diff mbox series

[1/3] fragments/yocto/sbom-cve-check: fix conflict with tag=

Message ID 20260723204833.43562-1-tim.orling@konsulko.com
State Accepted, archived
Commit ff6f41cc6e951198d928ea935f2b796cd9d2cf21
Headers show
Series [1/3] fragments/yocto/sbom-cve-check: fix conflict with tag= | expand

Commit Message

Tim Orling July 23, 2026, 8:48 p.m. UTC 
Fixes: 00864cf5bc meta: Add tag in SRC_URI to multiple recipes

When this fragment is enabled, SRCREV is set to AUTOREV, but this then
causes do_unpack to fail for both sbom-cve-check-update-cvelist-native
and sbom-cve-check-update-nvd-native, since the tag SRCREV does not
match with the 'main' HEAD AUTOREV.

Rather than allow the tag to float, for those that desire reproducible
builds with just IMAGES_CLASSES:append = " sbom-cve-check" and not
this fragment, set SRC_URI **without** the tag= in this fragment.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 meta/conf/fragments/yocto/sbom-cve-check.conf | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta/conf/fragments/yocto/sbom-cve-check.conf b/meta/conf/fragments/yocto/sbom-cve-check.conf
index 73ed35be27..46f6965a0d 100644
--- a/meta/conf/fragments/yocto/sbom-cve-check.conf
+++ b/meta/conf/fragments/yocto/sbom-cve-check.conf
@@ -13,6 +13,9 @@  IMAGE_CLASSES:append = " sbom-cve-check"
 
 SRCREV:pn-sbom-cve-check-update-nvd-native = "${AUTOREV}"
 SRCREV:pn-sbom-cve-check-update-cvelist-native = "${AUTOREV}"
+# Drop the tag= or else do_unpack fails
+SRC_URI:pn-sbom-cve-check-update-cvelist-native = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
+SRC_URI:pn-sbom-cve-check-update-nvd-native = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 
 SPDX_INCLUDE_VEX = "all"
 SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"