656da9ba679433e366) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 177e268811c04260923ac4b16fa047315304add0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/context: fix for gtk3 test failure during do_testsdkHarish Sadineni2025-02-121-5/+7
| | | | | | | | | | | | | | | | The do_testsdk for lib32-core-image-sato aborts with below error: configure: error: Package requirements (gtk+-3.0) were not met: No package 'gtk+-3.0' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. This causes due to an absolute path name in 'sdk_env', which is now stripped to have only the environment name. Backport from oe-core master: https://git.openembedded.org/openembedded-core/commit/?id=386e4132a9ced75599d92610cf5c0e8fe907c3b6 (From OE-Core rev: 83c3e40e2361d771a724062e38a1349b87059c75) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oe-selftest: devtool ide-sdk use modify debug-buildAdrian Freihofer2025-02-031-1/+1
| | | | | | | | (From OE-Core rev: 1528d6aa060811402eaecb1a9fe16bfec0417c98) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: build the default set of toolsAlexander Kanavin2025-01-261-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | Setting it explicitly replaces rust's default choice which is rustdoc (needed for example in selftests and otherwise expected to be present in typical rust installations): https://github.com/rust-lang/rust/blob/master/config.example.toml#L320 This addresses some of the rust selftest failures but not all. Help is appreciate to restore the selftest. Unfortunately, this also breaks rust reproducibility (or rather exposes that it was never properly fixed, as explained here: https://lists.openembedded.org/g/openembedded-core/message/199288 ) (From OE-Core rev: 4d739fe248d1023eb2c3c040fc4d33273dd16bc1) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 58eaf2ee6c0809bf0a0d3c1d177e62bda7241651) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/ssh: allow to retrieve raw, unformatted ouputAlexis Lothoré2025-01-241-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | The ssh target is currently well tailored to easily retrieve textual output from a command run on a remote target. It could also be used to retrieve raw data from a command run onto a remote target (for example, to feed this data directly to another program), but it currently suffers two minor issues preventing such use case: - stderr is piped to stdout, so any error log will be mixed in the program output - the final output is decoded as utf-8 and stripped Allow to return the raw, unmodified output by adding an optional "raw" parameter. Keep it to False by default to preserve the current behavior. When enabled, do not return a string but the raw output as bytes. (From OE-Core rev: 8d05dc6e2284b7ed7c32a8215b9c8bf6f7dabf00) (From OE-Core rev: d09187db648053a763036a5209efd584b352cf31) Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/utils/gitarchive: Return tag name and improve exclude handlingRichard Purdie2024-12-091-1/+3
| | | | | | | | | | | | | Tweak the gitarchive exclude handling not to error if excluded files don't match. Also return the tagname created so that other code can then use it. (From OE-Core rev: 0a5b4fabf8bf9b559295bb4d2583809ca11522f4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1adba3430faffdf6217b6a00533a3b48a9388abc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* resulttool: Use single space indentation in json outputRichard Purdie2024-12-091-1/+1
| | | | | | | | | | | | | Using 4 space indentation in resulted in hundreds of megabytes of extra file size in general use. Reduce this to make filesizes more managable and reduce the processing cost. Some level of indentation and spacing does make the files more readable and allows use of git diff so we need to retain some of it. (From OE-Core rev: 03fef3a99186863a0c460bd89bad40f2360a6930) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a274cdcaf852cca9497f0358f44dda99c06aacbe) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/reproducible: Clean up pathnamesRichard Purdie2024-12-091-1/+1
| | | | | | | | | | | | | | | | | | | There are several problems with these paths. Firstly they contain full system paths which depend upon where the test was run. These are pretty pointless and just take up a lot of space making the results files large. Secondly, they contain the same path twice. The reference and target path will always be the same thing in two different locations. Strip off the prefix and remove the duplication. This does change the output data but that can't really be avoided. It does shrink the results data and makes it more readable. (From OE-Core rev: 44ee8f69db5e008b5ac5e0dbf390bb4fcf704f07) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81a44de36e864b08687451fd85aeba7c529fd7f7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/reproducible: Drop rawlogsRichard Purdie2024-12-091-6/+0
| | | | | | | | | | | | | | | The "rawlogs" data consists of a long string of results data which is already in a structured data format. I can't see this is adding much value in duplciating the data but it does create a huge string with a lot of long problematic pathnames and inflates the results data size. I suggest we drop this data as obsolete and not necessary. (From OE-Core rev: 296f64cbf83c40759b368526335502a6b130aa14) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5b2c70fab2ffa409b861d83f048b65d458d03a90) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-10-22 15:40:36 +0000