From e77289e9a4c9960fad9cf15ff9ac8787a6c350aa Mon Sep 17 00:00:00 2001 From: Hongxu Jia Date: Tue, 18 Nov 2025 13:09:48 +0100 Subject: spdx30: Provide software_packageUrl field in SPDX 3.0 SBOM Define var-SPDX_PACKAGE_URL to provide software_packageUrl field [1][2] in SPDX 3.0 SBOM, support to override with package name SPDX_PACKAGE_URL: Currently, the format of purl is not defined in Yocto, set empty for now until we have a comprehensive plan for what Yocto purls look like. But users could customize their own purl by setting var-SPDX_PACKAGE_URL [1] https://spdx.github.io/spdx-spec/v3.0.1/model/Software/Properties/packageUrl/ [2] https://spdx.github.io/spdx-spec/v3.0.1/annexes/pkg-url-specification/ (From OE-Core rev: c8e6953a0b6f59ffca994c440069db39e60b12d2) (From OE-Core rev: 60724efdb3a243bc796b390ad0c478584a0fb7fa) Signed-off-by: Hongxu Jia Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/lib/oe/spdx30_tasks.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'meta/lib') diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 8115088ab8..a2d316301f 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -632,6 +632,14 @@ def create_spdx(d): set_var_field("SUMMARY", spdx_package, "summary", package=package) set_var_field("DESCRIPTION", spdx_package, "description", package=package) + if d.getVar("SPDX_PACKAGE_URL:%s" % package) or d.getVar("SPDX_PACKAGE_URL"): + set_var_field( + "SPDX_PACKAGE_URL", + spdx_package, + "software_packageUrl", + package=package + ) + pkg_objset.new_scoped_relationship( [oe.sbom30.get_element_link_id(build)], oe.spdx30.RelationshipType.hasOutput, -- cgit v1.2.3-54-g00ecf