From patchwork Wed Nov 11 17:35:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 103769 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2362.1794418543686461360 for ; Wed, 11 Nov 2026 09:35:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=uSvEnRQn; spf=pass (domain: gmail.com, ip: 209.85.128.53, mailfrom: stondo@gmail.com) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a5b2be99a8so27905685e9.2 for ; Wed, 11 Nov 2026 09:35:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794418542; x=1795023342; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=NifgvPF30MbFNY5IpUT5kxGOKA9ILfbSNaB83WvB920=; b=uSvEnRQnm2urTcdNRY+4jrtjI0xdc7IrVh/0DyMCTXIOTI5RTqLc8SQtNfUv6YoSHR kb371bRtDbGKvj0AmeqXFEu4gSSIWONPZVdgGuUNmU8yrK7PzbZNaVbCS7IVyvEWMqBE /1gTD3bkZBGVG40Be1wh9Rz01732eBiY37QsmXf0/WgjSIkFFuiAOI5hhemcKCb2DgZb S7sIakF67UfgVjRfxwi/0HfE9L5UbmhNmAHA8F4SwP9rKasOxWPx+xOLnBlv4CpazJma 0JkYQ0tchPizx2+X/+lTgj7ldfofTS9rlYLD3weYSURjncuuTvw9baRYPqLkmTzUyAHq RGqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794418542; x=1795023342; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=NifgvPF30MbFNY5IpUT5kxGOKA9ILfbSNaB83WvB920=; b=Eg0J4efulaOqcTW8R7MxrLxzukW+hsbn07qQdylGES/KbkB+yCS7L7Xjcp45ZdEy+w 1ekIvFeu87E6/cz0Bnkk+2CH6GhE9eBN6d9oJvfMHH3XDoUuFdY8oJ8d8lfvWcHllDtz VkeoPhCNFGC8uq3rhTsr6FgBqBDx+JF3E5G00FZPfU8XxJAXi5SiBMIt+5ZX7ndmeELn hEX+/GWVfYn1j+qh8btKquM2VX5NkACi6CKJhRQSRmblaL8bBr5+Yis+XxGZRcT+lgWO lRKEIQKgVpwZo70leKJNkRLgA2YWYY9J18Xpg3x3Na1BUHYcUn9GEMPlUZUkwF092f8d NDXw== X-Gm-Message-State: APuU4Z9tNqhAdjA0FsaIkhkkme4YatwMhCzFvcBhUEc46AiZX8Nkk+od SUpYCWLl5L1JF3d72Kesl3WfEtfPp2wn06KyAhEqPmtlR1qkYwvBF5yMebwpUJrZ X-Gm-Gg: AYBFou1pZW3wmBomFFE5pfBFki2IamMhV4xWzEuDzP3cwLZ+CfherpRW8PwdxUuYa9n XSqK3R+CkCSdCdPRag9cSlYnTGzOo8a3XydTKUj2UTcjqe/FmKFfKu+InLx6coaMWZzWEeGUm+P FC5AyZllh2MEwLru1xXzMM+pDoZ2Fm+BBpQBpdLwSH12Z+HGpohQRJNDVtOiCOhhb1v0DoundzF 2UbSxEgS5H7wWBb6u4oOTSPbVCnvQnaeTbjsTNhQJfEPgrPtukjK5HJa42IupXd5nKacKlWT/5X xI7Bb1JxeS8NHakzbxWCLzSa3nnypUO83QHtLJzG6yQXKDi9BJJzHwrN4KxfLL/pMZFkz+vEkmp AhNbJTSX/oMcNtbkvDuG5+7iC+AfcMLta8WLfGMiX6MP9UVJtNoe7GxE61jqYTPpZbxLFoa6QFW ZMyd19FqE/qTdIx65dhkWMSCZGv+QhF7fbIpXdd6R4U9XF4gmR/wvz/x7vWhpojfO8OpUzBysVr DeqjTqrktV84FkC2FYqPqGKsL2eyzKoaQjHVBG57qqhc3pYXGmJ7m/7cSdMvaJMnsXIquPcVmFL Cmoe3qYRZd+vRJiOT7+kovhl+FPoS4JLV9AK1sLx3y0y1rg= X-Received: by 2002:a05:600c:b86:b0:4a1:de8a:603a with SMTP id 5b1f17b1804b1-4ba093583e2mr60815865e9.6.1794418541860; Wed, 11 Nov 2026 09:35:41 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba0950394fsm54823785e9.2.2026.11.11.09.35.