diff mbox series

[v3,5/8] Add SPDX deploy tasks to various recipes

Message ID 20260624141706.2164567-6-JPEWhacker@gmail.com
State Under Review
Headers show
Series Implement SPDX for deploy tasks | expand

Commit Message

Joshua Watt June 24, 2026, 2:15 p.m. UTC
Adds SPDX deploy tasks to many recipes to record their output when
consumed in an SBoM

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
 meta/classes-recipe/barebox.bbclass             | 1 +
 meta/classes-recipe/devicetree.bbclass          | 1 +
 meta/classes-recipe/kernel-fit-image.bbclass    | 1 +
 meta/classes-recipe/kernel.bbclass              | 1 +
 meta/recipes-bsp/grub/grub-efi_2.14.bb          | 1 +
 meta/recipes-bsp/opensbi/opensbi_1.8.1.bb       | 1 +
 meta/recipes-bsp/u-boot/u-boot.inc              | 1 +
 meta/recipes-core/systemd/systemd-boot_259.5.bb | 2 +-
 8 files changed, 8 insertions(+), 1 deletion(-)

Comments

patchtest@automation.yoctoproject.org June 24, 2026, 2:31 p.m. UTC | #1
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/v3-5-8-Add-SPDX-deploy-tasks-to-various-recipes.patch

FAIL: test shortlog format: Commit shortlog (first line of commit message) should follow the format "<target>: <summary>" (test_mbox.TestMbox.test_shortlog_format)

PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new CVE patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new CVE patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new CVE patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
Mikko Rapeli June 24, 2026, 2:31 p.m. UTC | #2
Hi,

On Wed, Jun 24, 2026 at 08:15:22AM -0600, Joshua Watt via lists.openembedded.org wrote:
> Adds SPDX deploy tasks to many recipes to record their output when
> consumed in an SBoM
> 
> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> ---
>  meta/classes-recipe/barebox.bbclass             | 1 +
>  meta/classes-recipe/devicetree.bbclass          | 1 +
>  meta/classes-recipe/kernel-fit-image.bbclass    | 1 +
>  meta/classes-recipe/kernel.bbclass              | 1 +
>  meta/recipes-bsp/grub/grub-efi_2.14.bb          | 1 +
>  meta/recipes-bsp/opensbi/opensbi_1.8.1.bb       | 1 +
>  meta/recipes-bsp/u-boot/u-boot.inc              | 1 +
>  meta/recipes-core/systemd/systemd-boot_259.5.bb | 2 +-
>  8 files changed, 8 insertions(+), 1 deletion(-)

Why not doing this in deploy.bbclass for all users of the class?

