mbox series

[v3,0/2] spdx3: Add optional support for exporting

Message ID 20250821145438.2537767-1-kamel.bouhara@bootlin.com
Headers show
Series spdx3: Add optional support for exporting | expand

Message

Kamel Bouhara Aug. 21, 2025, 2:54 p.m. UTC 
Hi all,

This patch series introduces *optional* support for exporting
build-time configuration metadata into SPDX 3.0 documents.

The goal is to improve traceability and reproducibility in SPDX output,
particularly for security-critical settings.

The series adds support for two types of build metadata:

  1. Linux kernel configuration (.config)
     - Exported as a dedicated build_Build object
     - Each CONFIG_* line becomes a 'DictionaryEntry' in 'build_parameter'
     - Linked to the main recipe build using an 'ancestorOf' relationship
     - Controlled via 'SPDX_INCLUDE_KERNEL_CONFIG' (default: "0")

  2. PACKAGECONFIG feature set
     - Each PACKAGECONFIG feature is recorded as a DictionaryEntry
     - Captures whether a feature is enabled or disabled
     - Stored in the recipe's build_Build.build_parameter
     - Controlled via 'SPDX_INCLUDE_PACKAGECONFIG' (default: "0")

Both features are fully opt-in and have negligible runtime cost when
disabled.

This makes it easy for users to selectively enable metadata export only
when needed; for example, in CI pipelines, security audits, or diffing
builds for regressions.

As discussed in [1], the kernel's .config is a good candidate for
inclusion in SPDX.

The approach follows SPDX modeling by introducing a *separate build object*
for kernel configuration, avoiding overloading the meaning of the main
recipe build. This is linked via a 'ancestorOf' relationship to preserve
traceability.

Regarding PACKAGECONFIG values exported by SPDX_INCLUDE_BUILD_VARIABLES,
there are raw unevaluated strings and don’t show which features are
enabled/disabled.

Exporting each PACKAGECONFIG feature explicitly provides clear,
machine-readable data, which is especially useful for diffing builds.

While this doesn't aim to turn SPDX into a full build tracker, it *does*
provide a consistent, machine-readable way to surface relevant build
decisions in SBOMs already being generated.

This approach was validated internally to track hardening flags and
kernel changes.

[1] https://lists.openembedded.org/g/openembedded-core/message/220705

Kamel Bouhara (2):
  kernel.bbclass: Add task to export kernel configuration to SPDX
  spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX

 meta/classes-recipe/kernel.bbclass   | 63 ++++++++++++++++++++++++++++
 meta/classes/create-spdx-3.0.bbclass | 11 +++++
 meta/lib/oe/spdx30_tasks.py          | 20 +++++++++
 3 files changed, 94 insertions(+)

--
2.43.0