mbox series

[wrynose,0/4] spdx30: fix the source download enrichment

Message ID 20261111173537.3653558-1-stondo@gmail.com
Headers show
Series spdx30: fix the source download enrichment | expand

Message

Stefano Tondo Nov. 11, 2026, 5:35 p.m. UTC 
Hi Yoann,

This series backports three spdx30 fixes from master to wrynose, plus
their tests. Patches 2 to 4 also go to blacksail in a separate series.
Blacksail already has patch 1.

Wrynose has 9f1825e74d ("spdx30: Add Git version and PURL to source
downloads"). It adds the commit hash as version and a purl to the Git
source downloads in the SPDX. That code has three bugs, and master
fixed all of them:

1. spdx30_tasks: Fix duplicated revision in Git PURLs (e31479ddba)

   On wrynose, every Git purl has the revision twice, for example
   pkg:github/fastfloat/fast_float@<rev>@<rev>. That purl is invalid,
   so scanners cannot match it. Master reformatted the file after this
   fix, so I applied it by hand. The change is the same.

2. spdx30: Make source download enrichment part of the task signature
   (e57ec14f8d)

   The enrichment code is in two functions whose names start with an
   underscore. bitbake leaves such functions out of the task
   signature. So do_create_spdx did not track them, or the
   SPDX_GIT_PURL_MAPPINGS variable that they read. After a change,
   bitbake restored the old SPDX from sstate. The fix renames the two
   functions. As a side effect, the do_create_spdx signature of every
   recipe changes once.

3. spdx30: Enrich gitsm source downloads like git ones (1e5146d8f9)

   This one can look like a feature, but I think it is a fix.
   9f1825e74d enriches Git source downloads, but it checks only
   fd.type == "git". gitsm is the Git fetcher with submodule support,
   and it has the same revision. So a recipe that changes from git://
   to gitsm:// loses the version and the purl of its main repository,
   with no warning. The fix is one line.

4. oeqa/selftest: Add tests for source download enrichment
   (3ca309cbd3)

   Two selftests for patches 2 and 3, which fail without them. On
   wrynose, test_git_purl_mappings_rerun_create_spdx also fails
   without patch 1. That is how I found that wrynose does not have it.
   If you take only fixes, you can drop this patch. Patchwork can show
   it as accepted already, because a March commit (9a622a2062) has the
   same subject.

I tested the series with oe-selftest -r spdx.SPDX30Check on wrynose
(bitbake 2.18). All 14 tests pass.

KAZUYOSHI AKIYAMA (秋山 和慶) (1):
  spdx30_tasks: Fix duplicated revision in Git PURLs

Stefano Tondo (3):
  spdx30: Make source download enrichment part of the task signature
  spdx30: Enrich gitsm source downloads like git ones
  oeqa/selftest: Add tests for source download enrichment

 meta/lib/oe/spdx30_tasks.py          | 17 +++++-----
 meta/lib/oeqa/selftest/cases/spdx.py | 47 ++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 7 deletions(-)