Cheers

-Mikko

> diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
> index 2411fb5caa..60437c1ad1 100644
> --- a/meta/classes-recipe/barebox.bbclass
> +++ b/meta/classes-recipe/barebox.bbclass
> @@ -158,5 +158,6 @@ barebox_do_deploy () {
>          fi
>  }
>  addtask deploy after do_compile
> +SPDX_DEPLOY_TASKS += "do_deploy"
>  
>  EXPORT_FUNCTIONS do_configure do_compile do_install do_deploy
> diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
> index ce9d008aac..35c2499bdb 100644
> --- a/meta/classes-recipe/devicetree.bbclass
> +++ b/meta/classes-recipe/devicetree.bbclass
> @@ -164,6 +164,7 @@ devicetree_do_deploy() {
>      done
>  }
>  addtask deploy before do_build after do_install
> +SPDX_DEPLOY_TASKS += "do_deploy"
>  
>  EXPORT_FUNCTIONS do_compile do_install do_deploy
>  
> diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
> index ae8f3c6688..5115482eff 100644
> --- a/meta/classes-recipe/kernel-fit-image.bbclass
> +++ b/meta/classes-recipe/kernel-fit-image.bbclass
> @@ -241,3 +241,4 @@ do_deploy() {
>      fi
>  }
>  addtask deploy after do_compile before do_build
> +SPDX_DEPLOY_TASKS += "do_deploy"
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index 50cef17f69..8d0cb91688 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -842,6 +842,7 @@ kernel_do_deploy() {
>  do_deploy[prefuncs] += "read_subpackage_metadata"
>  
>  addtask deploy after do_install do_populate_sysroot do_packagedata
> +SPDX_DEPLOY_TASKS += "do_deploy"
>  
>  EXPORT_FUNCTIONS do_deploy
>  
> diff --git a/meta/recipes-bsp/grub/grub-efi_2.14.bb b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> index 6354b43989..e535d99710 100644
> --- a/meta/recipes-bsp/grub/grub-efi_2.14.bb
> +++ b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> @@ -97,6 +97,7 @@ do_deploy() {
>  }
>  
>  addtask deploy after do_install before do_build
> +SPDX_DEPLOY_TASKS += "do_deploy"
>  
>  FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
>                 ${datadir}/grub \
> diff --git a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> index 0a9652c283..93646a97df 100644
> --- a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> +++ b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> @@ -45,6 +45,7 @@ do_deploy () {
>  }
>  
>  addtask deploy before do_build after do_install
> +SPDX_DEPLOY_TASKS += "do_deploy"
>  
>  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
>  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
> diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> index a75948dfc3..acc2bf9819 100644
> --- a/meta/recipes-bsp/u-boot/u-boot.inc
> +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> @@ -471,3 +471,4 @@ uboot_deploy_spl () {
>  }
>  
>  addtask deploy before do_build after do_compile
> +SPDX_DEPLOY_TASKS += "do_deploy"
> diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> index c6c443f929..c887835806 100644
> --- a/meta/recipes-core/systemd/systemd-boot_259.5.bb
> +++ b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> @@ -72,4 +72,4 @@ do_deploy () {
>  }
>  
>  addtask deploy before do_build after do_compile
> -
> +SPDX_DEPLOY_TASKS += "do_deploy"
> -- 
> 2.54.0
> 

> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#239514): https://lists.openembedded.org/g/openembedded-core/message/239514
> Mute This Topic: https://lists.openembedded.org/mt/119957548/7159507
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [mikko.rapeli@linaro.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Joshua Watt June 24, 2026, 4:05 p.m. UTC | #3
On Wed, Jun 24, 2026 at 8:31 AM Mikko Rapeli <mikko.rapeli@linaro.org> wrote:
>
> Hi,
>
> On Wed, Jun 24, 2026 at 08:15:22AM -0600, Joshua Watt via lists.openembedded.org wrote:
> > Adds SPDX deploy tasks to many recipes to record their output when
> > consumed in an SBoM
> >
> > Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> > ---
> >  meta/classes-recipe/barebox.bbclass             | 1 +
> >  meta/classes-recipe/devicetree.bbclass          | 1 +
> >  meta/classes-recipe/kernel-fit-image.bbclass    | 1 +
> >  meta/classes-recipe/kernel.bbclass              | 1 +
> >  meta/recipes-bsp/grub/grub-efi_2.14.bb          | 1 +
> >  meta/recipes-bsp/opensbi/opensbi_1.8.1.bb       | 1 +
> >  meta/recipes-bsp/u-boot/u-boot.inc              | 1 +
> >  meta/recipes-core/systemd/systemd-boot_259.5.bb | 2 +-
> >  8 files changed, 8 insertions(+), 1 deletion(-)
>
> Why not doing this in deploy.bbclass for all users of the class?

