create-spdx-3.0: record component release date in SPDX output

From: Daniel Turull <daniel.turull@ericsson.com>

Add SPDX_INCLUDE_RELEASE_DATE (default enabled), which records each
recipe's release date in the releaseTime property of its
software_Package object, using the SOURCE_DATE_EPOCH already computed
for reproducible builds. SPDX_RELEASE_DATE_INCLUDE_PATCHES (default
disabled) additionally considers the Date: header of applied patches,
using the newest of SOURCE_DATE_EPOCH and all patch dates found;
SPDX_COMPONENT_RELEASE_DATE overrides both.

Tested with oe-selftest -r spdx (full suite, including the new
release-date cases) with no regressions.

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 meta/classes/create-spdx-3.0.bbclass |  20 +++-
 meta/lib/oe/spdx30_tasks.py          |  65 ++++++++++++
 meta/lib/oeqa/selftest/cases/spdx.py | 142 +++++++++++++++++++++++++++
 3 files changed, 226 insertions(+), 1 deletion(-)

On Tue, Sep 22, 2026 at 8:43 AM <daniel.turull@ericsson.com> wrote:

> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Add SPDX_INCLUDE_RELEASE_DATE (default enabled), which records each
> recipe's release date in the releaseTime property of its
> software_Package object, using the SOURCE_DATE_EPOCH already computed
> for reproducible builds. SPDX_RELEASE_DATE_INCLUDE_PATCHES (default
> disabled) additionally considers the Date: header of applied patches,
> using the newest of SOURCE_DATE_EPOCH and all patch dates found;
> SPDX_COMPONENT_RELEASE_DATE overrides both.
>
> Tested with oe-selftest -r spdx (full suite, including the new
> release-date cases) with no regressions.
>
> AI-Generated: Uses Kiro with Claude Sonnet 5
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  meta/classes/create-spdx-3.0.bbclass |  20 +++-
>  meta/lib/oe/spdx30_tasks.py          |  65 ++++++++++++
>  meta/lib/oeqa/selftest/cases/spdx.py | 142 +++++++++++++++++++++++++++
>  3 files changed, 226 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes/create-spdx-3.0.bbclass
> b/meta/classes/create-spdx-3.0.bbclass
> index 56fd01fd53..9955ffad85 100644
> --- a/meta/classes/create-spdx-3.0.bbclass
> +++ b/meta/classes/create-spdx-3.0.bbclass
> @@ -163,6 +163,23 @@ SPDX_GIT_PURL_MAPPINGS[doc] = "A space separated list
> of domain:purl_type \
>      on gitlab.example.com to the pkg:gitlab PURL type. \
>      github.com is always mapped to pkg:github by default."
>
> +SPDX_INCLUDE_RELEASE_DATE ??= "1"
> +SPDX_INCLUDE_RELEASE_DATE[doc] = "If set to '1', record the release date
> of \
> +    each recipe in the software_Package releaseTime property, derived
> from \
> +    SOURCE_DATE_EPOCH. Set to '0' to omit the property entirely."
>

There's little value in making this optional. The stuff that is optional is
so because it's slow to calculate or makes the SBoM output much larger;
this does neither.


> +
> +SPDX_RELEASE_DATE_INCLUDE_PATCHES ??= "0"
>

Is this necessary? I don't feel that patches should really affect the
"release date"


> +SPDX_RELEASE_DATE_INCLUDE_PATCHES[doc] = "If set to '1', also consider
> the \
> +    Date: header of applied patches in SRC_URI when determining the
> release \
> +    date recorded in releaseTime, using the newest of SOURCE_DATE_EPOCH
> and \
> +    all patch dates found. Has no effect if SPDX_INCLUDE_RELEASE_DATE is
> '0'."
> +
> +SPDX_COMPONENT_RELEASE_DATE ??= ""

+SPDX_COMPONENT_RELEASE_DATE[doc] = "Overrides the release date recorded in
> the \
> +    releaseTime property for this component. Expected format is full ISO
> 8601 \
> +    UTC (YYYY-MM-DDTHH:MM:SSZ). Takes precedence over
> SPDX_INCLUDE_RELEASE_DATE \
> +    and SPDX_RELEASE_DATE_INCLUDE_PATCHES."
>

I don't really like having a variable for this; it feels like it's too easy
to bit-rot or just not get updated when a recipe is updated. I also don't
think falling back to Source Date Epoch necessarily makes sense for this;
it's better to have no release date than SDE (IMHO). Also, the way you are
calling this means that it will always use the fallback (see below).

