mbox series

[0/1] spdx30: Runtime dependency detection from package manifests

Message ID 20260221042521.318013-1-stondo@gmail.com
Headers show
Series spdx30: Runtime dependency detection from package manifests | expand

Message

Stefano Tondo Feb. 21, 2026, 4:25 a.m. UTC 
From: Stefano Tondo <stefano.tondo.ext@siemens.com>

This patch adds lifecycle scope classification for SPDX 3.0 dependency
relationships by reading runtime dependencies from package manifests.

Currently, SPDX 3.0 dependency relationships lack lifecycle scope
classification - all dependencies appear the same regardless of whether
they are build-time or runtime. This patch reads the package manager's
manifest files to determine which dependencies are actually needed at
runtime, enabling proper LifecycleScopeType annotation.

Key changes:
- Read runtime dependencies from package manifests (dpkg, rpm, ipk)
- Classify dependencies as runtime or build scope in SPDX relationships
- Add oe-selftest coverage for lifecycle scope classification
- Properly handle implicit shared library dependencies (e.g., glibc)

This enables downstream tools to distinguish build-time from runtime
dependencies for vulnerability analysis and compliance assessment.

Stefano Tondo (1):
  spdx30: Read runtime dependencies from package manifests

 meta/classes/spdx-common.bbclass     |  53 +++++++++----
 meta/lib/oe/spdx30_tasks.py          | 112 ++++++++++++++++++++++++++-
 meta/lib/oeqa/selftest/cases/spdx.py |  78 +++++++++++++++++++
 3 files changed, 227 insertions(+), 16 deletions(-)