We probably could do that; I guess I'd like some feedback if anyone
else thinks that's a good idea or not. I initially did it this way
just to minimize disruption


>
> Cheers
>
> -Mikko
>
> > diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
> > index 2411fb5caa..60437c1ad1 100644
> > --- a/meta/classes-recipe/barebox.bbclass
> > +++ b/meta/classes-recipe/barebox.bbclass
> > @@ -158,5 +158,6 @@ barebox_do_deploy () {
> >          fi
> >  }
> >  addtask deploy after do_compile
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> >
> >  EXPORT_FUNCTIONS do_configure do_compile do_install do_deploy
> > diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
> > index ce9d008aac..35c2499bdb 100644
> > --- a/meta/classes-recipe/devicetree.bbclass
> > +++ b/meta/classes-recipe/devicetree.bbclass
> > @@ -164,6 +164,7 @@ devicetree_do_deploy() {
> >      done
> >  }
> >  addtask deploy before do_build after do_install
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> >
> >  EXPORT_FUNCTIONS do_compile do_install do_deploy
> >
> > diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
> > index ae8f3c6688..5115482eff 100644
> > --- a/meta/classes-recipe/kernel-fit-image.bbclass
> > +++ b/meta/classes-recipe/kernel-fit-image.bbclass
> > @@ -241,3 +241,4 @@ do_deploy() {
> >      fi
> >  }
> >  addtask deploy after do_compile before do_build
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> > index 50cef17f69..8d0cb91688 100644
> > --- a/meta/classes-recipe/kernel.bbclass
> > +++ b/meta/classes-recipe/kernel.bbclass
> > @@ -842,6 +842,7 @@ kernel_do_deploy() {
> >  do_deploy[prefuncs] += "read_subpackage_metadata"
> >
> >  addtask deploy after do_install do_populate_sysroot do_packagedata
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> >
> >  EXPORT_FUNCTIONS do_deploy
> >
> > diff --git a/meta/recipes-bsp/grub/grub-efi_2.14.bb b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > index 6354b43989..e535d99710 100644
> > --- a/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > +++ b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > @@ -97,6 +97,7 @@ do_deploy() {
> >  }
> >
> >  addtask deploy after do_install before do_build
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> >
> >  FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
> >                 ${datadir}/grub \
> > diff --git a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > index 0a9652c283..93646a97df 100644
> > --- a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > +++ b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > @@ -45,6 +45,7 @@ do_deploy () {
> >  }
> >
> >  addtask deploy before do_build after do_install
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> >
> >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
> >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
> > diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> > index a75948dfc3..acc2bf9819 100644
> > --- a/meta/recipes-bsp/u-boot/u-boot.inc
> > +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> > @@ -471,3 +471,4 @@ uboot_deploy_spl () {
> >  }
> >
> >  addtask deploy before do_build after do_compile
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> > diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > index c6c443f929..c887835806 100644
> > --- a/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > +++ b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > @@ -72,4 +72,4 @@ do_deploy () {
> >  }
> >
> >  addtask deploy before do_build after do_compile
> > -
> > +SPDX_DEPLOY_TASKS += "do_deploy"
> > --
> > 2.54.0
> >
>
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#239514): https://lists.openembedded.org/g/openembedded-core/message/239514
> > Mute This Topic: https://lists.openembedded.org/mt/119957548/7159507
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [mikko.rapeli@linaro.org]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
Mikko Rapeli June 24, 2026, 4:24 p.m. UTC | #4
Hi,

On Wed, Jun 24, 2026 at 10:05:33AM -0600, Joshua Watt wrote:
> On Wed, Jun 24, 2026 at 8:31 AM Mikko Rapeli <mikko.rapeli@linaro.org> wrote:
> >
> > Hi,
> >
> > On Wed, Jun 24, 2026 at 08:15:22AM -0600, Joshua Watt via lists.openembedded.org wrote:
> > > Adds SPDX deploy tasks to many recipes to record their output when
> > > consumed in an SBoM
> > >
> > > Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> > > ---
> > >  meta/classes-recipe/barebox.bbclass             | 1 +
> > >  meta/classes-recipe/devicetree.bbclass          | 1 +
> > >  meta/classes-recipe/kernel-fit-image.bbclass    | 1 +
> > >  meta/classes-recipe/kernel.bbclass              | 1 +
> > >  meta/recipes-bsp/grub/grub-efi_2.14.bb          | 1 +
> > >  meta/recipes-bsp/opensbi/opensbi_1.8.1.bb       | 1 +
> > >  meta/recipes-bsp/u-boot/u-boot.inc              | 1 +
> > >  meta/recipes-core/systemd/systemd-boot_259.5.bb | 2 +-
> > >  8 files changed, 8 insertions(+), 1 deletion(-)
> >
> > Why not doing this in deploy.bbclass for all users of the class?
> 
> We probably could do that; I guess I'd like some feedback if anyone
> else thinks that's a good idea or not. I initially did it this way
> just to minimize disruption