I think we *could* use the SDE library code to get the release time
(calling get_source_date_epoch_from_*), but instead of falling back to the
SDE fallback, just omit the releaseTime property


> +
>  IMAGE_CLASSES:append = " create-spdx-image-3.0"
>  SDK_CLASSES += "create-spdx-sdk-3.0"
>
> @@ -192,7 +209,7 @@ python do_create_recipe_spdx() {
>      import oe.spdx30_tasks
>      oe.spdx30_tasks.create_recipe_spdx(d)
>  }
> -addtask do_create_recipe_spdx
> +addtask do_create_recipe_spdx after do_deploy_source_date_epoch
>
>  SSTATETASKS += "do_create_recipe_spdx"
>  do_create_recipe_spdx[sstate-inputdirs] = "${SPDXRECIPEDEPLOY}"
> @@ -201,6 +218,7 @@ do_create_recipe_spdx[file-checksums] +=
> "${SPDX3_DEP_FILES}"
>  do_create_recipe_spdx[cleandirs] = "${SPDXRECIPEDEPLOY}"
>  do_create_recipe_spdx[deptask] += "do_create_recipe_spdx"
>  do_create_recipe_spdx[vardeps] += "${SPDX3_VAR_DEPS}"
> +do_create_recipe_spdx[vardeps] += "SPDX_INCLUDE_RELEASE_DATE
> SPDX_RELEASE_DATE_INCLUDE_PATCHES SPDX_COMPONENT_RELEASE_DATE"
>  do_create_recipe_spdx[file-checksums] =
> "${@bb.fetch.get_checksum_file_list(d)}"
>
>  python do_create_recipe_spdx_setscene () {
> diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
> index 9978ae731c..e6340c3678 100644
> --- a/meta/lib/oe/spdx30_tasks.py
> +++ b/meta/lib/oe/spdx30_tasks.py
> @@ -36,6 +36,65 @@ def set_timestamp_now(d, o, prop):
>          delattr(o, prop)
>
>
> +def get_release_date(d):
> +    """Resolve the release date to record in a recipe's releaseTime
> property.
> +
> +    Returns a datetime, or None if no release date should be recorded.
> +    """
> +    override = d.getVar("SPDX_COMPONENT_RELEASE_DATE")
> +    if override:
> +        try:
> +            return datetime.strptime(override,
> "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc)
> +        except ValueError:
> +            bb.fatal(
> +                "SPDX_COMPONENT_RELEASE_DATE value '%s' is not valid. "
> +                "Expected format: YYYY-MM-DDTHH:MM:SSZ (e.g.
> 2024-03-15T12:00:00Z)" % override
> +            )
> +
> +    if d.getVar("SPDX_INCLUDE_RELEASE_DATE") != "1":
> +        return None
> +
> +    source_date_epoch = d.getVar("SOURCE_DATE_EPOCH")
> +    if not source_date_epoch:
> +        return None
> +
> +    release_date = datetime.fromtimestamp(int(source_date_epoch),
> tz=timezone.utc)
> +
> +    if d.getVar("SPDX_RELEASE_DATE_INCLUDE_PATCHES") == "1":
> +        # Only the static Date: header is used, never "git log" on the
> +        # layer's repo, since that varies with clone depth/history.
> +        for url in oe.patch.src_patches(d):
> +            patch_path = bb.fetch.decodeurl(url)[2]
> +            patch_date = _get_patch_date_header(patch_path)
> +            if patch_date and patch_date > release_date:
> +                release_date = patch_date
> +
> +    return release_date
> +
> +
> +def _get_patch_date_header(patch_path):
> +    """Parse the 'Date:' header from a git-format-patch style file, if
> +    present, and return it as a timezone-aware datetime, or None."""
> +    from email.utils import parsedate_to_datetime
> +
> +    try:
> +        with open(patch_path, errors="replace") as f:
> +            for line in f:
> +                if line.startswith("Date:"):
> +                    try:
> +                        parsed =
> parsedate_to_datetime(line[len("Date:"):].strip())
> +                    except (ValueError, TypeError):
> +                        return None
> +                    if parsed.tzinfo is None:
> +                        return None
> +                    return parsed.astimezone(timezone.utc)
> +                if line.startswith("---") or line.startswith("diff
> --git"):
> +                    break
> +    except OSError:
> +        return None
> +    return None
> +
> +
>  def add_license_expression(
>      d, objset, license_expression, license_data, search_objsets=[]
>  ):
> @@ -631,6 +690,12 @@ def create_recipe_spdx(d):
>      if val := d.getVar("DESCRIPTION"):
>          recipe.description = val
>
> +    release_date = get_release_date(d)
> +    if release_date is not None:
> +        recipe.releaseTime = release_date
> +    else:
> +        delattr(recipe, "releaseTime")
> +
>

