@@ -354,15 +354,6 @@ def add_download_packages(d, doc, recipe):
if f.type == "file":
continue
- uri = f.type
- proto = getattr(f, "proto", None)
- if proto is not None:
- uri = uri + "+" + proto
- uri = uri + "://" + f.host + f.path
-
- if f.method.supports_srcrev():
- uri = uri + "@" + f.revisions[name]
-
if f.method.supports_checksum(f):
for checksum_id in CHECKSUM_LIST:
if checksum_id.upper() not in oe.spdx.SPDXPackage.ALLOWED_CHECKSUMS:
@@ -377,7 +368,7 @@ def add_download_packages(d, doc, recipe):
c.checksumValue = expected_checksum
package.checksums.append(c)
- package.downloadLocation = uri
+ package.downloadLocation = oe.spdx_common.fetch_data_to_uri(f, name)
doc.packages.append(package)
doc.add_relationship(doc, "DESCRIBES", package)
# In the future, we might be able to do more fancy dependencies,
@@ -379,22 +379,15 @@ def add_download_files(d, objset):
inputs.add(file)
else:
- uri = fd.type
- proto = getattr(fd, "proto", None)
- if proto is not None:
- uri = uri + "+" + proto
- uri = uri + "://" + fd.host + fd.path
-
- if fd.method.supports_srcrev():
- uri = uri + "@" + fd.revisions[name]
-
dl = objset.add(
oe.spdx30.software_Package(
_id=objset.new_spdxid("source", str(download_idx + 1)),
creationInfo=objset.doc.creationInfo,
name=file_name,
software_primaryPurpose=primary_purpose,
- software_downloadLocation=uri,
+ software_downloadLocation=oe.spdx_common.fetch_data_to_uri(
+ fd, name
+ ),
)
)
@@ -42,7 +42,6 @@ def is_work_shared_spdx(d):
def load_spdx_license_data(d):
-
with open(d.getVar("SPDX_LICENSES"), "r") as f:
data = json.load(f)
# Transform the license array to a dictionary
@@ -225,3 +224,22 @@ def get_patched_src(d):
bb.utils.mkdirhier(spdx_workdir)
finally:
d.setVar("WORKDIR", workdir)
+
+
+def fetch_data_to_uri(fd, name):
+ """
+ Translates a bitbake FetchData to a string URI
+ """
+ uri = fd.type
+ # Map gitsm to git, since gitsm:// is not a valid URI protocol
+ if uri == "gitsm":
+ uri = "git"
+ proto = getattr(fd, "proto", None)
+ if proto is not None:
+ uri = uri + "+" + proto
+ uri = uri + "://" + fd.host + fd.path
+
+ if fd.method.supports_srcrev():
+ uri = uri + "@" + fd.revisions[name]
+
+ return uri
"gitsm" is not a recognized URI protocol (outside of bitbake), so map it to "git" when writing. This should be OK since we report all of the submodule source code (if enabled), and it's still possible for 3rd party analyzers to determine that submodules are in use by looking at .gitmodules. The code to do the mapping is moved to a common location so it covers SPDX 2.2 also [YOCTO #15582] Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> --- meta/classes/create-spdx-2.2.bbclass | 11 +---------- meta/lib/oe/spdx30_tasks.py | 13 +++---------- meta/lib/oe/spdx_common.py | 20 +++++++++++++++++++- 3 files changed, 23 insertions(+), 21 deletions(-)