mbox series

[0/1] spdx3: Export kernel configuration as build parameters in SPDX output

Message ID 20250716090517.481832-1-kamel.bouhara@bootlin.com
Headers show
Series spdx3: Export kernel configuration as build parameters in SPDX output | expand

Message

Kamel Bouhara July 16, 2025, 9:05 a.m. UTC 
Enhances the SPDX 3.0 support in OpenEmbedded by ensuring that the kernel's build-time
configuration is captured and embedded in the generated SPDX metadata.

Recipes that provide "virtual/kernel" now have their '${B}/.config' file parsed, and each 'CONFIG_*'
entry is added to the SPDX document as a 'build_parameter'.

Including the kernel configuration in SPDX output is particularly relevant for compliance, security
auditing, and long-term maintenance, as it provides a machine-readable view of the exact kernel
features enabled or disabled at build time.

Potential future enhancements:

- Support parsing `CONFIG_FOO is not set` entries to document explicitly
  disabled kernel options for greater completeness.
- Optionally allow filtering or scoping of exported options (e.g., via
  'SPDX_KERNEL_CONFIG_FILTER') to limit output size or focus on security-relevant flags e.g.:

	# Only include a specific list of kernel config options in SPDX output
	SPDX_KERNEL_CONFIG_FILTER = "CONFIG_HARDENED_USERCOPY CONFIG_STACKPROTECTOR_STRONG CONFIG_SECURITY_SELINUX CONFIG_MODULE_SIG"

Feedback is welcome.

Greetings,
Kamel

Kamel Bouhara (1):
  spdx3: Add optional kernel configuration export to build_parameter for
    virtual/kernel

 meta/classes/create-spdx-3.0.bbclass |  6 ++++++
 meta/lib/oe/spdx30_tasks.py          | 32 ++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

--
2.43.0