mbox series

[v2,0/2] spdx3: Add optional support for exporting

Message ID 20250728133044.39757-1-kamel.bouhara@bootlin.com
Headers show
Series spdx3: Add optional support for exporting | expand

Message

Kamel Bouhara July 28, 2025, 1:30 p.m. UTC 
Hi all,

This v2 patch series introduces *optional* support for exporting
build-time configuration metadata into SPDX 3.0 documents.

The goal is to improve traceability and reproducibility in SPDX output,
particularly for security-critical settings.

The series adds support for two types of build metadata:

  1. Linux kernel configuration (.config)
     - Exported as a dedicated build_Build object
     - Each CONFIG_* line becomes a 'DictionaryEntry' in 'build_parameter'
     - Linked to the main recipe build using an 'ancestorOf' relationship
     - Controlled via 'SPDX_INCLUDE_KERNEL_CONFIG' (default: "0")

  2. PACKAGECONFIG feature set
     - Each PACKAGECONFIG feature is recorded as a DictionaryEntry
     - Captures whether a feature is enabled or disabled
     - Stored in the recipe's build_Build.build_parameter
     - Controlled via 'SPDX_INCLUDE_PACKAGECONFIG' (default: "0")

Both features are fully opt-in and have negligible runtime cost when
disabled.

This makes it easy for users to selectively enable metadata export only
when needed; for example, in CI pipelines, security audits, or diffing
builds for regressions.

As discussed in [1], the kernel's .config is a good candidate for
inclusion in SPDX.

The approach follows SPDX modeling by introducing a *separate build object*
for kernel configuration, avoiding overloading the meaning of the main
recipe build. This is linked via a 'ancestorOf' relationship to preserve
traceability.

Similarly, PACKAGECONFIG settings are metadata that can help detect
build-time feature toggles, especially across different configurations
or product variants.

While this doesn't aim to turn SPDX into a full build tracker, it *does*
provide a consistent, machine-readable way to surface relevant build
decisions in SBOMs already being generated.

This approach was validated internally to track hardening flags and
kernel changes.

[1] https://lists.openembedded.org/g/openembedded-core/message/220705


Kamel Bouhara (2):
  kernel.bbclass: Add task to export kernel configuration to SPDX
  spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX

 meta/classes-recipe/kernel.bbclass   | 62 ++++++++++++++++++++++++++++
 meta/classes/create-spdx-3.0.bbclass | 11 +++++
 meta/lib/oe/spdx30_tasks.py          | 20 +++++++++
 3 files changed, 93 insertions(+)

--
2.43.0