This can't really function here as expected; do_create_recipe_spdx runs
before do_unpack so it will never have access to sources. I think this
means it will only use the fallback source date epoch.



>      for cpe_id in oe.cve_check.get_cpe_ids(
>          d.getVar("CVE_PRODUCT"), d.getVar("CVE_VERSION")
>      ):
> diff --git a/meta/lib/oeqa/selftest/cases/spdx.py
> b/meta/lib/oeqa/selftest/cases/spdx.py
> index 8285189382 <(828)%20518-9382>..3b6d02d38c 100644
> --- a/meta/lib/oeqa/selftest/cases/spdx.py
> +++ b/meta/lib/oeqa/selftest/cases/spdx.py
> @@ -6,8 +6,11 @@
>
>  import textwrap
>  import hashlib
> +import os
> +from datetime import datetime, timezone
>  from oeqa.selftest.case import OESelftestTestCase
>  from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars
> +import oeqa.utils.ftools as ftools
>  import oe.spdx30
>
>
> @@ -443,3 +446,142 @@ class SPDX30Check(SPDX3CheckBase,
> OESelftestTestCase):
>                  r'\d',
>                  f"Version '{version}' for package '{name}' should contain
> digits"
>              )
> +
> +    def test_release_date_source_date_epoch(self):
> +        """releaseTime should be derived from SOURCE_DATE_EPOCH by
> default."""
> +        objset = self.check_recipe_spdx(
> +            "base-files",
> +
> "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json",
> +            task="create_recipe_spdx",
> +        )
> +
> +        # Query after the build so the do_unpack stamp file exists.
> +        source_date_epoch = get_bb_var("SOURCE_DATE_EPOCH", "base-files")
> +        expected = datetime.fromtimestamp(int(source_date_epoch),
> tz=timezone.utc)
> +
> +        recipe = None
> +        for pkg in objset.foreach_type(oe.spdx30.software_Package):
> +            if pkg.name == "base-files":
> +                recipe = pkg
> +                break
> +
> +        self.assertIsNotNone(recipe, "Unable to find base-files
> software_Package")
> +        self.assertEqual(recipe.releaseTime, expected)
> +
> +    def test_release_date_disabled(self):
> +        """SPDX_INCLUDE_RELEASE_DATE = "0" should omit releaseTime
> entirely."""
> +        objset = self.check_recipe_spdx(
> +            "base-files",
> +
> "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json",
> +            task="create_recipe_spdx",
> +            extraconf="""\
> +                SPDX_INCLUDE_RELEASE_DATE = "0"
> +                """,
> +        )
> +
> +        recipe = None
> +        for pkg in objset.foreach_type(oe.spdx30.software_Package):
> +            if pkg.name == "base-files":
> +                recipe = pkg
> +                break
> +
> +        self.assertIsNotNone(recipe, "Unable to find base-files
> software_Package")
> +        self.assertIsNone(
> +            recipe.releaseTime,
> +            "releaseTime should not be set when SPDX_INCLUDE_RELEASE_DATE
> is '0'",
> +        )
> +
> +    def test_release_date_override(self):
> +        """SPDX_COMPONENT_RELEASE_DATE overrides the resolved date."""
> +        override_date = "2020-01-01T00:00:00Z"
> +
> +        objset = self.check_recipe_spdx(
> +            "base-files",
> +
> "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json",
> +            task="create_recipe_spdx",
> +            extraconf=f"""\
> +                SPDX_COMPONENT_RELEASE_DATE = "{override_date}"