As an example, meta-arm qemuarm64-secureboot machine builds u-boot with tf-a and optee
which I think are all linked to a single u-boot binary. Both tf-a and optee binaries are
captured via deploy directory, and u-boot exports the flash binary via deploy
directory as well. None of these are visible in the rootfs images if the userspace
optee-client, optee-examples, optee-test, TEE applications like optee-ftpm or tf-a tests are not
installed.

Are all their SPDX and license data correctly captured with current approach via u-boot?

If yes, then things are better, but there are still a lot of external BSP etc
layer recipes which use only deploy.bbclass to export their blobs which get flashed
to target. Covering those as well via use of deploy.bbclass would be better, IMO.

Cheers,

-Mikko

> >
> > Cheers
> >
> > -Mikko
> >
> > > diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
> > > index 2411fb5caa..60437c1ad1 100644
> > > --- a/meta/classes-recipe/barebox.bbclass
> > > +++ b/meta/classes-recipe/barebox.bbclass
> > > @@ -158,5 +158,6 @@ barebox_do_deploy () {
> > >          fi
> > >  }
> > >  addtask deploy after do_compile
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > >
> > >  EXPORT_FUNCTIONS do_configure do_compile do_install do_deploy
> > > diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
> > > index ce9d008aac..35c2499bdb 100644
> > > --- a/meta/classes-recipe/devicetree.bbclass
> > > +++ b/meta/classes-recipe/devicetree.bbclass
> > > @@ -164,6 +164,7 @@ devicetree_do_deploy() {
> > >      done
> > >  }
> > >  addtask deploy before do_build after do_install
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > >
> > >  EXPORT_FUNCTIONS do_compile do_install do_deploy
> > >
> > > diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
> > > index ae8f3c6688..5115482eff 100644
> > > --- a/meta/classes-recipe/kernel-fit-image.bbclass
> > > +++ b/meta/classes-recipe/kernel-fit-image.bbclass
> > > @@ -241,3 +241,4 @@ do_deploy() {
> > >      fi
> > >  }
> > >  addtask deploy after do_compile before do_build
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> > > index 50cef17f69..8d0cb91688 100644
> > > --- a/meta/classes-recipe/kernel.bbclass
> > > +++ b/meta/classes-recipe/kernel.bbclass
> > > @@ -842,6 +842,7 @@ kernel_do_deploy() {
> > >  do_deploy[prefuncs] += "read_subpackage_metadata"
> > >
> > >  addtask deploy after do_install do_populate_sysroot do_packagedata
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > >
> > >  EXPORT_FUNCTIONS do_deploy
> > >
> > > diff --git a/meta/recipes-bsp/grub/grub-efi_2.14.bb b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > index 6354b43989..e535d99710 100644
> > > --- a/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > +++ b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > @@ -97,6 +97,7 @@ do_deploy() {
> > >  }
> > >
> > >  addtask deploy after do_install before do_build
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > >
> > >  FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
> > >                 ${datadir}/grub \
> > > diff --git a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > index 0a9652c283..93646a97df 100644
> > > --- a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > +++ b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > @@ -45,6 +45,7 @@ do_deploy () {
> > >  }
> > >
> > >  addtask deploy before do_build after do_install
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > >
> > >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
> > >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
> > > diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> > > index a75948dfc3..acc2bf9819 100644
