new file mode 100644
@@ -0,0 +1,58 @@
+From 9fb565a0a70c6985fa1efde13cfe7fb4851588ce Mon Sep 17 00:00:00 2001
+From: Benjamin Robin <benjamin.robin@bootlin.com>
+Date: Tue, 24 Feb 2026 10:59:25 +0100
+Subject: [PATCH] generate-bindings: allow to use local files
+
+shacl2code needs to download the following URLs during build time:
+ - https://spdx.org/rdf/3.0.1/spdx-model.ttl
+ - https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl
+ - https://spdx.org/rdf/3.0.1/spdx-context.jsonld
+
+There are a lot of package build tools that do not allow to download
+a file during the build. So provide a way to use local file:
+If the environment variable SHACL2CODE_SPDX_DIR is defined, load
+the SPDX model and SPDX context from the directory specified by this
+environment variable.
+
+Upstream-Status: Submitted [https://github.com/spdx/spdx-python-model/pull/19]
+
+Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
+---
+ gen/generate-bindings | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/gen/generate-bindings b/gen/generate-bindings
+index b963c55a3bc9..bc7041ee3bb9 100755
+--- a/gen/generate-bindings
++++ b/gen/generate-bindings
+@@ -14,12 +14,22 @@ echo "# Import all versions" > __init__.py
+ for v in $SPDX_VERSIONS; do
+ MODNAME="v$(echo "$v" | sed 's/[^a-zA-Z0-9_]/_/g')"
+
+- shacl2code generate --input https://spdx.org/rdf/$v/spdx-model.ttl \
+- --input https://spdx.org/rdf/$v/spdx-json-serialize-annotations.ttl \
+- --context https://spdx.org/rdf/$v/spdx-context.jsonld \
+- --license Apache-2.0 \
+- python \
+- -o "$MODNAME.py"
++ if [ -n "${SHACL2CODE_SPDX_DIR}" ] && [ -d "${SHACL2CODE_SPDX_DIR}/$v" ]
++ then
++ shacl2code generate --input "file://${SHACL2CODE_SPDX_DIR}/$v/spdx-model.ttl" \
++ --input "file://${SHACL2CODE_SPDX_DIR}/$v/spdx-json-serialize-annotations.ttl" \
++ --context-url "file://${SHACL2CODE_SPDX_DIR}/$v/spdx-context.jsonld" https://spdx.org/rdf/$v/spdx-context.jsonld \
++ --license Apache-2.0 \
++ python \
++ -o "$MODNAME.py"
++ else
++ shacl2code generate --input https://spdx.org/rdf/$v/spdx-model.ttl \
++ --input https://spdx.org/rdf/$v/spdx-json-serialize-annotations.ttl \
++ --context https://spdx.org/rdf/$v/spdx-context.jsonld \
++ --license Apache-2.0 \
++ python \
++ -o "$MODNAME.py"
++ fi
+
+ echo "from . import $MODNAME" >> __init__.py
+ done
+--
+2.53.0
new file mode 100644
@@ -0,0 +1,37 @@
+SUMMARY = "Generated Python code for SPDX Spec version 3"
+HOMEPAGE = "https://pypi.org/project/spdx-python-model/"
+SECTION = "devel/python"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
+
+PYPI_PACKAGE = "spdx_python_model"
+SRC_URI[sha256sum] = "bdec725398babcbdd4bcb7c16cf23497d06a48d0ef3ea1edb19a3b0d431ab8c1"
+
+SRC_URI += " \
+ https://spdx.org/rdf/3.0.1/spdx-context.jsonld;name=spdx1 \
+ https://spdx.org/rdf/3.0.1/spdx-json-serialize-annotations.ttl;name=spdx2 \
+ https://spdx.org/rdf/3.0.1/spdx-model.ttl;name=spdx3 \
+ file://0001-generate-bindings-allow-to-use-local-files.patch \
+"
+
+SRC_URI[spdx1.sha256sum] = "c72b0928f094c83e5c127784edb1ebca2af74a104fcacc007c332b23cbc788bd"
+SRC_URI[spdx2.sha256sum] = "c6a54b51230eb2bf3b31302546af201f303e0b7931c1db404d7f5b72b6f863e6"
+SRC_URI[spdx3.sha256sum] = "30ebb4af2d70a9809044ef46f44cc3dc5125226d70f818a50ed2e1d5f404c593"
+
+inherit pypi python_hatchling
+
+export SHACL2CODE_SPDX_DIR = "${S}/spdx"
+
+do_configure:append() {
+ mkdir -p "${SHACL2CODE_SPDX_DIR}/3.0.1/"
+ cp ${UNPACKDIR}/spdx-context.jsonld "${SHACL2CODE_SPDX_DIR}/3.0.1/"
+ cp ${UNPACKDIR}/spdx-json-serialize-annotations.ttl "${SHACL2CODE_SPDX_DIR}/3.0.1/"
+ cp ${UNPACKDIR}/spdx-model.ttl "${SHACL2CODE_SPDX_DIR}/3.0.1/"
+}
+
+DEPENDS += " \
+ python3-shacl2code \
+ python3-hatch-build-scripts \
+"
+
+BBCLASSEXTEND = "native nativesdk"
- Part of the dependency chain for sbom-cve-check Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com> --- ...enerate-bindings-allow-to-use-local-files.patch | 58 ++++++++++++++++++++++ .../python/python3-spdx-python-model_0.0.4.bb | 37 ++++++++++++++ 2 files changed, 95 insertions(+)