mbox series

[scarthgap,v4,00/17] backport: SPDX 3.0 support to Scarthgap

Message ID 20251107131502.3857600-1-kamel.bouhara@bootlin.com
Headers show
Series backport: SPDX 3.0 support to Scarthgap | expand

Message

Kamel Bouhara Nov. 7, 2025, 1:14 p.m. UTC
Hello,

This is the v4 series to backport SPDX 3.0 support from upstream
Walnascar to Scarthgap (Yocto Project 5.0 LTS).

Changes since v2:
-----------------
Cherry-picked commits:

    c5b5136bf8: Exclude do_create_spdx from automatic sysroot extension.

    03c6ace6c6: Fix SPDX_VERSION handling in selftests.

    7be5a6e699: Add tar test for SPDX 2.2.

Local fix:

    7e14a5b966: Align DEPLOY_DIR_SPDX in create-spdx-2.2.bbclass with
       ${SPDX_VERSION} layout, restoring successful SPDX 2.2 selftests.

Changes since v3:
-----------------
Cherry-picked commits:

     29d3f8ad4: classes/create-spdx-2.2: Handle empty packages

Greetings,
Kamel

Hongxu Jia (1):
  oeqa/selftest: Add SPDX 3.0 include source case for work-share

Joshua Watt (11):
  classes-global/license: Move functions to library code
  classes-global/staging: Exclude do_create_spdx from automatic sysroot
    extension
  lib/license: Move package license skip to library
  lib: oe: license: Add missing import
  classes-recipe/image: Add image file manifest
  classes-recipe/baremetal-image: Add image file manifest
  selftest: spdx: Add SPDX 3.0 test cases
  lib: oeqa: spdx: Add tests for extra options
  spdx 3.0: Rework how SPDX aliases are linked
  oeqa: spdx: Add tar test for SPDX 2.2
  classes/create-spdx-2.2: Handle empty packages

Kamel Bouhara (Schneider Electric) (4):
  backport: SPDX 3.0 fixes and tasks from upstream version Walnascar
  spdx30_tasks: fix FetchData attribute in add_download_files
  classes/create-spdx-2.2: align DEPLOY_DIR_SPDX with SPDX_VERSION
    layout
  spdx30_tasks: adapt CVE handling to new cve-check API

Richard Purdie (1):
  selftest/spdx: Fix for SPDX_VERSION addition

 meta/classes-global/base.bbclass              |   41 +-
 meta/classes-global/license.bbclass           |  165 -
 meta/classes-global/staging.bbclass           |    9 +-
 meta/classes-recipe/baremetal-image.bbclass   |   32 +-
 .../create-spdx-image-3.0.bbclass             |   85 +
 .../create-spdx-sdk-3.0.bbclass               |   74 +
 meta/classes-recipe/image.bbclass             |   58 +
 meta/classes-recipe/license_image.bbclass     |   14 +-
 meta/classes-recipe/nospdx.bbclass            |   13 +
 meta/classes/create-spdx-2.2.bbclass          |   85 +-
 meta/classes/create-spdx-3.0.bbclass          |  200 +
 meta/classes/spdx-common.bbclass              |   99 +
 meta/lib/oe/__init__.py                       |    2 +-
 meta/lib/oe/license.py                        |  203 +
 meta/lib/oe/sbom30.py                         | 1096 ++++
 meta/lib/oe/spdx30.py                         | 5593 +++++++++++++++++
 meta/lib/oe/spdx30_tasks.py                   | 1343 ++++
 meta/lib/oe/spdx_common.py                    |  244 +
 meta/lib/oeqa/selftest/cases/spdx.py          |  256 +-
 19 files changed, 9348 insertions(+), 264 deletions(-)
 create mode 100644 meta/classes-recipe/create-spdx-image-3.0.bbclass
 create mode 100644 meta/classes-recipe/create-spdx-sdk-3.0.bbclass
 create mode 100644 meta/classes-recipe/nospdx.bbclass
 create mode 100644 meta/classes/create-spdx-3.0.bbclass
 create mode 100644 meta/classes/spdx-common.bbclass
 create mode 100644 meta/lib/oe/sbom30.py
 create mode 100644 meta/lib/oe/spdx30.py
 create mode 100644 meta/lib/oe/spdx30_tasks.py
 create mode 100644 meta/lib/oe/spdx_common.py