> > > --- a/meta/recipes-bsp/u-boot/u-boot.inc
> > > +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> > > @@ -471,3 +471,4 @@ uboot_deploy_spl () {
> > >  }
> > >
> > >  addtask deploy before do_build after do_compile
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > index c6c443f929..c887835806 100644
> > > --- a/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > +++ b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > @@ -72,4 +72,4 @@ do_deploy () {
> > >  }
> > >
> > >  addtask deploy before do_build after do_compile
> > > -
> > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > --
> > > 2.54.0
> > >
> >
> > >
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > > Links: You receive all messages sent to this group.
> > > View/Reply Online (#239514): https://lists.openembedded.org/g/openembedded-core/message/239514
> > > Mute This Topic: https://lists.openembedded.org/mt/119957548/7159507
> > > Group Owner: openembedded-core+owner@lists.openembedded.org
> > > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [mikko.rapeli@linaro.org]
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > >
> >
Joshua Watt June 24, 2026, 4:30 p.m. UTC | #5
On Wed, Jun 24, 2026 at 10:24 AM Mikko Rapeli <mikko.rapeli@linaro.org> wrote:
>
> Hi,
>
> On Wed, Jun 24, 2026 at 10:05:33AM -0600, Joshua Watt wrote:
> > On Wed, Jun 24, 2026 at 8:31 AM Mikko Rapeli <mikko.rapeli@linaro.org> wrote:
> > >
> > > Hi,
> > >
> > > On Wed, Jun 24, 2026 at 08:15:22AM -0600, Joshua Watt via lists.openembedded.org wrote:
> > > > Adds SPDX deploy tasks to many recipes to record their output when
> > > > consumed in an SBoM
> > > >
> > > > Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
> > > > ---
> > > >  meta/classes-recipe/barebox.bbclass             | 1 +
> > > >  meta/classes-recipe/devicetree.bbclass          | 1 +
> > > >  meta/classes-recipe/kernel-fit-image.bbclass    | 1 +
> > > >  meta/classes-recipe/kernel.bbclass              | 1 +
> > > >  meta/recipes-bsp/grub/grub-efi_2.14.bb          | 1 +
> > > >  meta/recipes-bsp/opensbi/opensbi_1.8.1.bb       | 1 +
> > > >  meta/recipes-bsp/u-boot/u-boot.inc              | 1 +
> > > >  meta/recipes-core/systemd/systemd-boot_259.5.bb | 2 +-
> > > >  8 files changed, 8 insertions(+), 1 deletion(-)
> > >
> > > Why not doing this in deploy.bbclass for all users of the class?
> >
> > We probably could do that; I guess I'd like some feedback if anyone
> > else thinks that's a good idea or not. I initially did it this way
> > just to minimize disruption
>
> As an example, meta-arm qemuarm64-secureboot machine builds u-boot with tf-a and optee
> which I think are all linked to a single u-boot binary. Both tf-a and optee binaries are
> captured via deploy directory, and u-boot exports the flash binary via deploy
> directory as well. None of these are visible in the rootfs images if the userspace
> optee-client, optee-examples, optee-test, TEE applications like optee-ftpm or tf-a tests are not
> installed.
>
> Are all their SPDX and license data correctly captured with current approach via u-boot?

That is the intention. As long as the do_deploy of u-boot has a
dependency on do_deploy of the optee-ftpm and tf-a (either directly,
or transitively through prior tasks in u-boot), it should get
captured.

>
> If yes, then things are better, but there are still a lot of external BSP etc
> layer recipes which use only deploy.bbclass to export their blobs which get flashed
> to target. Covering those as well via use of deploy.bbclass would be better, IMO.

Right. Even if it's not done in deploy.bbclass, adding the
`SPDX_DEPLOY_TASKS += "do_deploy"` should be all that is needed,
making it easy if not automatic.

