From patchwork Wed Nov 4 11:22:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 102896 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7055.1793791382585769156 for ; Wed, 04 Nov 2026 03:23:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=ieVEN831; spf=pass (domain: gmail.com, ip: 209.85.128.44, mailfrom: stondo@gmail.com) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4b4571ff080so6025455e9.1 for ; Wed, 04 Nov 2026 03:23:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793791381; x=1794396181; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OdtrTjwz7XgShoHrt0fj+1ta31ytmv/KAZA53UklIuE=; b=ieVEN831BbroyO/g04arX6ecoMD0BDU55wMAMhLe3TObll0bmLSD7F97ASdPgwyQp4 dCLEjS649EqQ1NBz1ti45Nsoc1PiyxbCvtoYsp6Ijfx1p4O3MhhChJrqA3Eus15cfu+Z CjMw9mYdTGWt7oq1M92F7A1bkUpEvOmuu+/zsRzDuSCJi1pXltYAC1lQIk51yGZ6zKf+ JmL5mgXHNzteTytcg2IfCMYYcWpP1CJyBAprIxeEf7LqrRb+/T/36Btb6zsGUafcdObB xNbMTd0IoD82hZnk0siAzoTkXW0OLO2T/NHT8I9fdfTO4iovgBTqpp3ZlrYRRtzO6v7+ P2Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793791381; x=1794396181; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OdtrTjwz7XgShoHrt0fj+1ta31ytmv/KAZA53UklIuE=; b=M36x37TaTOVt30Iug5Fj5gdPmylQsEMNazPKgLKI21FguI40fwQneQwdiWhhTmQ6U6 lx3noTdDKi7J92XrkZaYB5Rv1NlhDFks5I2j4K+WjGaVJvFV8WbvfifNiZU28Oqe9tig aw6IlTLCjjd4ugDpxD9xsME5Jq775DoRDZy6LyMYiN7QEXgvXYxuzAxeeuB61cINnNwF JGl6uo+Ju+EKC/20LwF465FUVW5GS+txRT87nn3voKAJYW0FYrd43cJqpcqHttDHeV31 ZhWqRq2aN+pJhMXK6VsMG5wbHzhTDWz0fnWusnIqO66IpvQFfmUHk8mLnj050f/KjKI7 FyIQ== X-Gm-Message-State: APuU4Z8DEuBMOtuAnCrfgv3H38MIBpi4/0Rc2hIHq8UEykCTZdNTCSIp 43ZYzNuDu6JQzS334yQg6iGMjPwB37LzSnHN721bVmZlkCq6Qq5mJ9HhhCHnCw== X-Gm-Gg: AYBFou2Ddzs8SprwfAVYhGTOAk2bNQYEmiwZ5MU9rBnhZHil5vAYToqdRF/P5pEMlnN TCtwvig3TvBV+AOCsgDWrOJjjRGUNAqsFpGCIDMQtDhdYmX5Tea5S4ZoERMs3lVyahjTGTn1w9z Hl6s+cWDrLfpBjGD7+Hd8gAe1sGf1sTCAo/9vk7raEFeo8LU6u5Z7lzqxC6aeHK8trh82q5b8gY v8kxBCDP+2Xzcf++4A9N+4tssJhc3PB9X10T1P15uAbSFbc7GGYjUAFZq/o69lgW+B2EI1KVWA3 vKHRy7fLNt5q2UNf31vGo+OAR+VE4S5FaLHzcB4w/6E/k8bCJ3N5qPNk70AzmFgJl41VHQyIgYM ZabdYEVwrgthrKrTeOst2M7blT7YVAbzHkCOKKht6ExNIWCXhUa2XMuhGHvVi6ENYQyCfi0QOgZ 9YrkDIDc7GM3OFpZq/zGLc4sv61F6qFCQemZPV46SiG16lwrJU5JfD/83LZYB20712xpimSwGaO G11UKkvvk0C+1ztblf25KAaDvCLP1j4HZFl2RhBWdb9usLpzx5v30hel76gS8g3KT78r4p4NF7c 3Utbk0KkZdw= X-Received: by 2002:a05:600c:8b54:b0:4a1:fa21:fd90 with SMTP id 5b1f17b1804b1-4ac16bc547dmr382586005e9.9.1793791380563; Wed, 04 Nov 2026 03:23:00 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4b412e48fd8sm45024275e9.1.2026.11.04.03.22.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 03:22:59 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, Stefano Tondo , Stefano Tondo Subject: [PATCH 1/3] spdx30: Make source download enrichment part of the task signature Date: Wed, 4 Nov 2026 12:22:55 +0100 Message-ID: <20261104112257.866914-2-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104112257.866914-1-stondo@gmail.com> References: <20261104112257.866914-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 11:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249364 From: Stefano Tondo bitbake does not track module functions whose names start with an underscore when it computes task signatures. _enrich_source_package() and _generate_git_purl() were therefore not part of the do_create_spdx signature, and neither was SPDX_GIT_PURL_MAPPINGS, which _generate_git_purl() reads. Changing the mappings or this code did not rerun do_create_spdx, and the previous SPDX was restored from sstate. Rename both functions so that bitbake tracks them. This changes the do_create_spdx signature of every recipe once. Signed-off-by: Stefano Tondo --- meta/lib/oe/spdx30_tasks.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 646ec7d074..803a9e05a9 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -358,7 +358,7 @@ def collect_dep_sources(dep_objsets, dest): index_sources_by_hash(e.to, dest) -def _generate_git_purl(d, download_location, srcrev): +def generate_git_purl(d, download_location, srcrev): """Generate a Package URL for a Git source from its download location. Parses the Git URL to identify the hosting service and generates the @@ -416,7 +416,7 @@ def _generate_git_purl(d, download_location, srcrev): return None -def _enrich_source_package(d, dl, fd, file_name, primary_purpose): +def enrich_source_package(d, dl, fd, file_name, primary_purpose): """Enrich a Git source download package with version, PURL, and external refs. For Git sources, extracts the full SHA-1 from SRCREV as the version, @@ -435,7 +435,7 @@ def _enrich_source_package(d, dl, fd, file_name, primary_purpose): # Generate PURL for Git hosting services download_location = getattr(dl, "software_downloadLocation", None) if version and download_location: - purl = _generate_git_purl(d, download_location, version) + purl = generate_git_purl(d, download_location, version) if version: dl.software_packageVersion = version @@ -524,7 +524,7 @@ def add_download_files(d, objset): ) ) - _enrich_source_package(d, dl, fd, file_name, primary_purpose) + enrich_source_package(d, dl, fd, file_name, primary_purpose) if release_date is not None: dl.releaseTime = release_date From patchwork Wed Nov 4 11:22:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 102897 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6935.1793791383680344715 for ; Wed, 04 Nov 2026 03:23:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=bUz7Vk9M; spf=pass (domain: gmail.com, ip: 209.85.128.50, mailfrom: stondo@gmail.com) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a210470b49so4029695e9.2 for ; Wed, 04 Nov 2026 03:23:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793791382; x=1794396182; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=B8+0V+p2J/ZJmoCXcn8oNosQt4yfM9B4KumbJgEyUww=; b=bUz7Vk9MdLJoYlORZ2DnidZxRMnivmgFO325jF9qI/+2thk/8J1TqOJkQFeQjy6hsL 8Me++jeaSNF7zWMbMdWOfYpaF5lRV/ke181Uwf/nJT7NvWbUOfX2AGVAZX6at5OzN1Zl v3t3LHbVw5/9XsnlcnX6bVs/mGORTY7iPqFtRKhFsEvCgxvqQBd8GLen54XVLDv/BYkU