[scarthgap,05/30] meta: fix generation of kernel CONFIG_ in SPDX3

From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

With the current solution, using a separate task
(do_create_kernel_config_spdx) there is a dependency issue. Sometimes
the final rootfs SBOM does not contain the CONFIG_ values.

do_create_kernel_config_spdx is executed after do_create_spdx which
deploys the SPDX file. do_create_kernel_config_spdx calls
oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
which is OK, but the do_create_kernel_config_spdx ends up writing to
this deployed file (updating it).

do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
tasks, but there is nothing that prevents executing
do_create_kernel_config_spdx after do_create_rootfs_spdx.

To fix it, instead, now read from the workdir, and write to the
workdir, and do the processing from the do_create_spdx task:
we append to the do_create_spdx task.
Furthermore, update oeqa selftest to execute do_create_spdx instead
of removed function.

Also only execute this task if create-spdx-3.0 was inherited,
previously this code could be executed if create-spdx-2.2 is
inherited.

(cherry picked from commit 8417f4a186e78a9d309541f5d0e711178bb80488)

Fixes: 1fff29a04287 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/classes-recipe/kernel.bbclass   | 27 +++++++++++++++------------
 meta/lib/oeqa/selftest/cases/spdx.py |  2 +-
 2 files changed, 16 insertions(+), 13 deletions(-)

On Wed, 2026-06-17 at 09:44 +0200, Yoann Congal via
lists.openembedded.org wrote:
> From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> 
> With the current solution, using a separate task
> (do_create_kernel_config_spdx) there is a dependency issue. Sometimes
> the final rootfs SBOM does not contain the CONFIG_ values.
> 
> do_create_kernel_config_spdx is executed after do_create_spdx which
> deploys the SPDX file. do_create_kernel_config_spdx calls
> oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory,
> which is OK, but the do_create_kernel_config_spdx ends up writing to
> this deployed file (updating it).
> 
> do_create_rootfs_spdx has an explicit dependency to all do_create_spdx
> tasks, but there is nothing that prevents executing
> do_create_kernel_config_spdx after do_create_rootfs_spdx.
> 
> To fix it, instead, now read from the workdir, and write to the
> workdir, and do the processing from the do_create_spdx task:
> we append to the do_create_spdx task.
> Furthermore, update oeqa selftest to execute do_create_spdx instead
> of removed function.
> 
> Also only execute this task if create-spdx-3.0 was inherited,
> previously this code could be executed if create-spdx-2.2 is
> inherited.
> 
> (cherry picked from commit 8417f4a186e78a9d309541f5d0e711178bb80488)
> 
> Fixes: 1fff29a04287 ("kernel.bbclass: Add task to export kernel configuration to SPDX")
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> ---
>  meta/classes-recipe/kernel.bbclass   | 27 +++++++++++++++------------
>  meta/lib/oeqa/selftest/cases/spdx.py |  2 +-
>  2 files changed, 16 insertions(+), 13 deletions(-)
> 
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index 39e198864e4..618324f75ff 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -870,14 +870,13 @@ addtask deploy after do_populate_sysroot do_packagedata
>  
>  EXPORT_FUNCTIONS do_deploy
>  
> -python __anonymous() {
> -    inherits = (d.getVar("INHERIT") or "")
> -    if "create-spdx" in inherits:
> -        bb.build.addtask('do_create_kernel_config_spdx', 'do_populate_lic do_deploy', 'do_create_spdx', d)
> -}
> +do_create_spdx:append() {
> +    def create_kernel_config_spdx(d):
> +        if not bb.data.inherits_class("create-spdx-3.0", d):
> +            return
> +        if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) != "1":
> +            return
>  
> -python do_create_kernel_config_spdx() {
> -    if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) == "1":
>          import oe.spdx30
>          import oe.spdx30_tasks
>          from pathlib import Path
> @@ -909,9 +908,11 @@ python do_create_kernel_config_spdx() {
>          except Exception as e:
>              bb.error(f"Failed to parse kernel config file: {e}")
>  
> -        build, build_objset = oe.sbom30.find_root_obj_in_jsonld(
> -            d, "recipes", f"recipe-{pn}", oe.spdx30.build_Build
> -        )
> +        path = oe.sbom30.jsonld_arch_path(d, pkg_arch, "recipes", f"recipe-{pn}", deploydir=deploydir)
> +        build_objset = oe.sbom30.load_jsonld(d, path, required=True)
> +        build = build_objset.find_root(oe.spdx30.build_Build)
> +        if not build:
> +            bb.fatal("No root %s found in %s" % (oe.spdx30.build_Build.__name__, path))
>  
>          kernel_build = build_objset.add_root(
>              oe.spdx30.build_Build(
> @@ -930,9 +931,11 @@ python do_create_kernel_config_spdx() {
>              [kernel_build]
>          )
>  
> -        oe.sbom30.write_jsonld_doc(d, build_objset, deploydir / pkg_arch / "recipes" / f"recipe-{pn}.spdx.json")
> +        oe.sbom30.write_jsonld_doc(d, build_objset, path)
> +
> +    create_kernel_config_spdx(d)
>  }
> -do_create_kernel_config_spdx[depends] = "virtual/kernel:do_configure"
> +do_create_spdx[depends] += "virtual/kernel:do_configure"
>  
>  # Add using Device Tree support
>  inherit kernel-devicetree
> diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py
> index 035f3fe3363..3373988ca40 100644
> --- a/meta/lib/oeqa/selftest/cases/spdx.py
> +++ b/meta/lib/oeqa/selftest/cases/spdx.py
> @@ -298,7 +298,7 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
>          objset = self.check_recipe_spdx(
>              kernel_recipe,
>              spdx_path,
> -            task="do_create_kernel_config_spdx",
> +            task="do_create_spdx",
>              extraconf="""\
>                  INHERIT += "create-spdx"
>                  SPDX_INCLUDE_KERNEL_CONFIG = "1"

I agree this is worth backporting as it fixes omissions in generated
SPDX data. But it removes a task (do_create_kernel_config_spdx) so we
need to be careful.

In this case I doubt anyone is calling do_create_kernel_config_spdx
directly, so we should be able to handle this by highlighting the
removal in the release notes for the next scarthgap release.

Best regards,