>
> Cheers,
>
> -Mikko
>
> > >
> > > Cheers
> > >
> > > -Mikko
> > >
> > > > diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
> > > > index 2411fb5caa..60437c1ad1 100644
> > > > --- a/meta/classes-recipe/barebox.bbclass
> > > > +++ b/meta/classes-recipe/barebox.bbclass
> > > > @@ -158,5 +158,6 @@ barebox_do_deploy () {
> > > >          fi
> > > >  }
> > > >  addtask deploy after do_compile
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > >
> > > >  EXPORT_FUNCTIONS do_configure do_compile do_install do_deploy
> > > > diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
> > > > index ce9d008aac..35c2499bdb 100644
> > > > --- a/meta/classes-recipe/devicetree.bbclass
> > > > +++ b/meta/classes-recipe/devicetree.bbclass
> > > > @@ -164,6 +164,7 @@ devicetree_do_deploy() {
> > > >      done
> > > >  }
> > > >  addtask deploy before do_build after do_install
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > >
> > > >  EXPORT_FUNCTIONS do_compile do_install do_deploy
> > > >
> > > > diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
> > > > index ae8f3c6688..5115482eff 100644
> > > > --- a/meta/classes-recipe/kernel-fit-image.bbclass
> > > > +++ b/meta/classes-recipe/kernel-fit-image.bbclass
> > > > @@ -241,3 +241,4 @@ do_deploy() {
> > > >      fi
> > > >  }
> > > >  addtask deploy after do_compile before do_build
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> > > > index 50cef17f69..8d0cb91688 100644
> > > > --- a/meta/classes-recipe/kernel.bbclass
> > > > +++ b/meta/classes-recipe/kernel.bbclass
> > > > @@ -842,6 +842,7 @@ kernel_do_deploy() {
> > > >  do_deploy[prefuncs] += "read_subpackage_metadata"
> > > >
> > > >  addtask deploy after do_install do_populate_sysroot do_packagedata
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > >
> > > >  EXPORT_FUNCTIONS do_deploy
> > > >
> > > > diff --git a/meta/recipes-bsp/grub/grub-efi_2.14.bb b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > > index 6354b43989..e535d99710 100644
> > > > --- a/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > > +++ b/meta/recipes-bsp/grub/grub-efi_2.14.bb
> > > > @@ -97,6 +97,7 @@ do_deploy() {
> > > >  }
> > > >
> > > >  addtask deploy after do_install before do_build
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > >
> > > >  FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
> > > >                 ${datadir}/grub \
> > > > diff --git a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > > index 0a9652c283..93646a97df 100644
> > > > --- a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > > +++ b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
> > > > @@ -45,6 +45,7 @@ do_deploy () {
> > > >  }
> > > >
> > > >  addtask deploy before do_build after do_install
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > >
> > > >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
> > > >  FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
> > > > diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> > > > index a75948dfc3..acc2bf9819 100644
> > > > --- a/meta/recipes-bsp/u-boot/u-boot.inc
> > > > +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> > > > @@ -471,3 +471,4 @@ uboot_deploy_spl () {
> > > >  }
> > > >
> > > >  addtask deploy before do_build after do_compile
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > > diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > > index c6c443f929..c887835806 100644
> > > > --- a/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > > +++ b/meta/recipes-core/systemd/systemd-boot_259.5.bb
> > > > @@ -72,4 +72,4 @@ do_deploy () {
> > > >  }
> > > >
> > > >  addtask deploy before do_build after do_compile
> > > > -
> > > > +SPDX_DEPLOY_TASKS += "do_deploy"
> > > > --
> > > > 2.54.0
> > > >
> > >
> > > >
> > > > -=-=-=-=-=-=-=-=-=-=-=-
> > > > Links: You receive all messages sent to this group.
> > > > View/Reply Online (#239514): https://lists.openembedded.org/g/openembedded-core/message/239514
> > > > Mute This Topic: https://lists.openembedded.org/mt/119957548/7159507
> > > > Group Owner: openembedded-core+owner@lists.openembedded.org
> > > > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [mikko.rapeli@linaro.org]
> > > > -=-=-=-=-=-=-=-=-=-=-=-
> > > >
> > >
diff mbox series