f88Lhv0s3K5q9Zu2eBp+wToluizQ1ANSI0fn/T1C7qW/tjOJRsh1HX5JdusYo8EAw3Y8 NCnnVMW10frQndta8WaJgbVap+YQlZ8OhwLZkpXkYYU9ZXHjuz+S27p2GO8QzmoryvjQ TgiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793791382; x=1794396182; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=B8+0V+p2J/ZJmoCXcn8oNosQt4yfM9B4KumbJgEyUww=; b=2eDH73O44DduWf2GtVKcXR9hNFkDJqRKlSoPEX7Q5wJgoYYEEYnpjjdv6cLwje32xt GjJ8uhIP+EUdeNpWcPfOIoDeReaK+3r/z6ZlbrfJXxIhuoj2UYrRpCr4WusMj1A8KxIH Jivt6oKn2PC0xcGixDdt0MLlshJm0aF9iFpYgX2W1Hr6y1l+VfD0bcdYRPL1ZgK1SVvv 0LZBeidMxfHqLETmwm/Xz2CPWuRjZy1yZaYBfIbkz2Cxr3D6E25QnS6uaSbKwMPgzOdy +hjkW7uC9Q8Pt0pGtzaKlNphx2mmgL6GkQVY5yLUS+DQhD2cS4vUxwv8wM08Up2zPQcQ 6j0A== X-Gm-Message-State: APuU4Z+xi9xpLMF3A735kcdN4eZfERaRW/7IfUEVLKMlTc1LvoQK6zZc c+eacQKCEHa+FwN2TklGjjBOmkesrF0/kwf5TVCNzywGNDW5WMKvhq3CPM1ayg== X-Gm-Gg: AYBFou3HYOerjSn2h+iZFAPITIv+Q3sV6SeMjoUl9a3X2lLp0flFz9qrkM8Yun3zSPi 7SUIoBcm7TXEODk3zhYktn4BWCiwg368DqVm91pJTJCTEKq0AqJ/fkLqhb5s4vLpgzMM3FqR/sb MhJdEdlJM4zk3Y3nAwJtlI4K5RbGOVLUNTVhkZGr75qPHwf80U3vhcCA383AQ8H4oyESXy4WSEo 587gkAF0V2el7Fvo3ihLFzhwEVbnsBiPPVlNFZVlaPaT9LVCVE0hFk29DSdXWj1mSoLqQdNQ8no C2PE8IqqqwFUul4vP0JnByA8daT6iWPZN6JWLhlXti+TD08y11fKX3vOWmzfIV2fnVA+NbD2LR5 OTVJQntZxHDTQ+ANr0Cet9Uc8v5zPdp8AXlXPP6xfzgaDBKrKqr1CqtWcLRy9Z04/NOQWLjQb5r gUTtCAiRm6Eyv4N1EQIg8N6uRWUToaHi6/TvXJa7egJyueeKSceba2nR1BuZe++gfQmQ8wSUUqU cblaj0axypbJ+IzYhRGdjjI3FmOBCtpzaNLgZXk5fU0mM9GvHGlA+YQjQ2R8kDvr8Rf0inL9Vza 3qRKDcmVOYE= X-Received: by 2002:a05:600d:8082:b0:4ad:181a:4348 with SMTP id 5b1f17b1804b1-4ad181a442cmr252206675e9.18.1793791381853; Wed, 04 Nov 2026 03:23:01 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4b412e48fd8sm45024275e9.1.2026.11.04.03.23.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 03:23:01 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, Stefano Tondo , Stefano Tondo Subject: [PATCH 2/3] spdx30: Enrich gitsm source downloads like git ones Date: Wed, 4 Nov 2026 12:22:56 +0100 Message-ID: <20261104112257.866914-3-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104112257.866914-1-stondo@gmail.com> References: <20261104112257.866914-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 11:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249365 From: Stefano Tondo The source download enrichment only handled fd.type "git", so gitsm downloads got the VCS external reference but neither the SRCREV as version nor the PURL. The gitsm fetcher is a git fetcher with submodule support and carries the same revision, so treat it the same. Signed-off-by: Stefano Tondo --- meta/lib/oe/spdx30_tasks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 803a9e05a9..7f3280a763 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -426,7 +426,7 @@ def enrich_source_package(d, dl, fd, file_name, primary_purpose): version = None purl = None - if fd.type == "git": + if fd.type in ("git", "gitsm"): # Use full SHA-1 from fd.revision srcrev = getattr(fd, "revision", None) if srcrev and srcrev not in {"${AUTOREV}", "AUTOINC", "INVALID"}: