diff mbox series

[whinlatter,17/18] create-spdx-image-3.0: Image SPDX/SBOM tasks are retained for eSDK installation

Message ID 3f57280caa7918f10e4e9685ad87a3128d4e9f0f.1766352840.git.steve@sakoman.com
State New
Headers show
Series [whinlatter,01/18] binutils: Fix CVE-2025-11494 | expand

Commit Message

Steve Sakoman Dec. 21, 2025, 9:37 p.m. UTC 
From: Jayasurya Maganuru <Maganuru.Jayasurya@windriver.com>

Fixes [YOCTO #15853]

Image SPDX/SBOM tasks were running after do_sdk_depends, causing their
signatures to be excluded from locked-sigs.inc. As a result, the eSDK installer
attempted to re-run these tasks, leading to unexpected task execution errors.

Run do_create_image_sbom_spdx before do_sdk_depends to ensure all image
SPDX/SBOM tasks are completed and captured in the locked signatures.

Signed-off-by: Jayasurya Maganuru <Maganuru.Jayasurya@windriver.com>
Suggested-by: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 11c5653f16d4fbb751b2a4ad4e477bbe779d6e72)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/classes-recipe/create-spdx-image-3.0.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/classes-recipe/create-spdx-image-3.0.bbclass b/meta/classes-recipe/create-spdx-image-3.0.bbclass
index 636ab14eb0..f070b7e697 100644
--- a/meta/classes-recipe/create-spdx-image-3.0.bbclass
+++ b/meta/classes-recipe/create-spdx-image-3.0.bbclass
@@ -69,7 +69,7 @@  python do_create_image_sbom_spdx() {
     import oe.spdx30_tasks
     oe.spdx30_tasks.create_image_sbom_spdx(d)
 }
-addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build
+addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build do_sdk_depends
 SSTATETASKS += "do_create_image_sbom_spdx"
 SSTATE_SKIP_CREATION:task-create-image-sbom = "1"
 do_create_image_sbom_spdx[sstate-inputdirs] = "${SPDXIMAGEDEPLOYDIR}"