Patch

diff --git a/meta/classes-recipe/barebox.bbclass b/meta/classes-recipe/barebox.bbclass
index 2411fb5caa..60437c1ad1 100644
--- a/meta/classes-recipe/barebox.bbclass
+++ b/meta/classes-recipe/barebox.bbclass
@@ -158,5 +158,6 @@  barebox_do_deploy () {
         fi
 }
 addtask deploy after do_compile
+SPDX_DEPLOY_TASKS += "do_deploy"
 
 EXPORT_FUNCTIONS do_configure do_compile do_install do_deploy
diff --git a/meta/classes-recipe/devicetree.bbclass b/meta/classes-recipe/devicetree.bbclass
index ce9d008aac..35c2499bdb 100644
--- a/meta/classes-recipe/devicetree.bbclass
+++ b/meta/classes-recipe/devicetree.bbclass
@@ -164,6 +164,7 @@  devicetree_do_deploy() {
     done
 }
 addtask deploy before do_build after do_install
+SPDX_DEPLOY_TASKS += "do_deploy"
 
 EXPORT_FUNCTIONS do_compile do_install do_deploy
 
diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
index ae8f3c6688..5115482eff 100644
--- a/meta/classes-recipe/kernel-fit-image.bbclass
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -241,3 +241,4 @@  do_deploy() {
     fi
 }
 addtask deploy after do_compile before do_build
+SPDX_DEPLOY_TASKS += "do_deploy"
diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index 50cef17f69..8d0cb91688 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -842,6 +842,7 @@  kernel_do_deploy() {
 do_deploy[prefuncs] += "read_subpackage_metadata"
 
 addtask deploy after do_install do_populate_sysroot do_packagedata
+SPDX_DEPLOY_TASKS += "do_deploy"
 
 EXPORT_FUNCTIONS do_deploy
 
diff --git a/meta/recipes-bsp/grub/grub-efi_2.14.bb b/meta/recipes-bsp/grub/grub-efi_2.14.bb
index 6354b43989..e535d99710 100644
--- a/meta/recipes-bsp/grub/grub-efi_2.14.bb
+++ b/meta/recipes-bsp/grub/grub-efi_2.14.bb
@@ -97,6 +97,7 @@  do_deploy() {
 }
 
 addtask deploy after do_install before do_build
+SPDX_DEPLOY_TASKS += "do_deploy"
 
 FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
                ${datadir}/grub \
diff --git a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
index 0a9652c283..93646a97df 100644
--- a/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
+++ b/meta/recipes-bsp/opensbi/opensbi_1.8.1.bb
@@ -45,6 +45,7 @@  do_deploy () {
 }
 
 addtask deploy before do_build after do_install
+SPDX_DEPLOY_TASKS += "do_deploy"
 
 FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
 FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index a75948dfc3..acc2bf9819 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -471,3 +471,4 @@  uboot_deploy_spl () {
 }
 
 addtask deploy before do_build after do_compile
+SPDX_DEPLOY_TASKS += "do_deploy"
diff --git a/meta/recipes-core/systemd/systemd-boot_259.5.bb b/meta/recipes-core/systemd/systemd-boot_259.5.bb
index c6c443f929..c887835806 100644
--- a/meta/recipes-core/systemd/systemd-boot_259.5.bb
+++ b/meta/recipes-core/systemd/systemd-boot_259.5.bb
@@ -72,4 +72,4 @@  do_deploy () {
 }
 
 addtask deploy before do_build after do_compile
-
+SPDX_DEPLOY_TASKS += "do_deploy"