mbox series

[v3,0/3] spdx: add support to include releaseTime

Message ID 20260928190400.3908822-1-daniel.turull@ericsson.com
Headers show
Series spdx: add support to include releaseTime | expand

Message

Daniel Turull Sept. 28, 2026, 7:03 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

We have a requirements to include release time of open source components
in the SBOM. There is a field specific for that in spdx 3 spec.

https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Properties/releaseTime/

This can also be used to evaluate how old are some of the core
components and decide if they need replacement.

The previous 2 versions did not have cover letter.

Tested with oe-selftest -r spdx

Daniel Turull (3):
  classes/base: exclude __CACHED_SOURCE_DATE_EPOCH from task hash
  create-spdx-3.0: record component release date in SPDX output
  scripts/contrib: add spdx-release-date-report.py

 meta/classes-global/base.bbclass            |   4 +
 meta/classes/create-spdx-3.0.bbclass        |   2 +-
 meta/lib/oe/spdx30_tasks.py                 |  19 ++
 meta/lib/oeqa/selftest/cases/spdx.py        |  39 ++++
 scripts/contrib/spdx-release-date-report.py | 193 ++++++++++++++++++++
 5 files changed, 256 insertions(+), 1 deletion(-)
 create mode 100755 scripts/contrib/spdx-release-date-report.py