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 09:35:41 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, patrick.wicki@siemens.com, stefano.tondo.ext@siemens.com, Kazuyoshi Akiyama , Mathieu Dubois-Briand , Richard Purdie Subject: [wrynose][PATCH 1/4] spdx30_tasks: Fix duplicated revision in Git PURLs Date: Wed, 11 Nov 2026 18:35:34 +0100 Message-ID: <20261111173537.3653558-2-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261111173537.3653558-1-stondo@gmail.com> References: <20261111173537.3653558-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 17:35:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250046 From: KAZUYOSHI AKIYAMA (秋山 和慶) _generate_git_purl() generates invalid PURLs of the form `pkg:github//@@`. purl-spec only allows a single `@`. oe.spdx_common.fetch_data_to_uri() already appends "@" to the download location, and urlparse() leaves that suffix in parsed.path. Therefore, the parsed repository name(`{repo}`) includes `@`. So, need to strip the revision suffix before splitting out the owner(`{owner}`) and the repository name(`{repo}`). While here, replace str.replace(".git", "") with str.removesuffix() so repository names that contain ".git" elsewhere are preserved. Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit e31479ddbaf58d5c2eda2b0051e1a821d46e6f7c) Signed-off-by: Stefano Tondo --- meta/lib/oe/spdx30_tasks.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 1821dd7de4..d5128fff52 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -425,11 +425,14 @@ def _generate_git_purl(d, download_location, srcrev): for domain, purl_type in git_purl_handlers.items(): if hostname == domain: - path = parsed.path.strip('/') + # oe.spdx_common.fetch_data_to_uri() appends "@" to the + # download location, which must not become part of the + # repository name + path = parsed.path.strip('/').partition('@')[0] path_parts = path.split('/') if len(path_parts) >= 2: owner = path_parts[0] - repo = path_parts[1].replace('.git', '') + repo = path_parts[1].removesuffix('.git') return f"{purl_type}/{owner}/{repo}@{srcrev}" break From patchwork Wed Nov 11 17:35:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 103772 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2382.1794418545403294408 for ; Wed, 11 Nov 2026 09:35:45 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=O42iRYMh; spf=pass (domain: gmail.com, ip: 209.85.128.53, mailfrom: stondo@gmail.com) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a35db1f202so27018305e9.3 for ; Wed, 11 Nov 2026 09:35:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794418544; x=1795023344; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7aEejM8kd0gd3jbiSE8wFglsXrPFyTw0OcIX8e7rT7I=; b=O42iRYMhNNcO2904Ff5aB7W2wT5JIUBWH1KtjcVIoJYY9zgiC+dsaAVfpJ98WAdIgA k0HzzIxyZg0JiurFZgTLsPnFNAiEs6y9rX6YZ4OwPZh2XSkCNwkJOBgYXIrY3rXVZT2V RfFd23m1yuMyFBSDZgQ49JCqCTSX/fO4iHWB67d7kpqRbEiLqDE4Ffb9PhM471gcqiM0 G5qE9UGA+vu/XxxTg61aCj5kjpT/XSUOc2D45xK0+twAQ0Cn2JL8FaLdhXGjJ6ArG823 GnG+DgN4Am2q597Vr4ihx5MbsMm3o6w2skAsiQCU/PgtN7bql5GFVBppZenKuBCCrTV/ HNAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794418544; x=1795023344; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=7aEejM8kd0gd3jbiSE8wFglsXrPFyTw0OcIX8e7rT7I=; b=kWkrkc7Ybu7Bjv40c9e13rQEmaBZlWgzYaIkvp+mb9aeD+3Pg595Qgzt1O1hfFWkG7 