new file mode 100755
@@ -0,0 +1,193 @@
+#! /usr/bin/env python3
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Author: Daniel Turull <daniel.turull@ericsson.com>
+#
+# Reports, per recipe, whether a valid releaseTime was recorded in SPDX
+# 3.0.1 output.
+#
+# AI-Generated: Uses Kiro (Claude)
+
+import argparse
+import csv
+import glob
+import json
+import logging
+import os
+import re
+import sys
+
+
+def load_jsonld_graph(path):
+ """Return the @graph list of a SPDX 3.0.1 JSON-LD document, or [] on error."""
+ try:
+ with open(path, "r", encoding="utf-8") as f:
+ data = json.load(f)
+ except (OSError, json.JSONDecodeError) as e:
+ logging.warning("Skipping %s: %s", path, e)
+ return []
+ return data.get("@graph", [])
+
+
+def collect_release_dates(deploy_dir):
+ """
+ Map recipe name -> releaseTime (or None) from all static/static-*.spdx.json
+ files found under deploy_dir.
+ """
+ release_dates = {}
+ pattern = os.path.join(deploy_dir, "**", "static", "static-*.spdx.json")
+ for path in sorted(glob.glob(pattern, recursive=True)):
+ for element in load_jsonld_graph(path):
+ if element.get("type") != "software_Package":
+ continue
+ name = element.get("name")
+ if not name:
+ continue
+ # First occurrence wins; the same recipe can appear for multiple
+ # arches (e.g. allarch vs machine-specific) with identical data.
+ release_dates.setdefault(name, element.get("releaseTime"))
+ return release_dates
+
+
+def _to_row(name, release_date):
+ return {
+ "recipe": name,
+ "release_date": release_date or "",
+ "valid_date": bool(release_date),
+ }
+
+
+def build_report(deploy_dir):
+ """
+ Build the report: [{"recipe": ..., "release_date": ..., "valid_date": bool}]
+ """
+ release_dates = collect_release_dates(deploy_dir)
+ return [_to_row(name, release_dates[name]) for name in sorted(release_dates)]
+
+
+# Per-recipe document namespace shared by all elements of that recipe in a
+# merged SBOM, e.g. http://spdx.org/spdxdocs/acl-<uuid>/<hash>/recipe/acl
+DOC_NAMESPACE_RE = re.compile(
+ r"^(https?://spdx\.org/spdxdocs/[^/]+-"
+ r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/"
+)
+
+
+def doc_namespace(spdx_id):
+ """Extract the per-recipe document namespace from a SPDX ID, or None."""
+ match = DOC_NAMESPACE_RE.match(spdx_id or "")
+ return match.group(1) if match else None
+
+
+def build_report_from_file(spdx_file):
+ """
+ Build the same report as build_report(), but from a single merged SBOM
+ document (e.g. an image's *.rootfs.spdx.json) instead of a DEPLOY_DIR_SPDX
+ tree. Recipes are identified by their document namespace.
+ """
+ graph = load_jsonld_graph(spdx_file)
+
+ recipes = {} # namespace -> {"name": ..., "release_date": ...}
+ for element in graph:
+ if element.get("type") != "software_Package":
+ continue
+
+ namespace = doc_namespace(element.get("spdxId"))
+ if namespace is None:
+ continue
+
+ if element.get("software_primaryPurpose") == "specification" and element.get("name"):
+ # The recipe itself, as opposed to its runtime package(s).
+ recipes[namespace] = {
+ "name": element["name"],
+ "release_date": element.get("releaseTime"),
+ }
+
+ report = [_to_row(info["name"], info["release_date"]) for info in recipes.values()]
+ report.sort(key=lambda r: r["recipe"])
+ return report
+
+
+def filter_rows(report, missing_only, sort_by_date=False):
+ rows = [r for r in report if not missing_only or not r["valid_date"]]
+ if sort_by_date:
+ rows.sort(key=lambda r: (not r["valid_date"], r["release_date"], r["recipe"]))
+ return rows
+
+
+def print_table(rows):
+ if not rows:
+ print("No matching recipes found.")
+ return
+
+ name_width = max(len("recipe"), *(len(r["recipe"]) for r in rows))
+ print(f"{'recipe':<{name_width}} {'release_date':<21} valid")
+ for r in rows:
+ print(f"{r['recipe']:<{name_width}} {r['release_date']:<21} {r['valid_date']}")
+
+
+def write_csv(rows, path):
+ with open(path, "w", newline="", encoding="utf-8") as f:
+ writer = csv.writer(f)
+ writer.writerow(["recipe", "release_date", "valid_date"])
+ for r in rows:
+ writer.writerow([r["recipe"], r["release_date"], r["valid_date"]])
+
+
+def main():
+ parser = argparse.ArgumentParser(
+ description="Report recipe release dates from SPDX 3.0.1 output"
+ )
+ parser.add_argument(
+ "--deploy-dir",
+ required=True,
+ help="Path to DEPLOY_DIR_SPDX (e.g. tmp/deploy/spdx/3.0.1) or to a "
+ "single merged image SBOM file (e.g. "
+ "tmp/deploy/images/<machine>/<image>.rootfs.spdx.json)",
+ )
+ parser.add_argument(
+ "--missing-only",
+ action="store_true",
+ help="Only report recipes without a valid release date",
+ )
+ parser.add_argument(
+ "--csv",
+ help="Write the report to a CSV file instead of only printing a table",
+ )
+ parser.add_argument(
+ "--sort-by-date",
+ action="store_true",
+ help="Sort output by release date instead of recipe name (missing dates last)",
+ )
+ args = parser.parse_args()
+
+ logging.basicConfig(format="[%(filename)s:%(lineno)d] %(message)s", level=logging.INFO)
+
+ if os.path.isdir(args.deploy_dir):
+ report = build_report(args.deploy_dir)
+ elif os.path.isfile(args.deploy_dir):
+ report = build_report_from_file(args.deploy_dir)
+ else:
+ parser.error(f"--deploy-dir {args.deploy_dir} does not exist")
+
+ total = len(report)
+ valid = sum(1 for r in report if r["valid_date"])
+ logging.info("Recipes with SPDX static data: %d", total)
+ logging.info("Recipes with a valid release date: %d", valid)
+ logging.info("Recipes missing a release date: %d", total - valid)
+
+ rows = filter_rows(report, args.missing_only, args.sort_by_date)
+ print_table(rows)
+
+ if args.csv:
+ write_csv(rows, args.csv)
+ logging.info("CSV report written to %s", args.csv)
+
+ return 0
+
+
+if __name__ == "__main__":
+ sys.exit(main())