--
2.43.0

Comments

Steve Sakoman Nov. 7, 2025, 9:16 p.m. UTC | #1
Unfortunately I'm still getting autobuilder errors on the oeeselftest
runs, example below:

https://errors.yoctoproject.org/Errors/Details/887588/

Steve

On Fri, Nov 7, 2025 at 5:15 AM Kamel Bouhara via
lists.openembedded.org
<kamel.bouhara=bootlin.com@lists.openembedded.org> wrote:
>
> Hello,
>
> This is the v4 series to backport SPDX 3.0 support from upstream
> Walnascar to Scarthgap (Yocto Project 5.0 LTS).
>
> Changes since v2:
> -----------------
> Cherry-picked commits:
>
>     c5b5136bf8: Exclude do_create_spdx from automatic sysroot extension.
>
>     03c6ace6c6: Fix SPDX_VERSION handling in selftests.
>
>     7be5a6e699: Add tar test for SPDX 2.2.
>
> Local fix:
>
>     7e14a5b966: Align DEPLOY_DIR_SPDX in create-spdx-2.2.bbclass with
>        ${SPDX_VERSION} layout, restoring successful SPDX 2.2 selftests.
>
> Changes since v3:
> -----------------
> Cherry-picked commits:
>
>      29d3f8ad4: classes/create-spdx-2.2: Handle empty packages
>
> Greetings,
> Kamel
>
> Hongxu Jia (1):
>   oeqa/selftest: Add SPDX 3.0 include source case for work-share
>
> Joshua Watt (11):
>   classes-global/license: Move functions to library code
>   classes-global/staging: Exclude do_create_spdx from automatic sysroot
>     extension
>   lib/license: Move package license skip to library
>   lib: oe: license: Add missing import
>   classes-recipe/image: Add image file manifest
>   classes-recipe/baremetal-image: Add image file manifest
>   selftest: spdx: Add SPDX 3.0 test cases
>   lib: oeqa: spdx: Add tests for extra options
>   spdx 3.0: Rework how SPDX aliases are linked
>   oeqa: spdx: Add tar test for SPDX 2.2
>   classes/create-spdx-2.2: Handle empty packages
>
> Kamel Bouhara (Schneider Electric) (4):
>   backport: SPDX 3.0 fixes and tasks from upstream version Walnascar
>   spdx30_tasks: fix FetchData attribute in add_download_files
>   classes/create-spdx-2.2: align DEPLOY_DIR_SPDX with SPDX_VERSION
>     layout
>   spdx30_tasks: adapt CVE handling to new cve-check API
>
> Richard Purdie (1):
>   selftest/spdx: Fix for SPDX_VERSION addition
>
>  meta/classes-global/base.bbclass              |   41 +-
>  meta/classes-global/license.bbclass           |  165 -
>  meta/classes-global/staging.bbclass           |    9 +-
>  meta/classes-recipe/baremetal-image.bbclass   |   32 +-
>  .../create-spdx-image-3.0.bbclass             |   85 +
>  .../create-spdx-sdk-3.0.bbclass               |   74 +
>  meta/classes-recipe/image.bbclass             |   58 +
>  meta/classes-recipe/license_image.bbclass     |   14 +-
>  meta/classes-recipe/nospdx.bbclass            |   13 +
>  meta/classes/create-spdx-2.2.bbclass          |   85 +-
>  meta/classes/create-spdx-3.0.bbclass          |  200 +
>  meta/classes/spdx-common.bbclass              |   99 +
>  meta/lib/oe/__init__.py                       |    2 +-
>  meta/lib/oe/license.py                        |  203 +
>  meta/lib/oe/sbom30.py                         | 1096 ++++
>  meta/lib/oe/spdx30.py                         | 5593 +++++++++++++++++
>  meta/lib/oe/spdx30_tasks.py                   | 1343 ++++
>  meta/lib/oe/spdx_common.py                    |  244 +
>  meta/lib/oeqa/selftest/cases/spdx.py          |  256 +-
>  19 files changed, 9348 insertions(+), 264 deletions(-)
>  create mode 100644 meta/classes-recipe/create-spdx-image-3.0.bbclass
>  create mode 100644 meta/classes-recipe/create-spdx-sdk-3.0.bbclass
>  create mode 100644 meta/classes-recipe/nospdx.bbclass
>  create mode 100644 meta/classes/create-spdx-3.0.bbclass
>  create mode 100644 meta/classes/spdx-common.bbclass
>  create mode 100644 meta/lib/oe/sbom30.py
>  create mode 100644 meta/lib/oe/spdx30.py
>  create mode 100644 meta/lib/oe/spdx30_tasks.py
>  create mode 100644 meta/lib/oe/spdx_common.py
>
> --
> 2.43.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#226036): https://lists.openembedded.org/g/openembedded-core/message/226036
> Mute This Topic: https://lists.openembedded.org/mt/116169967/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Joshua Watt Nov. 7, 2025, 9:22 p.m. UTC | #2
On Fri, Nov 7, 2025 at 2:16 PM Steve Sakoman <steve@sakoman.com> wrote:
>
> Unfortunately I'm still getting autobuilder errors on the oeeselftest
> runs, example below:
>
> https://errors.yoctoproject.org/Errors/Details/887588/

