@@ -9,6 +9,7 @@ import oe.cve_check
import oe.license
import oe.packagedata
import oe.patch
+import oe.reproducible
import oe.sbom30
import oe.sdk
import oe.spdx30
@@ -36,6 +37,26 @@ def set_timestamp_now(d, o, prop):
delattr(o, prop)
+def get_release_date(d):
+ """Resolve the release date to record in a package's releaseTime property.
+
+ Reads SDE_FILE via oe.reproducible.epochfile_read() directly, rather than
+ SOURCE_DATE_EPOCH, since a recipe may set SOURCE_DATE_EPOCH itself to
+ override the computed value, and that override is not a release date.
+
+ Omits the fallback value since it is not a meaningful release date.
+
+ Returns a datetime, or None if no release date should be recorded.
+ """
+ source_date_epoch = oe.reproducible.epochfile_read(d.getVar("SDE_FILE"), d)
+ if not source_date_epoch or source_date_epoch == d.getVar(
+ "SOURCE_DATE_EPOCH_FALLBACK"
+ ):
+ return None
+
+ return datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+
def add_license_expression(
d, objset, license_expression, license_data, search_objsets=[]
):
@@ -441,6 +462,7 @@ def _enrich_source_package(d, dl, fd, file_name, primary_purpose):
def add_download_files(d, objset):
inputs = set()
+ release_date = get_release_date(d)
urls = d.getVar("SRC_URI").split()
fetch = bb.fetch.Fetch(urls, d)
@@ -504,6 +526,9 @@ def add_download_files(d, objset):
_enrich_source_package(d, dl, fd, file_name, primary_purpose)
+ if release_date is not None:
+ dl.releaseTime = release_date
+
if fd.method.supports_checksum(fd):
for checksum_id in bb.fetch.CHECKSUM_LIST:
if checksum_id not in oe.spdx30.HashAlgorithm.NAMED_INDIVIDUALS:
@@ -6,6 +6,7 @@
import textwrap
import hashlib
+from datetime import datetime, timezone
from oeqa.selftest.case import OESelftestTestCase
from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars
import oe.spdx30
@@ -443,3 +444,44 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
r'\d',
f"Version '{version}' for package '{name}' should contain digits"
)
+
+ def test_release_date_source_date_epoch(self):
+ """releaseTime should be derived from SDE_FILE via epochfile_read().
+
+ This is recorded on the downloaded source software_Package objects
+ produced by do_create_spdx (not the recipe-only do_create_recipe_spdx
+ task), since the release date can only be known once sources are
+ available and SOURCE_DATE_EPOCH has been computed.
+ """
+ objset = self.check_recipe_spdx(
+ "tar",
+ "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/builds/build-tar.spdx.json",
+ )
+
+ bitbake("tar -c unpack -f")
+ sde_file = get_bb_var("SDE_FILE", "tar")
+ with open(sde_file) as f:
+ source_date_epoch = f.read()
+ expected = datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc)
+
+ pkg = None
+ for candidate in objset.foreach_type(oe.spdx30.software_Package):
+ if candidate.software_downloadLocation:
+ pkg = candidate
+ break
+
+ self.assertIsNotNone(pkg, "Unable to find downloaded source software_Package")
+ self.assertEqual(pkg.releaseTime, expected)
+
+ def test_release_date_omitted_without_downloaded_source(self):
+ """releaseTime only applies to downloaded source packages; recipes
+ with only local file:// sources have none, and get no releaseTime."""
+ # base-files only has file:// sources, so it has no downloaded
+ # source software_Package and thus no releaseTime anywhere.
+ objset = self.check_recipe_spdx(
+ "base-files",
+ "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/builds/build-base-files.spdx.json",
+ )
+
+ for candidate in objset.foreach_type(oe.spdx30.software_Package):
+ self.assertIsNone(candidate.releaseTime)