mbox series

[v8,0/9] Implement SPDX for deploy tasks

Message ID 20261104153535.3184146-1-JPEWhacker@gmail.com
Headers show
Series Implement SPDX for deploy tasks | expand

Message

Joshua Watt Nov. 4, 2026, 3:33 p.m. UTC 
The SPDX use case for file system image has been well defined since SPDX
was first implemented, however there has always been a desire to also
express SPDX output for other non-image deliverables (primarily, those
that have a do_deploy task or similar). These types of tasks cannot
easily use the traditional method of having a separate SPDX task that
runs to create their SPDX output as this causes lots of problems with
the way dependencies are specified. Instead, it is desirable for these
tasks to directly produce SPDX output that can be consumed by other
tasks that depend on them.

This patch series adds support for this. Any sstate task that starts
with "do_deploy" can now be added to the SPDX_DEPLOY_TASKS list and it
will run a postfunc to generate SPDX output that describes what is being
deployed. For classical do_deploy tasks, this is setup to be easy by
automatically capturing all the deployed output files in the SPDX data,
but other tasks can be added as well.

Finally, the do_create_image_spdx task is removed and replaced with a
SPDX deploy postfunc using this new system. This means that any task
that depends on do_image_complete will automatically also get the SPDX
output for the image, simplifying the dependency handling.

V2: Fixed SPDX documents missing at SBoM creation time when the
documents were not a direct dependency of the SBoM, and were present in
a sstate object. Previously, these sstate objects were not restored
because they were "covered" by the later sstate tasks, but now they are
restored if they are depended on by a task that creates SPDX output.

V3: Fixed a bug where dependencies that are not in the taskhash could be
missing when the final SBoM is created and added tests.

V4: Fixed some testing errors that revealed that EFI providers have to
be MACHINE_ARCH (and consequently, wic-tools)

V6: Fixed a bug where eudev/systemd initramfs-framework was not being
properly detected and the wrong link was in the SPDX due to the switch
between the two not being detected.

Also, deploy.bbclass now always adds do_deploy to SPDX_DEPLOY_TASKS, so
any recipe inheriting that class gets it automatically.

V7: Add SPDX_DEPLOY_ALLOW_EMPTY variable, and set it on ovmf to fix it
erroring out for native builds.

V8: Fix deploy error for linux-dummy, and allarch signature error for
initramfs-framework

Joshua Watt (9):
  spdx: Skip dependencies that are not in the taskhash
  spdx: Add ability for deploy tasks to create SPDX
  oeqa: Add SPDX deploy SBoM test
  classes-global/sstate: Keep SPDX generating setscene dependencies
  classes-recipe/deploy: Add do_deploy to SPDX_DEPLOY_TASKS
  spdx: Replace do_create_image_spdx with deploy task
  layer.conf: Fix initramfs-framework not knowing which udev it has
  ovmf: Allow empty SPDX deploy artifacts
  linux-dummy: Allow empty SPDX deploy artifacts

 meta/classes-global/sstate.bbclass            |  38 ++-
 .../create-spdx-image-3.0.bbclass             |  32 +-
 meta/classes-recipe/deploy.bbclass            |   2 +
 meta/classes-recipe/nospdx.bbclass            |   2 +-
 meta/classes/create-spdx-3.0.bbclass          | 185 ++++++++++
 meta/classes/spdx-common.bbclass              |   2 +-
 meta/conf/layer.conf                          |   2 -
 meta/lib/oe/sbom30.py                         |  46 ++-
 meta/lib/oe/spdx30_tasks.py                   | 323 ++++++++++++++----
 meta/lib/oe/spdx_common.py                    |   2 +-
 meta/lib/oeqa/selftest/cases/spdx.py          |  11 +
 .../initrdscripts/initramfs-framework_1.0.bb  |   2 -
 meta/recipes-core/ovmf/ovmf_git.bb            |   1 +
 meta/recipes-kernel/linux/linux-dummy.bb      |   2 +
 14 files changed, 545 insertions(+), 105 deletions(-)