Is this the correct link? I looked at it an the failure is in devtool with:

Unable to resolve 'mbedtls-2.28' in upstream git repository in git
ls-remote output for github.com/ARMmbed/mbedtls.git

Which I don't _think_ should be related to the SPDX changes.....
perhaps an unrelated transient error?

>
> Steve
>
> On Fri, Nov 7, 2025 at 5:15 AM Kamel Bouhara via
> lists.openembedded.org
> <kamel.bouhara=bootlin.com@lists.openembedded.org> wrote:
> >
> > Hello,
> >
> > This is the v4 series to backport SPDX 3.0 support from upstream
> > Walnascar to Scarthgap (Yocto Project 5.0 LTS).
> >
> > Changes since v2:
> > -----------------
> > Cherry-picked commits:
> >
> >     c5b5136bf8: Exclude do_create_spdx from automatic sysroot extension.
> >
> >     03c6ace6c6: Fix SPDX_VERSION handling in selftests.
> >
> >     7be5a6e699: Add tar test for SPDX 2.2.
> >
> > Local fix:
> >
> >     7e14a5b966: Align DEPLOY_DIR_SPDX in create-spdx-2.2.bbclass with
> >        ${SPDX_VERSION} layout, restoring successful SPDX 2.2 selftests.
> >
> > Changes since v3:
> > -----------------
> > Cherry-picked commits:
> >
> >      29d3f8ad4: classes/create-spdx-2.2: Handle empty packages
> >
> > Greetings,
> > Kamel
> >
> > Hongxu Jia (1):
> >   oeqa/selftest: Add SPDX 3.0 include source case for work-share
> >
> > Joshua Watt (11):
> >   classes-global/license: Move functions to library code
> >   classes-global/staging: Exclude do_create_spdx from automatic sysroot
> >     extension
> >   lib/license: Move package license skip to library
> >   lib: oe: license: Add missing import
> >   classes-recipe/image: Add image file manifest
> >   classes-recipe/baremetal-image: Add image file manifest
> >   selftest: spdx: Add SPDX 3.0 test cases
> >   lib: oeqa: spdx: Add tests for extra options
> >   spdx 3.0: Rework how SPDX aliases are linked
> >   oeqa: spdx: Add tar test for SPDX 2.2
> >   classes/create-spdx-2.2: Handle empty packages
> >
> > Kamel Bouhara (Schneider Electric) (4):
> >   backport: SPDX 3.0 fixes and tasks from upstream version Walnascar
> >   spdx30_tasks: fix FetchData attribute in add_download_files
> >   classes/create-spdx-2.2: align DEPLOY_DIR_SPDX with SPDX_VERSION
> >     layout
> >   spdx30_tasks: adapt CVE handling to new cve-check API
> >
> > Richard Purdie (1):
> >   selftest/spdx: Fix for SPDX_VERSION addition
> >
> >  meta/classes-global/base.bbclass              |   41 +-
> >  meta/classes-global/license.bbclass           |  165 -
> >  meta/classes-global/staging.bbclass           |    9 +-
> >  meta/classes-recipe/baremetal-image.bbclass   |   32 +-
> >  .../create-spdx-image-3.0.bbclass             |   85 +
