@@ -397,7 +397,11 @@ class ObjectSet(oe.spdx30.SHACLObjectSet):
self.doc.import_.append(m)
return spdxid
- def new_agent(self, varname, *, creation_info=None, add=True):
+ def new_agent(self, varname, *, creation_info=None, add=True, expand=False):
+ if expand:
+ varname = self.d.getVar(f"{varname}")
+ if not varname:
+ return None
ref_varname = self.d.getVar(f"{varname}_ref")
if ref_varname:
if ref_varname == varname:
@@ -905,7 +905,7 @@ def create_spdx(d):
force_purposes=["install"],
)
- supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER")
+ supplier = build_objset.new_agent("SPDX_PACKAGE_SUPPLIER", expand=True)
if supplier is not None:
spdx_package.suppliedBy = (
supplier if isinstance(supplier, str) else supplier._id
@@ -1213,8 +1213,8 @@ def write_bitbake_spdx(d):
objset = oe.sbom30.ObjectSet.new_objset(d, "bitbake", False)
host_import_key = d.getVar("SPDX_BUILD_HOST")
- invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False)
- on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False)
+ invoked_by = objset.new_agent("SPDX_INVOKED_BY", add=False, expand=True)
+ on_behalf_of = objset.new_agent("SPDX_ON_BEHALF_OF", add=False, expand=True)
if d.getVar("SPDX_INCLUDE_BITBAKE_PARENT_BUILD") == "1":
# Since the Build objects are unique, we may as well set the creation
@@ -1536,7 +1536,7 @@ def create_image_sbom_spdx(d):
objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements)
# Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined
- supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False)
+ supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False, expand=True)
if supplier is not None:
supplier_id = supplier if isinstance(supplier, str) else supplier._id
if not isinstance(supplier, str):
@@ -1657,7 +1657,7 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, toolchain_outputname):
)
# Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
- supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False)
+ supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False, expand=True)
if supplier is not None:
supplier_id = supplier if isinstance(supplier, str) else supplier._id
if not isinstance(supplier, str):
Sub-variables (_name, _type, _comment, _id_email) were being looked up using the literal string "SPDX_IMAGE_SUPPLIER", "SPDX_SDK_SUPPLIER" "SPDX_PACKAGE_SUPPLIER", "SPDX_INVOKED_BY", "SPDX_ON_BEHALF_OF", instead of the value of those variables, breaking the documented ability to use a custom prefix (e.g. MY_COMPANY). Tested by setting in local.conf: ``` MY_COMPANY_name = "CCCC" MY_COMPANY_type = "organization" SPDX_IMAGE_SUPPLIER = "MY_COMPANY" SPDX_IMAGE_SUPPLIER_name = "AAAA" SPDX_IMAGE_SUPPLIER_type = "organization" SPDX_PACKAGE_SUPPLIER = "MY_COMPANY" SPDX_PACKAGE_SUPPLIER_name = "BBBB" SPDX_PACKAGE_SUPPLIER_type = "organization" ``` And then comparing `core-image-minimal-qemux86-64.rootfs.spdx.json` SBOMs. Before this change SBOM contained only AAAA and BBBB but no CCCC, after there was only CCCC. Signed-off-by: iwanicki92 <iwanicki92@gmail.com> --- meta/lib/oe/sbom30.py | 6 +++++- meta/lib/oe/spdx30_tasks.py | 10 +++++----- 2 files changed, 10 insertions(+), 6 deletions(-)