mbox series

[0/6] Add SPDX 3.0 support

Message ID 20240610214456.2757397-1-JPEWhacker@gmail.com
Headers show
Series Add SPDX 3.0 support | expand

Message

Joshua Watt June 10, 2024, 9:41 p.m. UTC 
This patch series add support for SPDX 3.0. Currently it is not possible
to have SPDX 2.2 and SPDX 3.0 enabled at the same time; users may choose
to specifically use SPDX 3.0 instead of 2.2 by doing INHERIT +=
"create-spdx-3.0"

The default version is not changed yet, although that will likely happen
soon

Joshua Watt (6):
  classes-recipe/image: Add image file manifest
  classes/spdx-common: Move common SPDX to new class
  classes/spdx-common: Add SPDX version to path
  classes/spdx-common: Return empty list from extract_licenses
  classes/create-spdx-3.0: Add class
  classes-recipe/image_types: Add SPDX_IMAGE_PURPOSE to images

 meta/classes-recipe/image.bbclass           |   61 +
 meta/classes-recipe/image_types.bbclass     |    2 +
 meta/classes-recipe/image_types_wic.bbclass |    1 +
 meta/classes/create-spdx-2.2.bbclass        |  261 +-
 meta/classes/create-spdx-3.0.bbclass        | 1284 +++++
 meta/classes/spdx-common.bbclass            |  280 +
 meta/lib/oe/sbom30.py                       |  993 ++++
 meta/lib/oe/spdx30.py                       | 5413 +++++++++++++++++++
 8 files changed, 8046 insertions(+), 249 deletions(-)
 create mode 100644 meta/classes/create-spdx-3.0.bbclass
 create mode 100644 meta/classes/spdx-common.bbclass
 create mode 100644 meta/lib/oe/sbom30.py
 create mode 100644 meta/lib/oe/spdx30.py

Comments

Richard Purdie June 11, 2024, 8:50 a.m. UTC | #1 
On Mon, 2024-06-10 at 15:41 -0600, Joshua Watt via lists.openembedded.org wrote:
> This patch series add support for SPDX 3.0. Currently it is not possible
> to have SPDX 2.2 and SPDX 3.0 enabled at the same time; users may choose
> to specifically use SPDX 3.0 instead of 2.2 by doing INHERIT +=
> "create-spdx-3.0"
> 
> The default version is not changed yet, although that will likely happen
> soon

Does this series depend on other patches?

Cheers,

Richard
Richard Purdie June 11, 2024, 10:40 a.m. UTC | #2 
On Mon, 2024-06-10 at 15:41 -0600, Joshua Watt via
lists.openembedded.org wrote:
> This patch series add support for SPDX 3.0. Currently it is not
> possible
> to have SPDX 2.2 and SPDX 3.0 enabled at the same time; users may
> choose
> to specifically use SPDX 3.0 instead of 2.2 by doing INHERIT +=
> "create-spdx-3.0"
> 
> The default version is not changed yet, although that will likely
> happen
> soon
> 
> Joshua Watt (6):
>   classes-recipe/image: Add image file manifest
>   classes/spdx-common: Move common SPDX to new class
>   classes/spdx-common: Add SPDX version to path
>   classes/spdx-common: Return empty list from extract_licenses
>   classes/create-spdx-3.0: Add class
>   classes-recipe/image_types: Add SPDX_IMAGE_PURPOSE to images

I set 3.0 to the default for testing and there were some interesting
looking failures:

https://valkyrie.yoctoproject.org/#/builders/43/builds/52/steps/11/logs/stdio

I'm guessing:

https://valkyrie.yoctoproject.org/#/builders/37/builds/60

is due to a missing patch?

Other failures:

https://valkyrie.yoctoproject.org/#/builders/74/builds/44/steps/13/logs/stdio
https://valkyrie.yoctoproject.org/#/builders/93/builds/51/steps/11/logs/stdio

but I stopped the build at this point.

Cheers,

Richard
Joshua Watt June 11, 2024, 2:42 p.m. UTC | #3 
On Tue, Jun 11, 2024 at 4:40 AM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Mon, 2024-06-10 at 15:41 -0600, Joshua Watt via
> lists.openembedded.org wrote:
> > This patch series add support for SPDX 3.0. Currently it is not
> > possible
> > to have SPDX 2.2 and SPDX 3.0 enabled at the same time; users may
> > choose
> > to specifically use SPDX 3.0 instead of 2.2 by doing INHERIT +=
> > "create-spdx-3.0"
> >
> > The default version is not changed yet, although that will likely
> > happen
> > soon
> >
> > Joshua Watt (6):
> >   classes-recipe/image: Add image file manifest
> >   classes/spdx-common: Move common SPDX to new class
> >   classes/spdx-common: Add SPDX version to path
> >   classes/spdx-common: Return empty list from extract_licenses
> >   classes/create-spdx-3.0: Add class
> >   classes-recipe/image_types: Add SPDX_IMAGE_PURPOSE to images
>
> I set 3.0 to the default for testing and there were some interesting
> looking failures:
>
> https://valkyrie.yoctoproject.org/#/builders/43/builds/52/steps/11/logs/stdio
>
> I'm guessing:
>
> https://valkyrie.yoctoproject.org/#/builders/37/builds/60
>
> is due to a missing patch?

Hah, I don't think so, I just neglected to test SDK builds. My bad.

>
> Other failures:
>
> https://valkyrie.yoctoproject.org/#/builders/74/builds/44/steps/13/logs/stdio
> https://valkyrie.yoctoproject.org/#/builders/93/builds/51/steps/11/logs/stdio

That one appears to be some corner case I need to figure out.

>
> but I stopped the build at this point.

Thanks

>
> Cheers,
>
> Richard