diff mbox series

[10/14] spdx30_tasks: Fix non-deterministic BUILDNAME in image package version

Message ID 20260221042418.317535-11-stondo@gmail.com
State New
Headers show
Series spdx30: SBOM enrichment for PURL, metadata, and compliance | expand

Commit Message

Stefano Tondo Feb. 21, 2026, 4:24 a.m. UTC 
From: Stefano Tondo <stefano.tondo.ext@siemens.com>

BUILDNAME is a timestamp set by buildstats.bbclass that changes
between builds, causing non-deterministic BitBake task hashes.

This was causing basehash mismatch errors:
  ERROR: When reparsing ...do_create_image_spdx, the basehash value
  changed from X to Y. The metadata is not deterministic.

Root Cause:
  The image_package metadata uses BUILDNAME as packageVersion.
  BUILDNAME varies between builds (e.g., "20260120151200" vs "")
  making it unsuitable for deterministic builds.

Fix:
  Replace BUILDNAME with DISTRO_VERSION which is:
  - Deterministic across builds
  - Semantically appropriate for image versioning
  - Falls back to "1.0" for nodistro builds

This ensures clean builds without basehash errors while maintaining
meaningful version information in the SBOM.

Signed-off-by: Stefano Tondo <stefano.tondo.ext@siemens.com>
---
 meta/lib/oe/spdx30_tasks.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 0d62de61a3..12b8e68fbe 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -1505,7 +1505,7 @@  def create_image_spdx(d):
             _id=objset.new_spdxid("image", "root"),
             creationInfo=objset.doc.creationInfo,
             name=f"{image_basename}-{machine}",
-            software_packageVersion=d.getVar("BUILDNAME") or "1.0",
+            software_packageVersion=d.getVar("DISTRO_VERSION") or "1.0",
             software_primaryPurpose=oe.spdx30.software_SoftwarePurpose.container,
             description=d.getVar("IMAGE_DESCRIPTION") or f"{image_basename} image for {machine}",
         )