diff mbox series

[v2] Add SPDX_INCLUDE_COMPILED_SOURCES documentation

Message ID 20250619132257.2050864-1-daniel.turull@ericsson.com
State Under Review
Headers show
Series [v2] Add SPDX_INCLUDE_COMPILED_SOURCES documentation | expand

Commit Message

Daniel Turull June 19, 2025, 1:22 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Adding documentation for the new feature to store in SPDX
only the compiled sources.

Merged in oe-core: c6a2f1fca76fae4c3ea471a0c63d0b453beea968
 - spdx: add option to include only compiled sources

CC: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 documentation/dev-manual/sbom.rst      |  3 +++
 documentation/ref-manual/variables.rst | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+)

Comments

Antonin Godard June 20, 2025, 7:31 a.m. UTC | #1 
On Thu Jun 19, 2025 at 3:22 PM CEST, daniel.turull wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Adding documentation for the new feature to store in SPDX
> only the compiled sources.
>
> Merged in oe-core: c6a2f1fca76fae4c3ea471a0c63d0b453beea968
>  - spdx: add option to include only compiled sources

Thanks a lot for clarifying!

Applying to master-next.

Reviewed-by: Antonin Godard <antonin.godard@bootlin.com>

Antonin
diff mbox series

Patch

diff --git a/documentation/dev-manual/sbom.rst b/documentation/dev-manual/sbom.rst
index e6806ce92..ca0fc8b9d 100644
--- a/documentation/dev-manual/sbom.rst
+++ b/documentation/dev-manual/sbom.rst
@@ -60,6 +60,9 @@  more information in the output :term:`SPDX` data:
 -  Add a description of the source files used to generate host tools and target
    packages (:term:`SPDX_INCLUDE_SOURCES`)
 
+-  Add a description of the **compiled** source files used to generate host tools
+   and target packages (:term:`SPDX_INCLUDE_COMPILED_SOURCES`)
+
 -  Add archives of these source files themselves (:term:`SPDX_ARCHIVE_SOURCES`).
 
 Though the toplevel :term:`SPDX` output is available in
diff --git a/documentation/ref-manual/variables.rst b/documentation/ref-manual/variables.rst
index 5c18b852d..7f26bfb8e 100644
--- a/documentation/ref-manual/variables.rst
+++ b/documentation/ref-manual/variables.rst
@@ -8764,6 +8764,28 @@  system and gives an overview of their function and contents.
       image), compared to just using the :ref:`ref-classes-create-spdx` class
       with no option.
 
+   :term:`SPDX_INCLUDE_COMPILED_SOURCES`
+      This option allows the same as :term:`SPDX_INCLUDE_SOURCES` but including
+      only the sources used to compile the host tools and the target packages.
+      While :term:`SPDX_INCLUDE_SOURCES` includes all files in the source
+      directory as source file descriptions, :term:`SPDX_INCLUDE_COMPILED_SOURCES`
+      includes only the sources that are used to produce the binaries delivered
+      as packages. The source files that are not used during compilation are not
+      included in the SBOM. It uses debugsource information generated during
+      ``do_package`` to filter out source files.
+
+      This enables an external tool to use the SPDX information to disregard
+      vulnerabilities that are not compiled in the packages.
+
+      Enable this option as follows::
+
+         SPDX_INCLUDE_COMPILED_SOURCES = "1"
+
+      According to our tests, building ``core-image-minimal`` for the
+      ``qemux86-64`` machine, enabling this option compared with the
+      :term:`SPDX_INCLUDE_SOURCES` reduces the size of the  ``tmp/deploy/spdx``
+      directory from 2GB to 1.6GB.
+
    :term:`SPDX_NAMESPACE_PREFIX`
       This option could be used in order to change the prefix of ``spdxDocument``
       and the prefix of ``documentNamespace``. It is set by default to