mbox series

[v8,0/7] SPDX 3.0 SBOM enrichment and compliance improvements

Message ID 20260309132854.128375-1-stondo@gmail.com
Headers show
Series SPDX 3.0 SBOM enrichment and compliance improvements | expand

Message

Stefano Tondo March 9, 2026, 1:28 p.m. UTC 
From: Stefano Tondo <stefano.tondo.ext@siemens.com>

This series enhances SPDX 3.0 SBOM generation with enriched
metadata, ecosystem-specific Package URLs, and compliance
improvements. It addresses all feedback from Joshua Watt's
review of the v7 series.

Changes since v7:
- Patch 1: Dropped tri-state SPDX_FILES_INCLUDED, replaced
  with simple SPDX_FILE_EXCLUDE_PATTERNS (no-op when empty).
  Removed SBOM_COMPONENT_*/SBOM_SUPPLIER_* variables.
- Patch 2: Cleaned up supplier support, no variable renames.
- Patch 3: Redesigned ecosystem PURL generation. Each bbclass
  (pypi, npm, cargo, go-mod, cpan) sets its own PURL by
  prepending to SPDX_PACKAGE_URLS. No bb.data.inherits_class()
  from SPDX code.
- Patch 4: Squashed v7 patches 4+5+6. Full SHA-1 for versions.
  urllib.parse for Git URL parsing. split(':', 1) for mappings.
  Extracted _generate_git_purl()/_enrich_source_package().
  Dropped tag-to-version heuristic and archive format check.
  Preserved inputs.add(dl). HOMEPAGE ref at recipe level only.
- Patch 5: Merged v7 patches 7+8. Dropped SPDX_NAMESPACE_PREFIX
  and hasattr() per review feedback.
- Patches 6-7: Unchanged from v7 (LGTM with Reviewed-by).

v7: https://lists.openembedded.org/g/openembedded-core/message/209863

Stefano Tondo (7):
  spdx30: Add configurable file exclusion pattern support
  spdx30: Add supplier support for image and SDK SBOMs
  spdx30: Add ecosystem-specific PURL generation via bbclasses
  spdx30: Enrich source downloads with version and PURL
  oeqa/selftest: Add tests for source download enrichment
  cve_check: Escape special characters in CPE 2.3 strings
  spdx-common: Add documentation for undocumented SPDX variables

 meta/classes-recipe/cargo_common.bbclass |   3 +
 meta/classes-recipe/cpan.bbclass         |  11 ++
 meta/classes-recipe/go-mod.bbclass       |   3 +
 meta/classes-recipe/npm.bbclass          |   7 +
 meta/classes-recipe/pypi.bbclass         |   3 +
 meta/classes/create-spdx-3.0.bbclass     |  17 +++
 meta/classes/spdx-common.bbclass         |  32 +++++
 meta/lib/oe/cve_check.py                 |  38 ++++-
 meta/lib/oe/spdx30_tasks.py              | 170 ++++++++++++++++++++++-
 meta/lib/oeqa/selftest/cases/spdx.py     |  69 +++++++++
 10 files changed, 348 insertions(+), 5 deletions(-)