H+Z1GJ9jNyhSBjuNcognoyRhzaWCl943lX9OgvRGs1vAVQPLc+BddJvbeb7hH2KM1yI0 tOU9Xkgs+KFoQdeqbl7pa+r4BtKS+KbDe6/EmtsHkstyMSEYIArpsMaAeWzs6bzKu+qA DIZ//0y3Y+ckiHDcBpgvGFAV089BcLYADCtz4M5P0qnlWqiilP17JHEPiIUm7Ok7kzHH HnTlqS5k+ldEDbMJ33aQPSad7zO2LgzT+lp6nMiVNUr6FDQT+GviXQHXjrDj2T8nqj8n yLgw== X-Gm-Message-State: APuU4Z9F31MJaGIzi7Xt4MzLqGiXyu2kfCpEtn7rpBFDRVQgEHlt3rQ9 k50AhSU60I0ed73bnaX7wYKJHZUQ5Sah8tBmAzF5xOkahm/dUvDZFJxtraLTsFy0 X-Gm-Gg: AYBFou3dBlAWifz7eZYq1kkFe/F6nlIJQ0jk45Rnvi9AMYocTk2aItRYy9PoN6YRqU9 37l5vu5PGfEKvbhXxeQYjyNJohrUgEGlXi35qASVv2US6HCEsImCheM5XYxkpPj4G8kRO/3FZTc 2v7YK6/F/fiDnqVC0T/xR4AnDvJS8kwHwIqeQm1ykDvf1w1jRkEnE5i5X6wuS8R2YfqJRMfwfwC VWJv1n1Q56U3QC4eZeHWlSQJICCrgLT9GcqEydT92uIObdEhzkdUSUiQp3E+TAVAuft4aSa3vKH dV0O2icz6U9xsUiMUcOfEOmIYiT0ExNN8bPCakAAS0eOkAu/mZihIb3bx3lHFERcGZV+L548kY7 JUXSfCuWWiogsaE0VTzLzWv87zoA0XY2wPJbUYNtfk/mYd6jAGO51AvU2YKp6x8tG0wApgLtHko pwg+99IS/zw/EBhIZ7+vQtx8vx7hdzl/lv2P2rwkdt5IF6NjWNZhRvV24RzWZk8tBdx86ChUqZV SQnhhYHrUw4RjG3koy4zIMAVoDRjTmSpwhZX1RArtTCaDDXZr+uZT5PpR4wxU2BP9khk+HZzGOR aW5bq8vUIxWfApwWLPTIMNnLXawioJ72Oci916Qb10xw3A== X-Received: by 2002:a05:600c:19d0:b0:4a1:cef3:fb3a with SMTP id 5b1f17b1804b1-4ba093805dfmr54097885e9.9.1794418543638; Wed, 11 Nov 2026 09:35:43 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba0950394fsm54823785e9.2.2026.11.11.09.35.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 09:35:42 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, patrick.wicki@siemens.com, stefano.tondo.ext@siemens.com, Mathieu Dubois-Briand , Richard Purdie Subject: [wrynose][PATCH 2/4] spdx30: Make source download enrichment part of the task signature Date: Wed, 11 Nov 2026 18:35:35 +0100 Message-ID: <20261111173537.3653558-3-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261111173537.3653558-1-stondo@gmail.com> References: <20261111173537.3653558-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 17:35:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250047 From: Stefano Tondo bitbake does not track module functions whose names start with an underscore when it computes task signatures. _enrich_source_package() and _generate_git_purl() were therefore not part of the do_create_spdx signature, and neither was SPDX_GIT_PURL_MAPPINGS, which _generate_git_purl() reads. Changing the mappings or this code did not rerun do_create_spdx, and the previous SPDX was restored from sstate. Rename both functions so that bitbake tracks them. This changes the do_create_spdx signature of every recipe once. Signed-off-by: Stefano Tondo Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit e57ec14f8d9bbe2e789163739df5c991e2eebe5e) Signed-off-by: Stefano Tondo --- meta/lib/oe/spdx30_tasks.