mbox series

[wrynose,0/4] spdx: fix the compiled-sources filter

Message ID 20260917-backport-wrynose-v1-0-bb7d640c2719@jp.honda
Headers show
Series spdx: fix the compiled-sources filter | expand

Message

KAZUYOSHI AKIYAMA (秋山 和慶) Sept. 17, 2026, 4:24 a.m. UTC 
SPDX_INCLUDE_COMPILED_SOURCES is meant to filter all source files down to
only the ones that were compiled before adding them to the SBOM,
but on wrynose it doesn't work.
add_package_files() is what picks which files go into the SBOM.
It walks ${SPDXWORK} itself to get file paths,
then keeps only the ones that match the list of compiled sources
returned by get_compiled_sources().
get_compiled_sources() just returns what save_debugsources_info() stored,
and that data uses paths rooted at ${TARGET_DBGSRC_DIR}
(= /usr/src/debug/${PN}/${PV}), not the ${SPDXWORK}-rooted paths
add_package_files() compares against.
So the list get_compiled_sources() returns never matches
what add_package_files() is comparing,
and almost every file ends up marked as not compiled.
This happens for every recipe except the kernel,
which has its own special-cased path.

This isn't just a matter of the SBOM missing the right files.
sbom-cve-check uses the same match result to decide whether
a vulnerable file was actually built, for its vulnerability triage.
If the match count is always zero, that triage doesn't work either.
On yocto-6.0.2 we confirmed the misjudgment affects cpio and perl.

master already has this fixed,
and this backport brings that fix to wrynose.
b567c2f0d9 is the commit that fixes it.
Everything else in the series is a prerequisite for that patch.
Backporting b567c2f0d9 along with its prerequisites
brings wrynose's behavior in line with master.
With this, compiled sources get counted correctly,
and sbom-cve-check's triage works correctly too.

On wrynose (genericx86-64, core-image-full-cmdline),
the match rate goes from effectively zero to 93.9%.

One thing changes.
What the SBOM records as a source file name changes too.
aa44a0f0eb re-unpacks under UNPACKDIR instead of WORKDIR,
so a recorded source file name changes
(e.g. sources/acl-2.3.2/... becomes acl-2.3.2/...).
This is a change to SBOM metadata only.
The actual build output is unaffected.
Anyone diffing SBOMs across LTS point releases will see it.

Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
---
Benjamin Robin (4):
      spdx_common: simplify get_patched_src() implementation
      spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
      spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
      package: no longer modify paths in save_debugsources_info()

 meta/lib/oe/package.py      |  54 +++++++++----------
 meta/lib/oe/spdx30_tasks.py |   1 -
 meta/lib/oe/spdx_common.py  | 125 +++++++++++++++++++++++++++-----------------
 3 files changed, 101 insertions(+), 79 deletions(-)
---
base-commit: 9da814ca3685ada3fce46b8987f04ed3d57247b7
change-id: 20260917-backport-wrynose-8fa831054074

Best regards,
--  
Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>