> +                """,
> +        )
> +
> +        recipe = None
> +        for pkg in objset.foreach_type(oe.spdx30.software_Package):
> +            if pkg.name == "base-files":
> +                recipe = pkg
> +                break
> +
> +        self.assertIsNotNone(recipe, "Unable to find base-files
> software_Package")
> +        self.assertEqual(
> +            recipe.releaseTime,
> +            datetime(2020, 1, 1, tzinfo=timezone.utc),
> +        )
> +
> +    def _write_test_patch(self, recipe, date_header):
> +        """Write a no-op patch against a fixture file (not part of the
> +        recipe's real source, so it isn't coupled to its content) with the
> +        given Date: header, and point FILESEXTRAPATHS at it."""
> +        inc_file = self.write_recipeinc(
> +            recipe,
> +            textwrap.dedent(
> +                """\
> +                FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> +                SRC_URI += "file://release-date-test-file"
> +                SRC_URI += "file://release-date-test.patch"
> +                """
> +            ),
> +        )
> +        patch_dir = os.path.join(os.path.dirname(inc_file), "files")
> +        os.makedirs(patch_dir, exist_ok=True)
> +        ftools.write_file(
> +            os.path.join(patch_dir, "release-date-test-file"),
> +            "original content\n",
> +        )
> +        patch_path = os.path.join(patch_dir, "release-date-test.patch")
> +        ftools.write_file(
> +            patch_path,
> +            textwrap.dedent(
> +                f"""\
> +                From: Test Author <test@example.com>
> +                Date: {date_header}
> +                Subject: [PATCH] modify release-date-test-file
> +
> +                Upstream-Status: Inappropriate [test patch, not intended
> for upstream]
> +
> +                ---
> +                --- a/release-date-test-file
> +                +++ b/release-date-test-file
> +                @@ -1 +1 @@
> +                -original content
> +                +patched content
> +                """
> +            ),
> +        )
> +        self.track_for_cleanup(patch_dir)
> +        return patch_path
> +
> +    def test_release_date_include_patches(self):
> +        """SPDX_RELEASE_DATE_INCLUDE_PATCHES = "1" makes a newer patch
> +        Date: header win over SOURCE_DATE_EPOCH."""
> +        newer_patch_date = "Mon, 15 Jun 2099 00:00:00 +0000"
> +
> +        self._write_test_patch("base-files", newer_patch_date)
> +        self.add_command_to_tearDown("bitbake -c clean base-files")
> +
> +        objset = self.check_recipe_spdx(
> +            "base-files",
> +
> "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json",
> +            task="create_recipe_spdx",
> +            extraconf="""\
> +                SPDX_RELEASE_DATE_INCLUDE_PATCHES = "1"
> +                """,
> +        )
> +        recipe = None
> +        for pkg in objset.foreach_type(oe.spdx30.software_Package):
> +            if pkg.name == "base-files":
> +                recipe = pkg
> +                break
> +        self.assertIsNotNone(recipe, "Unable to find base-files
> software_Package")
> +        self.assertEqual(
> +            recipe.releaseTime,
> +            datetime(2099, 6, 15, tzinfo=timezone.utc),
> +        )
>