[DRAFT,v3,0/2] Add meta layer information to spdx

v3 of the patch series looking for feedback on the overall architecture. I
worked out the problem in alias linking, so a major blocker is out of the way.

Please continue to consider this as a draft for discussion only!

During discussion on IRC some questions were raised especially regarding the
interaction with sstate caching.
The layer information is only part of `create_spdx`, not `create_recipe_spdx`.
It is thus only added to the final image spdx documents, not to the individual
recipe or packagage spdx document. Images and their spdx documents are always
rebuild, so with this approach no additional rebuilds occur even if a layers
revision changes.

My still open questions are:
* is the overall architecture reasonable/correct?
* referring to layers is inconsistent across tooling. E.g. the core layer is
  either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is
  the layer directory in the openembedded-core repository.
  I chose the latter since that is what the utility function
  `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL)
  implementation uses the other naming scheme though. Any thoughts on which
  should be chosen and why? 

v3:
* rebase onto current master branch
* fixed the alias linking

v2:
* fix build failures on clean build (layers.spdx.json created before bitbake.spdx.json)
* rebase onto current master branch
* remove commented out parts for overwriting the layer commit id

Daniel Wagenknecht (2):
  spdx: add entries for meta-layers
  spdx: link files to the meta-layer providing them

 meta/classes/create-spdx-3.0.bbclass |   1 +
 meta/classes/spdx-common.bbclass     |   3 +
 meta/lib/oe/sbom30.py                |  12 +++
 meta/lib/oe/spdx30_tasks.py          | 118 ++++++++++++++++++++++++++-
 4 files changed, 130 insertions(+), 4 deletions(-)

On Fri Nov 6, 2026 at 11:54 AM GMT, Daniel Wagenknecht wrote:
> v3 of the patch series looking for feedback on the overall architecture. I
> worked out the problem in alias linking, so a major blocker is out of the way.
>
> Please continue to consider this as a draft for discussion only!
>
> During discussion on IRC some questions were raised especially regarding the
> interaction with sstate caching.
> The layer information is only part of `create_spdx`, not `create_recipe_spdx`.
> It is thus only added to the final image spdx documents, not to the individual
> recipe or packagage spdx document. Images and their spdx documents are always
> rebuild, so with this approach no additional rebuilds occur even if a layers
> revision changes.
>
> My still open questions are:
> * is the overall architecture reasonable/correct?
> * referring to layers is inconsistent across tooling. E.g. the core layer is
>   either named `core` as defined by `BBFILE_COLLECTIONS` or `meta` as that is
>   the layer directory in the openembedded-core repository.
>   I chose the latter since that is what the utility function
>   `oe.buildcfg.get_layer_revisions` returns. The package URL (PURL)
>   implementation uses the other naming scheme though. Any thoughts on which
>   should be chosen and why? 

Hi Daniel,

It's worth thinking about how this will interact with the proposed
changes to how layer.conf will work [1] [2]. That should hopefully
improve consistency in how layers are referred to across tools, but may
also impact other parts of these patches.

[1]: https://lists.openembedded.org/g/openembedded-architecture/topic/layers_and_layer_conf_time/121884200
[2]: https://lists.openembedded.org/g/openembedded-architecture/topic/layer_changes_poc_and_rfc/122113105

Best regards,