mbox series

[0/2] spdx30: Add summary field and concluded license support

Message ID 20251218120139.104155-1-stondo@gmail.com
Headers show
Series spdx30: Add summary field and concluded license support | expand

Message

Stefano Tondo Dec. 18, 2025, 12:01 p.m. UTC 
This patch series improves SPDX 3.0 SBOM documentation quality by adding
summary field population and concluded license support.

The summary field enhancement makes SBOMs more human-readable by providing
brief descriptions for each package using an intelligent fallback chain.
This is particularly useful for security review and compliance documentation
where understanding component purposes at a glance is valuable.

The concluded license support allows tracking the results of manual or
automated license analysis in SBOMs through the SPDX_CONCLUDED_LICENSE
variable. This addresses use cases where license analysis identifies
differences from the declared LICENSE field, with clear guidelines on when
to use the variable versus correcting the upstream LICENSE field.

Both changes improve SBOM completeness and usefulness without impacting
existing builds or requiring changes to existing recipes.

Stefano Tondo (2):
  spdx30_tasks: Add summary field with fallback chain
  spdx30_tasks: Add concluded license support with
    SPDX_CONCLUDED_LICENSE

 meta/classes/spdx-common.bbclass | 11 +++++++++++
 meta/lib/oe/spdx30_tasks.py      | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

--
2.43.0