From patchwork Wed Nov 4 11:22:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 102898 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7057.1793791385216139509 for ; Wed, 04 Nov 2026 03:23:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=YRw8znom; spf=pass (domain: gmail.com, ip: 209.85.128.46, mailfrom: stondo@gmail.com) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a35db1f202so4014085e9.3 for ; Wed, 04 Nov 2026 03:23:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793791383; x=1794396183; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=clrinB6kn2KFJrBAh44Avrv6dR4n+TvXFI9I/VdAcDY=; b=YRw8znomi4rdzgSbKQFDYqdYllvkaS3BZPsJoSNumsWF1GqZ4WPT9jxSjzQ+J08fOc 8sUp+x7FlfMpgtDg81x8ov3VZGX+uQVysi3QvOvHbQU8C6p1vHJbf8hkFgcThmSDPWSS bFanGjyfh8GeuG7UfeA06vXWuCRHoIkwrHx8vcOc5/vLQqg26S7JRrt4NDOzcJb5adPn 2fzAVZ/4KWUdfZOxr+UP+vNPJgtCf6ZiVTqsspl13lSUMC+1QTWvqgW4HT/xxVoF83cH 8UxlEARaTR2MSXGo+q+i1W8FTKzrk2X8c2eCIfKNJHq+7nE7H4tteXrGBA3coUv5nTsM kYpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793791383; x=1794396183; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=clrinB6kn2KFJrBAh44Avrv6dR4n+TvXFI9I/VdAcDY=; b=HBwaVH+z0OnitJTbUv6HMwca73gGH8ZxDasJPjG3SlW6XxWNvD/qDtYh1F/elmGSXX dHC8o7qfhhb8A7NOREC5feM94iXLppsS3ontmoAFT77EFOGZBjVA9ENdQvHcBUDArKZ3 nN+eHIE+r/CCKC7DN7DqEUI62ZyfMvg+Y/K5jtj4TINi4lkG7IVTVNv9nztvhdn9qU0s Ki4FlVgI8ZMvCkLUdX+T7otM/2rjSsYE9xTj/45Zi3/Y+rnAWcc5cwIFkbpaoXT+xQk3 coVoS5oSfuSn+dTUJXeauE3AwX9bf88kD4pf/HBG1jn9ZqxbIasrCBETPXU//+XPwfGD UwPg== X-Gm-Message-State: APuU4Z/3ZJaD/Gw78S8pejSSE2pNv7+ELVQuA5QpnappnMZYk1V+HoQL Zj9XyhT6I37m7RBm1amK2szQRYdOh+XBn++MzIPOJVY/8buoAkFux97DKbRhvA== X-Gm-Gg: AYBFou0TmnTDn23brr8pZMJafTLaX+Qj1lJIBc96pXVJPsANvRZg2LJE//VaNgmhXus HgFwLnbmlaza9WCM9Y3cPyxtbxaUJLn8gQldmi9K7ONh3L1BgxAxydvpY3Zt5hUMuEBoStFCwan DvyHLZDeMs+JENxO4AunXQzgSoQ1dyOw15Mv7cDMDfJdI/FHkFavw+05SeSxti1Wm8maIqfhsR5 LlQhXdUdbFl6tv0uLSVVyW+PUnBHQR5BJzOCeLjkNWf6+6CCdM96YsScgnb6Zv8Z58lBoV6p7sb G5yYcNgw/4bTf84O1uTml2ljTfeUQPpffmbCDSarZRCswsN1Sk9EsvP7egclIQya2p4qkE6Sb3C W7fvRVMDJBLr0wqXHVeBhKZ9WNod+jPZ/UjnPnzgBQVhWFdOFvOFXowU5k90Rupa38xtnAzEvNJ HYCWYCfRmCfYAPKKDqGHC2TuIgHmy8qZL8H/jYJTzE/aWxktTpHIXIQ82m+yFLSFS4eiw4URiz0 6YT6QyQ4lG5Txve2OIjYwDuLKtcvF8X5k4cdFYP68YEyuzRkllQUjfieFLHoQGt9QmunDMgh5Xs c+cO97FEQOw= X-Received: by 2002:a05:600c:1d07:b0:4a2:18d4:f9e0 with SMTP id 5b1f17b1804b1-4ac18c735b3mr362427095e9.25.1793791383412; Wed, 04 Nov 2026 03:23:03 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4b412e48fd8sm45024275e9.1.2026.11.04.03.23.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 03:23:02 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, Stefano Tondo , Stefano Tondo Subject: [PATCH 3/3] oeqa/selftest: Add tests for source download enrichment Date: Wed, 4 Nov 2026 12:22:57 +0100 Message-ID: <20261104112257.866914-4-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104112257.866914-1-stondo@gmail.com> References: <20261104112257.866914-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 11:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249366 From: Stefano Tondo test_gitsm_source_version builds git-submodule-test, which uses gitsm, and checks that its source download carries the SRCREV as version. test_git_purl_mappings_rerun_create_spdx builds fastfloat twice, first with the default mapping and then with github.com mapped to another PURL type, and checks that the second SPDX carries the new PURL. Before the enrichment became part of the task signature, the second build restored the first SPDX from sstate. Signed-off-by: Stefano Tondo --- meta/lib/oeqa/selftest/cases/spdx.py | 47 ++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py index c900558b44..e5d6715aa9 100644 --- a/meta/lib/oeqa/selftest/cases/spdx.py +++ b/meta/lib/oeqa/selftest/cases/spdx.py @@ -445,6 +445,53 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase): f"Version '{version}' for package '{name}' should contain digits" ) + def test_gitsm_source_version(self): + """Test that gitsm source downloads are enriched like git ones. + + git-submodule-test is fetched with gitsm://, so its source download + must carry the SRCREV as version. + """ + objset = self.check_recipe_spdx( + "git-submodule-test", + "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/builds/build-git-submodule-test.spdx.json", + ) + + srcrev = get_bb_var("SRCREV", "git-submodule-test") + for pkg in objset.foreach_type(oe.spdx30.software_Package): + location = pkg.software_downloadLocation or "" + if location.startswith("git+https://git.yoctoproject.org/git-submodule-test"): + self.assertEqual(pkg.software_packageVersion, srcrev) + break + else: + self.fail("git-submodule-test gitsm source download not found") + + def test_git_purl_mappings_rerun_create_spdx(self): + """Test that SPDX_GIT_PURL_MAPPINGS is part of the do_create_spdx signature. + + fastfloat is fetched from github.com. Build it with the default + mapping, then map github.com to another PURL type: do_create_spdx + must run again instead of restoring the first result from sstate. + """ + spdx_path = "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/builds/build-fastfloat.spdx.json" + location_prefix = "git+https://github.com/fastfloat/fast_float" + srcrev = get_bb_var("SRCREV", "fastfloat") + + def source_purl(objset): + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if (pkg.software_downloadLocation or "").startswith(location_prefix): + return pkg.software_packageUrl + self.fail("fastfloat git source download not found") + + objset = self.check_recipe_spdx("fastfloat", spdx_path) + self.assertEqual(source_purl(objset), f"pkg:github/fastfloat/fast_float@{srcrev}") + + objset = self.check_recipe_spdx( + "fastfloat", + spdx_path, + extraconf='SPDX_GIT_PURL_MAPPINGS = "github.com:pkg:selftest"\n', + ) + self.assertEqual(source_purl(objset), f"pkg:selftest/fastfloat/fast_float@{srcrev}") + def test_release_date_source_date_epoch(self): """releaseTime should be derived from SDE_FILE via epochfile_read().