> >  .../create-spdx-sdk-3.0.bbclass               |   74 +
> >  meta/classes-recipe/image.bbclass             |   58 +
> >  meta/classes-recipe/license_image.bbclass     |   14 +-
> >  meta/classes-recipe/nospdx.bbclass            |   13 +
> >  meta/classes/create-spdx-2.2.bbclass          |   85 +-
> >  meta/classes/create-spdx-3.0.bbclass          |  200 +
> >  meta/classes/spdx-common.bbclass              |   99 +
> >  meta/lib/oe/__init__.py                       |    2 +-
> >  meta/lib/oe/license.py                        |  203 +
> >  meta/lib/oe/sbom30.py                         | 1096 ++++
> >  meta/lib/oe/spdx30.py                         | 5593 +++++++++++++++++
> >  meta/lib/oe/spdx30_tasks.py                   | 1343 ++++
> >  meta/lib/oe/spdx_common.py                    |  244 +
> >  meta/lib/oeqa/selftest/cases/spdx.py          |  256 +-
> >  19 files changed, 9348 insertions(+), 264 deletions(-)
> >  create mode 100644 meta/classes-recipe/create-spdx-image-3.0.bbclass
> >  create mode 100644 meta/classes-recipe/create-spdx-sdk-3.0.bbclass
> >  create mode 100644 meta/classes-recipe/nospdx.bbclass
> >  create mode 100644 meta/classes/create-spdx-3.0.bbclass
> >  create mode 100644 meta/classes/spdx-common.bbclass
> >  create mode 100644 meta/lib/oe/sbom30.py
> >  create mode 100644 meta/lib/oe/spdx30.py
> >  create mode 100644 meta/lib/oe/spdx30_tasks.py
> >  create mode 100644 meta/lib/oe/spdx_common.py
> >
> > --
> > 2.43.0
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#226036): https://lists.openembedded.org/g/openembedded-core/message/226036
> > Mute This Topic: https://lists.openembedded.org/mt/116169967/3620601
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
Steve Sakoman Nov. 7, 2025, 10:26 p.m. UTC | #3
On Fri, Nov 7, 2025 at 1:22 PM Joshua Watt <jpewhacker@gmail.com> wrote:
>
> On Fri, Nov 7, 2025 at 2:16 PM Steve Sakoman <steve@sakoman.com> wrote:
> >
> > Unfortunately I'm still getting autobuilder errors on the oeeselftest
> > runs, example below:
> >
> > https://errors.yoctoproject.org/Errors/Details/887588/
>
> Is this the correct link? I looked at it an the failure is in devtool with:
>
> Unable to resolve 'mbedtls-2.28' in upstream git repository in git
> ls-remote output for github.com/ARMmbed/mbedtls.git
>
> Which I don't _think_ should be related to the SPDX changes.....
> perhaps an unrelated transient error?

This is the right link, and you are correct, this does appear to be an
unrelated transient issue!

Sorry for the false alarm, this series was the only addition to a
previously passing patch set so I jumped to a bad conclusion :-(

