mbox series

[00/10] spdx3: Bug fixes and improvements

Message ID 20260420-spdx3-improvements-v1-0-27e0d5edcdbe@bootlin.com
Headers show
Series spdx3: Bug fixes and improvements | expand

Message

Benjamin Robin April 20, 2026, 7:44 a.m. UTC 
This series tries to improve the generation of SPDX3 SBOM.
I am sorry, this series arrives a bit late...

There are various cleanup commits:
 - Simplify how to reference OEDocumentExtension class.
 - Simplify the sorting of a license dictionary
 - Remove unused local variables
 - Remove redundant '\d' in RegExp

There are 2 bug fixes:
 - Fix undeclared variables in import_bitbake_build()
 - Fix return value of get_package_sources_from_debug()

There are 2 improvements:
 - Add status notes to VEX relationship. Without this improvement the message
   provided in CVE_STATUS is lost. The generated JSON generated by the VEX
   Yocto class provides the information, but the goal is to have everything
   inside the SPDX3 SBOM file.
 - Prevents duplication of sources in "hasInput" relationships.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Benjamin Robin (Schneider Electric) (10):
      oe/sbom30: Remove unneeded oe.sbom30. to reference local symbol
      oe/sbom30: Simplify sorting of license_text_map
      oe/sbom30: Fix undeclared variable in import_bitbake_build()
      oe/spdx30_tasks: Remove unused license_ref_idx variable
      oe/spdx30_tasks: Fix return value of get_package_sources_from_debug
      oe/spdx30_tasks: Remove unused local variables
      oe/spdx_common: Remove redundant '\d' in RegExp
      oe/spdx_common: Remove unused local variables
      oe/spdx30_task: Add status notes to VEX relationship
      oe/spdx30_task: Prevent duplication of sources in hasInput rel

 meta/lib/oe/sbom30.py       | 25 +++++++++++++++----------
 meta/lib/oe/spdx30_tasks.py | 38 ++++++++++++++++++--------------------
 meta/lib/oe/spdx_common.py  |  5 +----
 3 files changed, 34 insertions(+), 34 deletions(-)
---
base-commit: d9b69d0a2d69e003b9432e1473830a89ff5a06c4
change-id: 20260420-spdx3-improvements-86cfa729a464

Best regards,
--  
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>