diff mbox series

spdx30_tasks: fix missing SPDX runtime dependencies

Message ID 20260718-fix_spdx_packages_dependson-v1-1-f950be4cd006@se.com
State New
Headers show
Series spdx30_tasks: fix missing SPDX runtime dependencies | expand

Commit Message

Pascal Eberhard via B4 Relay July 18, 2026, 7:15 a.m. UTC 
From: Pascal Eberhard <pascal.eberhard@se.com>

The runtime dependsOn relationship entries between software_Package
is missing from the generated SPDX files.

Remove the subpkgdata lookup as the final pkg_name is already resolved
by collect_package_providers().

Rename variables to avoid shadowing the 'dep' variable and to make it
explicit which package/pkg name is being used.

Signed-off-by: Pascal Eberhard <pascal.eberhard@se.com>
---
 meta/lib/oe/spdx30_tasks.py | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)


---
base-commit: 171af3b2915dd076c8d1b205ff75eac1ebd5a586
change-id: 20260718-fix_spdx_packages_dependson-28d9bb78a55c

Best regards,
diff mbox series

Patch

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 79e18db11d..652fe269e2 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -1141,9 +1141,13 @@  def create_spdx(d):
 
 def create_package_spdx(d):
     deploydir = Path(d.getVar("SPDXRUNTIMEDEPLOY"))
+    pkgdatadir = Path(d.getVar('PKGDATA_DIR'))
 
     direct_deps = oe.spdx_common.collect_direct_deps(d, "do_create_spdx")
 
+    # providers[package_name] = pkg_name, where:
+    # - package_name is the name in the recipe in PACKAGES/RDEPENDS, and
+    # - pkg_name is the final name given by the package manager.
     providers = oe.spdx_common.collect_package_providers(d, direct_deps)
     pkg_arch = d.getVar("SSTATE_PKGARCH")
 
@@ -1197,26 +1201,24 @@  def create_package_spdx(d):
             if dep not in providers:
                 continue
 
-            dep, _ = providers[dep]
+            dep_pkg_name, _ = providers[dep]
 
-            if not oe.packagedata.packaged(dep, localdata):
+            if not os.path.exists(pkgdatadir / "runtime-reverse" / dep_pkg_name):
+                bb.debug(1, f"pkg_name {dep_pkg_name}, package {dep} missing for {package}")
                 continue
 
-            dep_pkg_data = oe.packagedata.read_subpkgdata_dict(dep, d)
-            dep_pkg = dep_pkg_data["PKG"]
-
-            if dep in dep_package_cache:
-                dep_spdx_package = dep_package_cache[dep]
+            if dep_pkg_name in dep_package_cache:
+                dep_spdx_package = dep_package_cache[dep_pkg_name]
             else:
-                bb.debug(1, "Searching for %s" % dep_pkg)
+                bb.debug(1, "Searching for %s" % dep_pkg_name)
                 dep_spdx_package, _ = oe.sbom30.find_root_obj_in_jsonld(
                     d,
                     "packages-staging",
-                    "package-" + dep_pkg,
+                    "package-" + dep_pkg_name,
                     oe.spdx30.software_Package,
                     software_primaryPurpose=oe.spdx30.software_SoftwarePurpose.install,
                 )
-                dep_package_cache[dep] = dep_spdx_package
+                dep_package_cache[dep_pkg_name] = dep_spdx_package
 
             runtime_spdx_deps.add(dep_spdx_package)
             seen_deps.add(dep)