Steve

> > On Fri, Nov 7, 2025 at 5:15 AM Kamel Bouhara via
> > lists.openembedded.org
> > <kamel.bouhara=bootlin.com@lists.openembedded.org> wrote:
> > >
> > > Hello,
> > >
> > > This is the v4 series to backport SPDX 3.0 support from upstream
> > > Walnascar to Scarthgap (Yocto Project 5.0 LTS).
> > >
> > > Changes since v2:
> > > -----------------
> > > Cherry-picked commits:
> > >
> > >     c5b5136bf8: Exclude do_create_spdx from automatic sysroot extension.
> > >
> > >     03c6ace6c6: Fix SPDX_VERSION handling in selftests.
> > >
> > >     7be5a6e699: Add tar test for SPDX 2.2.
> > >
> > > Local fix:
> > >
> > >     7e14a5b966: Align DEPLOY_DIR_SPDX in create-spdx-2.2.bbclass with
> > >        ${SPDX_VERSION} layout, restoring successful SPDX 2.2 selftests.
> > >
> > > Changes since v3:
> > > -----------------
> > > Cherry-picked commits:
> > >
> > >      29d3f8ad4: classes/create-spdx-2.2: Handle empty packages
> > >
> > > Greetings,
> > > Kamel
> > >
> > > Hongxu Jia (1):
> > >   oeqa/selftest: Add SPDX 3.0 include source case for work-share
> > >
> > > Joshua Watt (11):
> > >   classes-global/license: Move functions to library code
> > >   classes-global/staging: Exclude do_create_spdx from automatic sysroot
> > >     extension
> > >   lib/license: Move package license skip to library
> > >   lib: oe: license: Add missing import
> > >   classes-recipe/image: Add image file manifest
> > >   classes-recipe/baremetal-image: Add image file manifest
> > >   selftest: spdx: Add SPDX 3.0 test cases
> > >   lib: oeqa: spdx: Add tests for extra options
> > >   spdx 3.0: Rework how SPDX aliases are linked
> > >   oeqa: spdx: Add tar test for SPDX 2.2
> > >   classes/create-spdx-2.2: Handle empty packages
> > >
> > > Kamel Bouhara (Schneider Electric) (4):
> > >   backport: SPDX 3.0 fixes and tasks from upstream version Walnascar
> > >   spdx30_tasks: fix FetchData attribute in add_download_files
> > >   classes/create-spdx-2.2: align DEPLOY_DIR_SPDX with SPDX_VERSION
> > >     layout
> > >   spdx30_tasks: adapt CVE handling to new cve-check API
> > >
> > > Richard Purdie (1):
> > >   selftest/spdx: Fix for SPDX_VERSION addition
> > >
> > >  meta/classes-global/base.bbclass              |   41 +-
> > >  meta/classes-global/license.bbclass           |  165 -
> > >  meta/classes-global/staging.bbclass           |    9 +-
> > >  meta/classes-recipe/baremetal-image.bbclass   |   32 +-
> > >  .../create-spdx-image-3.0.bbclass             |   85 +
> > >  .../create-spdx-sdk-3.0.bbclass               |   74 +
> > >  meta/classes-recipe/image.bbclass             |   58 +
> > >  meta/classes-recipe/license_image.bbclass     |   14 +-
> > >  meta/classes-recipe/nospdx.bbclass            |   13 +
> > >  meta/classes/create-spdx-2.2.bbclass          |   85 +-
> > >  meta/classes/create-spdx-3.0.bbclass          |  200 +
> > >  meta/classes/spdx-common.bbclass              |   99 +
> > >  meta/lib/oe/__init__.py                       |    2 +-
> > >  meta/lib/oe/license.py                        |  203 +
> > >  meta/lib/oe/sbom30.py                         | 1096 ++++
> > >  meta/lib/oe/spdx30.py                         | 5593 +++++++++++++++++
> > >  meta/lib/oe/spdx30_tasks.py                   | 1343 ++++
> > >  meta/lib/oe/spdx_common.py                    |  244 +
> > >  meta/lib/oeqa/selftest/cases/spdx.py          |  256 +-
> > >  19 files changed, 9348 insertions(+), 264 deletions(-)
> > >  create mode 100644 meta/classes-recipe/create-spdx-image-3.0.bbclass
> > >  create mode 100644 meta/classes-recipe/create-spdx-sdk-3.0.bbclass
> > >  create mode 100644 meta/classes-recipe/nospdx.bbclass
> > >  create mode 100644 meta/classes/create-spdx-3.0.bbclass
> > >  create mode 100644 meta/classes/spdx-common.bbclass
> > >  create mode 100644 meta/lib/oe/sbom30.py
> > >  create mode 100644 meta/lib/oe/spdx30.py
> > >  create mode 100644 meta/lib/oe/spdx30_tasks.py
> > >  create mode 100644 meta/lib/oe/spdx_common.py
> > >
> > > --
> > > 2.43.0
> > >
> > >
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > > Links: You receive all messages sent to this group.
> > > View/Reply Online (#226036): https://lists.openembedded.org/g/openembedded-core/message/226036
> > > Mute This Topic: https://lists.openembedded.org/mt/116169967/3620601
> > > Group Owner: openembedded-core+owner@lists.openembedded.org
> > > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > >