@@ -14,9 +14,20 @@ python do_sbom_cve_check() {
"""
Task: Run sbom-cve-check analysis on SBOM.
"""
- sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
+ import os
+
image_name = d.getVar("IMAGE_NAME")
link_name = d.getVar("IMAGE_LINK_NAME")
+ deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
+
+ # IMAGE_NAME carries DATETIME, which changes on every invocation while being
+ # excluded from task hashes, so this path is only valid when
+ # do_create_image_sbom_spdx ran in the same invocation. Fall back to the
+ # symlink it maintains, which is stable across builds.
+ sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % image_name)
+ if not os.path.exists(sbom_path) and link_name:
+ sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % link_name)
+
run_sbom_cve_check(d, sbom_path, image_name, link_name)
}
do_sbom_cve_check builds its input path from ${IMAGE_NAME}, which carries ${IMAGE_VERSION_SUFFIX} and so ${DATETIME}. That value is excluded from task hashes but changes on every bitbake invocation, so the path is only correct when do_create_image_sbom_spdx ran in the same invocation. It does not when the class is newly enabled on an existing build tree: the image SBOM is already deployed and stamped from an earlier build, do_sbom_cve_check has never run, so bitbake executes only the latter and it looks for a file whose timestamp belongs to the current invocation. The same happens on any forced re-run of just this task: $ bitbake -f -c sbom_cve_check core-image-minimal ERROR: core-image-minimal-1.0-r0 do_sbom_cve_check: sbom-cve-check failed: [...] sbom-cve-check: error: [Errno 2] No such file or directory: '.../core-image-minimal-qemux86-64.rootfs-20260804101106.spdx.json' $ ls tmp/deploy/images/qemux86-64/*.spdx.json core-image-minimal-qemux86-64.rootfs-20260804095834.spdx.json core-image-minimal-qemux86-64.rootfs.spdx.json -> ...-20260804095834.spdx.json The file is there under ${IMAGE_LINK_NAME}, the symlink do_create_image_sbom_spdx maintains. Keep preferring the timestamped name, so behaviour is unchanged whenever it exists, and fall back to the symlink rather than failing. Guarded on link_name being set, since IMAGE_LINK_NAME can be empty. Signed-off-by: Thomas Roos <roosesweb@gmail.com> --- meta/classes-recipe/sbom-cve-check.bbclass | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)