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index d5128fff52..9fb2dcc36f 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -383,7 +383,7 @@ def collect_dep_sources(dep_objsets, dest): -def _generate_git_purl(d, download_location, srcrev): +def generate_git_purl(d, download_location, srcrev): """Generate a Package URL for a Git source from its download location. Parses the Git URL to identify the hosting service and generates the @@ -439,7 +439,7 @@ def _generate_git_purl(d, download_location, srcrev): return None -def _enrich_source_package(d, dl, fd, file_name, primary_purpose): +def enrich_source_package(d, dl, fd, file_name, primary_purpose): """Enrich a Git source download package with version, PURL, and external refs. For Git sources, extracts the full SHA-1 from SRCREV as the version, @@ -458,7 +458,7 @@ def _enrich_source_package(d, dl, fd, file_name, primary_purpose): # Generate PURL for Git hosting services download_location = getattr(dl, 'software_downloadLocation', None) if version and download_location: - purl = _generate_git_purl(d, download_location, version) + purl = generate_git_purl(d, download_location, version) if version: dl.software_packageVersion = version @@ -547,7 +547,7 @@ def add_download_files(d, objset): ) ) - _enrich_source_package(d, dl, fd, file_name, primary_purpose) + enrich_source_package(d, dl, fd, file_name, primary_purpose) if fd.method.supports_checksum(fd): # TODO Need something better than hard coding this From patchwork Wed Nov 11 17:35:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 103770 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2363.1794418547776109723 for ; Wed, 11 Nov 2026 09:35:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=GpjcNSdT; spf=pass (domain: gmail.com, ip: 209.85.128.49, mailfrom: stondo@gmail.com) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a208d93758so36832305e9.3 for ; Wed, 11 Nov 2026 09:35:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794418546; x=1795023346; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NNUEKGe7bl0YrBpCPzTPfkgN7y1r4wOvWLu+6J3xMIo=; b=GpjcNSdTZtzp6WcusL8KHQn8kZu/dx0l1FJFTnAGubjhjqg9xorp6NmoGFB0nJUK6n Yp08HFZdhZyf5/2/aoTabCerbViKEIBfSz87+FbtIB4Qd0oS13GNOFJ49ARBkmiD4zNe TdTXQuG+1c76k/r2/ul+9H9zocNOdTn5e/wJFxq4tKOfVCUFbomyVpbXbi8SO4DSKFQe 4MjJ9vZOqeBIl5JjYXQ3ottsJKUEExACHm8pECX8j/SNZyV/TFRToFLR8iT9AOTbItNA hGx2c83J8Gm3v9XcyeiVakPs2eMrf2i4jia6ZZdop6HkUQC8GaKEj36hAVBayOcenZsd potA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794418546; x=1795023346; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NNUEKGe7bl0YrBpCPzTPfkgN7y1r4wOvWLu+6J3xMIo=; b=zhJkNUWjE4Fxkaj40j94kQar5g6YthX4M8Z9YAT3OHFLyOmx1SHeLZZ2TM8HvjL2Pj dTMyLYz/loXssYhhGYHzHSWZ9u2Ne6UjsNqobufkF+gEqNj9fQDtSQhDKEfHWiiVLlg1 shKBF4UmmE+dt4zITqpWECh3HYc7IyHzqlsSpTpaOk1PGR+bYnb2XwcjfqqBj00MqjJ1 EmEuE0hfHB8ax6JuRbgAexgdliODG2dBxW+ft+v3FycEnlWhMFujbwsj2ZhUVcxYeyY9 iHNy0hcSKQtxM1uDbl/DnhStnc8AkbNACrR02H8ayPh2OYVowDvebUFbtEaDoTcxjP5N cOVw== X-Gm-Message-State: APuU4Z9RZTaxCFhatBBBh9YBoLkJ6Xu2fu0w/Xb0yviMr0zd0iOUBDTN iE8uGhiir71hSy6boWDcnFaj7xHb0ErClXeEW/0ptGzHrqbzwMVWi1VK3JtqD1R2 X-Gm-Gg: