mbox series

[scarthgap,0/1] Fix SPDX_INCLUDE_COMPILED_SOURCES in SPDX3

Message ID 20260522104644.788606-1-joaomarcos.costa@bootlin.com
Headers show
Series Fix SPDX_INCLUDE_COMPILED_SOURCES in SPDX3 | expand

Message

Joao Marcos Costa May 22, 2026, 10:46 a.m. UTC 
From: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>

Hello,

Currently, a SPDX3 SBoM including the compiled sources [1] is incomplete due to
a path mismatch between what is provided by package.py and what is expected by
SPDX3 (spdx30_tasks.py, spdx_common.py). Example:

- package.py provides: "linux-yocto-6.6.123+git-r0/drivers/base/soc.c"

- SPDX3 expects: "linux-yocto-6.6.127+git/drivers/base/soc.c"

This patch fixes this mismatch, and ensures the SPDX v2.2 code is changed
accordingly.

Best regards,

[1] SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"

João Marcos Costa (Schneider Electric) (1):
  meta/lib/oe/package.py: fix path to kernel sources in
    save_debugsources_info

 meta/classes/create-spdx-2.2.bbclass | 2 +-
 meta/lib/oe/package.py               | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)