mbox series

[0/2] Add meta layer information to spdx

Message ID 20260914114526.2646773-1-dwagenknecht@emlix.com
Headers show
Series Add meta layer information to spdx | expand

Message

Daniel Wagenknecht Sept. 14, 2026, 11:44 a.m. UTC 
Hello,

as discussed before here
https://lists.openembedded.org/g/openembedded-core/message/226131
and here
https://lists.openembedded.org/g/openembedded-core/message/225774

it would be good to include information about the layers used in a build in the
generated spdx documents.

My primary goal is to track where all the configuration files added via file
protocol in `SRC_URI` originate from, but the approach could be extended to
track recipes, classes, machine config etc.

These patches are meant as a basis to discuss the approach and should be
considered draft status.

The approach is to generate a `layers.spdx.json` on each build invocation
that lists each layer used in the build as a `softwarePackage` with version
and source information as well as - if can be reasonably deducted - the
downloadLocation. Each source file added via file protocol is then linked to the
containing meta layer via a `contains` relationship.

Open Questions:
- is the overall architecture reasonable/correct?
- referring to layers is inconsistent across tooling. E.g. the core layer is
  either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is
  the layer directory in the openembedded-core repository.
  I chose the latter since that is what the utility function
  `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL)
  implementation uses the other naming scheme though. Any thoughts on which
  should be chosen and why?
- I do not understand the alias linking yet. With the current implementation
  I see many hash mismatches like
  WARNING: gcc-runtime-15.3.0-r0 do_create_spdx: Element http://spdx.org/spdxdocs/layers-7ad0d8d7-57f9-5c3c-9411-49227dd50610/layers/layer/meta
    has alias http://spdx.org/spdxdocs/UNIHASH-7ad0d8d7-57f9-5c3c-9411-49227dd50610/UNIHASH/layer/meta, but it should have prefix
    http://spdxdocs.org/openembedded-alias/by-doc-hash/e80f1d61f4749e663e80a4dfb25ebb1127b5f50600d3065de7ed91030942a1ef/

I've currently got some time available to work on this to get a proper solution
integrated into openembedded-core.

Best Wishes
Daniel Wagenknecht 



Daniel Wagenknecht (2):
  spdx: add entries for meta-layers
  spdx: link files to the meta-layer providing them

 meta/classes/create-spdx-3.0.bbclass |   1 +
 meta/classes/spdx-common.bbclass     |   3 +
 meta/lib/oe/sbom30.py                |  12 +++
 meta/lib/oe/spdx30_tasks.py          | 118 ++++++++++++++++++++++++++-
 4 files changed, 130 insertions(+), 4 deletions(-)