@@ -192,7 +192,7 @@ python do_create_recipe_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_recipe_spdx(d)
}
-addtask do_create_recipe_spdx
+addtask do_create_recipe_spdx after do_deploy_source_date_epoch
SSTATETASKS += "do_create_recipe_spdx"
do_create_recipe_spdx[sstate-inputdirs] = "${SPDXRECIPEDEPLOY}"
@@ -9,6 +9,7 @@ import oe.cve_check
import oe.license
import oe.packagedata
import oe.patch
+import oe.reproducible
import oe.sbom30
import oe.sdk
import oe.spdx30
@@ -36,6 +37,28 @@ def set_timestamp_now(d, o, prop):
delattr(o, prop)
+def get_release_date(d):
+ """Resolve the release date to record in a recipe's releaseTime property.
+
+ Uses the SOURCE_DATE_EPOCH already determined for reproducible builds
+ (SDE_FILE), without falling back to SOURCE_DATE_EPOCH_FALLBACK, since a
+ fixed fallback timestamp is not a meaningful release date.
+
+ Returns a datetime, or None if no release date should be recorded.
+ """
+ sde_file = d.getVar("SDE_FILE")
+ if not sde_file or not os.path.isfile(sde_file):
+ return None
+
+ source_date_epoch = oe.reproducible.epochfile_read(sde_file, d)
+ if source_date_epoch == d.getVar("SOURCE_DATE_EPOCH_FALLBACK"):
+ # SDE_FILE exists but its value is only the fallback (e.g. no git
+ # checkout and no fetched source to derive a date from).
+ return None
+
+ return datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+
def add_license_expression(
d, objset, license_expression, license_data, search_objsets=[]
):
@@ -633,6 +656,10 @@ def create_recipe_spdx(d):
if val := d.getVar("DESCRIPTION"):
recipe.description = val
+ release_date = get_release_date(d)
+ if release_date is not None:
+ recipe.releaseTime = release_date
+
for cpe_id in oe.cve_check.get_cpe_ids(
d.getVar("CVE_PRODUCT"), d.getVar("CVE_VERSION")
):
@@ -6,6 +6,7 @@
import textwrap
import hashlib
+from datetime import datetime, timezone
from oeqa.selftest.case import OESelftestTestCase
from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars
import oe.spdx30
@@ -443,3 +444,54 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
r'\d',
f"Version '{version}' for package '{name}' should contain digits"
)
+
+ def test_release_date_source_date_epoch(self):
+ """releaseTime should be derived from the recipe's SDE_FILE."""
+ objset = self.check_recipe_spdx(
+ "base-files",
+ "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json",
+ task="create_recipe_spdx",
+ )
+
+ sde_file = get_bb_var("SDE_FILE", "base-files")
+ self.assertExists(sde_file)
+ with open(sde_file) as f:
+ source_date_epoch = int(f.read())
+
+ expected = datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+ recipe = None
+ for pkg in objset.foreach_type(oe.spdx30.software_Package):
+ if pkg.name == "base-files":
+ recipe = pkg
+ break
+
+ self.assertIsNotNone(recipe, "Unable to find base-files software_Package")
+ self.assertEqual(recipe.releaseTime, expected)
+
+ def test_release_date_omitted_for_fallback_value(self):
+ """releaseTime must be omitted when SDE_FILE only has the fallback."""
+ objset = self.check_recipe_spdx(
+ "packagegroup-base",
+ "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-packagegroup-base.spdx.json",
+ task="create_recipe_spdx",
+ )
+
+ sde_file = get_bb_var("SDE_FILE", "packagegroup-base")
+ fallback = get_bb_var("SOURCE_DATE_EPOCH_FALLBACK", "packagegroup-base")
+ self.assertExists(sde_file)
+ with open(sde_file) as f:
+ self.assertEqual(
+ f.read().strip(), fallback,
+ "packagegroup-base has no SRC_URI; SDE_FILE is expected to "
+ "only contain SOURCE_DATE_EPOCH_FALLBACK",
+ )
+
+ recipe = None
+ for pkg in objset.foreach_type(oe.spdx30.software_Package):
+ if pkg.name == "packagegroup-base":
+ recipe = pkg
+ break
+
+ self.assertIsNotNone(recipe, "Unable to find packagegroup-base software_Package")
+ self.assertIsNone(recipe.releaseTime)