AYBFou1NFtU34BzVs/gUhETIauTny0LgQnFUJrdOHTIvTa5/A7am2JJJJdFkYgGhXJM kLeH9nSfBFKlIKMxz2baN6WpDu/ZBTb2He+oJUW1fLL4noiPwdog8EDotL2ZcURhAGZNHKUcz0T kPgI2d6QO3azWTUqqB5ys6HVkDtQK1zcKaVqWGOwZ37hsay65BrZGKAKC/Orzg2WjKH5d+Tl3tl 0otjoGzQfVJaSpZ/9FOAk8D0xrlzr8hmxhi0ienzx2PfVnKPOy0y5xWaKrWZARIWItEAjPCoKEL Jk+Ehb7RLf5EUkROeXuQNLiB0b6PiuFbFh+Khl9WWSB8FP/y1mcwfW3oEHrSq78JfsvwkMeOPOL A0cJyJ+rKmzqH/OFR76MD0cLI2xfqZSIVkU5RNcVGC/Db0AgGc0Gu8U5eWtFAy2I0F6zXrDYWoj ikFOv64jfkGkINRBaci8SbwSUU7PiZ3j6TQK3dLpDFnKQVaXDbNiJoYk31pnWsipUgDV6JzPQhO ecQdtMMmd6y1enpetx8ROUsxLaBT/zADiOtxWnhffl9Deriw6ANgFcsgDYjvg0eFTe9XI2Fw+7L BKZZ7FTwO9n1q7vL+0JUErw8h3wLCTFSnkXdyEnzpTkfj1ZmAm0Vt0P5yqXbMV0wv5Y= X-Received: by 2002:a05:600c:1986:b0:4a1:f7f4:7ced with SMTP id 5b1f17b1804b1-4ba0937a886mr56705555e9.17.1794418545950; Wed, 11 Nov 2026 09:35:45 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba0950394fsm54823785e9.2.2026.11.11.09.35.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 09:35:44 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, patrick.wicki@siemens.com, stefano.tondo.ext@siemens.com, Mathieu Dubois-Briand , Richard Purdie Subject: [wrynose][PATCH 3/4] spdx30: Enrich gitsm source downloads like git ones Date: Wed, 11 Nov 2026 18:35:36 +0100 Message-ID: <20261111173537.3653558-4-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261111173537.3653558-1-stondo@gmail.com> References: <20261111173537.3653558-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 17:35:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250048 From: Stefano Tondo The source download enrichment only handled fd.type "git", so gitsm downloads got the VCS external reference but neither the SRCREV as version nor the PURL. The gitsm fetcher is a git fetcher with submodule support and carries the same revision, so treat it the same. Signed-off-by: Stefano Tondo Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 1e5146d8f9111416c3fc9247b152d1d70b55c7fe) Signed-off-by: Stefano Tondo --- meta/lib/oe/spdx30_tasks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 9fb2dcc36f..dbaccd0e34 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -449,7 +449,7 @@ def enrich_source_package(d, dl, fd, file_name, primary_purpose): version = None purl = None - if fd.type == "git": + if fd.type in ("git", "gitsm"): # Use full SHA-1 from fd.revision srcrev = getattr(fd, 'revision', None) if srcrev and srcrev not in {'${AUTOREV}', 'AUTOINC', 'INVALID'}: From patchwork Wed Nov 11 17:35:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Tondo X-Patchwork-Id: 103771 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2384.1794418550059218292 for ; Wed, 11 Nov 2026 09:35:50 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=uTEQn43U; spf=pass (domain: gmail.com, ip: 209.85.128.45, mailfrom: stondo@gmail.com) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a1fbd52ab6so23598655e9.0 for ; Wed, 11 Nov 2026 09:35:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794418548; x=1795023348; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cnt5ZzV7vikxmQUthDHOJrKIXPLKU60aKKQHbI2yaQw=; b=uTEQn43UmaSLqpl4xZ09VLVmxBDc+8vK6hE/PuLc8bRSDBrL7KMZRGJ3dX8QQMssj+ 0XCLdPAJ5gmdIe/9/qOXii94PztRFVIUrcRWpNpPRfR6WYxVWaYG536j2S7/ZH+AHbS/ QnzceXcvpdH9gAbfJR7LsMzvyDm+4F5uqolyf/IxwXaau0RYO6teOWIWtVAT97LzlloG 3KKamx6AbFvzZLblHKxB05VPV5ySpNtutN73pCMf8ex+THAXXspmEAg79ZUs0zWw+yr6 sJiPFGc+ZJTecKAXiacnMM4SD0HMbrBGLOvy1Kk0KvxKKsvyvSNmcjn2ES+ATIHg8hH3 4I7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794418548; x=1795023348; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=cnt5ZzV7vikxmQUthDHOJrKIXPLKU60aKKQHbI2yaQw=; b=cEzSb5fVsjPXpgWLw3QB/jG+ZBZ0P2YJKVciAC/ZpFUUVfrq+ocPLz9P6wSbVpDyUJ 4j4ddPVu3MZqgxdegBlThaceK6Gyywjv2sw/CZSYJVJze+qxvIFQWYLX3zUyyAr0NgbF 5a5ryU0ZU+dqG2JhRUDWOIKr2J4pebq6NBdyHtlBqICCdNQp94esbF5qFkwRBIDf/z8U kUk3pPugPRJeL0hRRiqQI9wnrLywbjtKG8dW8V9TYqIWu1uY7n6R5kZvuGjg03PUKnLg tC1JE4uOOGAaHH2ZWDaf9KZENieofWlgsTxN1QAP8ypXrHFVJ9gUKGfuIuAEIlZbx5La uYxA== X-Gm-Message-State: APuU4Z/5fqiVjpsDOgkvdC2nOZ6py7MV6TWEcWu6I/vUTxgL6l+1hl4N GKPn0Ua0eoZFrjU+b8FkUm2YRgbYjyYSxoNdq2ETQU7sN7vFllSgq+JsWFnlnJU5 X-Gm-Gg: AYBFou0cvuyNYWTIgxyWfXkv1w02XLG84BO7m+rV8J5yV84UOhS+11gSm9UZZNUNTIA Vfhm8JPtHTckHuFbxIa7yMN5BYxiqvSaATaOehDHzbf0zBYOGh+1+TARzbIphuhwO+lHM/VISoh BS2EbxHJ4hZH6oFnmfYDltYozbtlqnUslIauCfCYOgsvgY+n78ExbvzluB3iaJaH25Q7cDfmCcz 3L24v/7mkPVnGkID3VN6Dkl1E2LXfbhlsJrnG8O3mUpiKfN1SIwlnQ1HgnwX/ydhHgaV49v/PFg UYu6i6CRwsTps2KMno8pSBzEq4V3B911LehaZhM93U1nEcdWLaevGdJWHUKvGj0lWRoUTJcaGSO NA+8uM7vbNu8RbgtjNKHbMgIr8Lr1r19oairuh3jcCbxUll8xB9FM715WrhxnaWZQictGZq6v+j qUp7e7BuX1Z5Ckc+JDqzSCdSkXfR1QykJfYYF+ACGqkDT7ADavBEp0AQFEjf7G4eMDNUX7XJXJe +9oCl/ZdS0JnIzOl4xHc8KUJqXJzQsUXsncxW3sF74gumQJdYwPWYijOh70/2dir/t8BQWbMgX9 jt0UgIwep37H7GBl33o2uzW/wBpJqnBXoNMMvkhlRsahyQ== X-Received: by 2002:a05:600c:a012:b0:4a1:fba8:b13d with SMTP id 5b1f17b1804b1-4ba0939d46cmr53629145e9.9.1794418548198; Wed, 11 Nov 2026 09:35:48 -0800 (PST) Return-Path: Received: from fedora ([165.225.94.251]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba0950394fsm54823785e9.2.2026.11.11.09.35.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 09:35:46 -0800 (PST) From: Stefano Tondo To: openembedded-core@lists.openembedded.org Cc: yoann.congal@smile.fr, jpewhacker@gmail.com, peter.marko@siemens.com, adrian.freihofer@siemens.com, patrick.wicki@siemens.com, stefano.tondo.ext@siemens.com, Mathieu Dubois-Briand , Richard Purdie Subject: [wrynose][PATCH 4/4] oeqa/selftest: Add tests for source download enrichment Date: Wed, 11 Nov 2026 18:35:37 +0100 Message-ID: <20261111173537.3653558-5-stondo@gmail.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261111173537.3653558-1-stondo@gmail.com> References: <20261111173537.3653558-1-stondo@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 17:35:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250049 From: Stefano Tondo test_gitsm_source_version builds git-submodule-test, which uses gitsm, and checks that its source download carries the SRCREV as version. test_git_purl_mappings_rerun_create_spdx builds fastfloat twice, first with the default mapping and then with github.com mapped to another PURL type, and checks that the second SPDX carries the new PURL. Before the enrichment became part of the task signature, the second build restored the first SPDX from sstate. Signed-off-by: Stefano Tondo Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 3ca309cbd38e7115705a9871c389b4641ec88c63) Signed-off-by: Stefano Tondo --- meta/lib/oeqa/selftest/cases/spdx.py | 47 ++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py index 8285189382..e65ab46f30 100644 --- a/meta/lib/oeqa/selftest/cases/spdx.py +++ b/meta/lib/oeqa/selftest/cases/spdx.py @@ -443,3 +443,50 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase): r'\d', f"Version '{version}' for package '{name}' should contain digits" ) + def test_gitsm_source_version(self): + """Test that gitsm source downloads are enriched like git ones. + + git-submodule-test is fetched with gitsm://, so its source download + must carry the SRCREV as version. + """ + objset = self.check_recipe_spdx( + "git-submodule-test", + "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/builds/build-git-submodule-test.spdx.json", + ) + + srcrev = get_bb_var("SRCREV", "git-submodule-test") + for pkg in objset.foreach_type(oe.spdx30.software_Package): + location = pkg.software_downloadLocation or "" + if location.startswith("git+https://git.yoctoproject.org/git-submodule-test"): + self.assertEqual(pkg.software_packageVersion, srcrev) + break + else: + self.fail("git-submodule-test gitsm source download not found") + + def test_git_purl_mappings_rerun_create_spdx(self): + """Test that SPDX_GIT_PURL_MAPPINGS is part of the do_create_spdx signature. + + fastfloat is fetched from github.com. Build it with the default + mapping, then map github.com to another PURL type: do_create_spdx + must run again instead of restoring the first result from sstate. + """ + spdx_path = "{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/builds/build-fastfloat.spdx.json" + location_prefix = "git+https://github.com/fastfloat/fast_float" + srcrev = get_bb_var("SRCREV", "fastfloat") + + def source_purl(objset): + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if (pkg.software_downloadLocation or "").startswith(location_prefix): + return pkg.software_packageUrl + self.fail("fastfloat git source download not found") + + objset = self.check_recipe_spdx("fastfloat", spdx_path) + self.assertEqual(source_purl(objset), f"pkg:github/fastfloat/fast_float@{srcrev}") + + objset = self.check_recipe_spdx( + "fastfloat", + spdx_path, + extraconf='SPDX_GIT_PURL_MAPPINGS = "github.com:pkg:selftest"\n', + ) + self.assertEqual(source_purl(objset), f"pkg:selftest/fastfloat/fast_float@{srcrev}") +