mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-05 08:02:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

classes/create-spdx-2.2: Fix SPDX dependencies for ABI Safe recipes

Browse Source 
SPDX Documents can currently get into a state where they reference SPDX
IDs that do not exist (locally). The reason for this is that some
tasks/recipes are marked as ABI safe, and thus are excluded from
taskhash. This means that when SPDX creates a document, it will refer to
the SPDX ID in the dependency at the time when the document is created,
but if the dependency changes and gets a new SPDX ID, the document will
not rebuild to reference the new SPDX ID, causing it to be dangling.

Fix this by using the new field in BB_TASKDEPDATA to skip dependencies
that are not part of the taskhash calculation.

(From OE-Core rev: 8393557b5229c7a0cea18a586848384bff1d7424)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
joshua Watt
2024-05-02 08:57:50 -06:00
committed by Richard Purdie
parent c17d11189c
commit 3bf65ca15f
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
meta/classes/create-spdx-2.2.bbclass
View File

@@ -357,7 +357,13 @@ def collect_dep_recipes(d, doc, spdx_recipe):
with spdx_deps_file.open("r") as f:
deps = json.load(f)
for dep_pn, dep_hashfn in deps:
for dep_pn, dep_hashfn, in_taskhash in deps:
# If this dependency is not calculated in the taskhash skip it.
# Otherwise, it can result in broken links since this task won't
# rebuild and see the new SPDX ID if the dependency changes
if not in_taskhash:
continue
dep_recipe_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "recipe-" + dep_pn, dep_hashfn)
if not dep_recipe_path:
bb.fatal("Cannot find any SPDX file for recipe %s, %s" % (dep_pn, dep_hashfn))
@@ -478,7 +484,7 @@ def collect_direct_deps(d, dep_task):
for dep_name in this_dep[3]:
dep_data = taskdepdata[dep_name]
if dep_data[1] == dep_task and dep_data[0] != pn:
deps.add((dep_data[0], dep_data[7]))
deps.add((dep_data[0], dep_data[7], dep_name in this_dep[8]))
return sorted(deps)
@@ -721,9 +727,9 @@ def collect_package_providers(d):
providers = {}
deps = collect_direct_deps(d, "do_create_spdx")
deps.append((d.getVar("PN"), d.getVar("BB_HASHFILENAME")))
deps.append((d.getVar("PN"), d.getVar("BB_HASHFILENAME"), True))
for dep_pn, dep_hashfn in deps:
for dep_pn, dep_hashfn, _ in deps:
localdata = d
recipe_data = oe.packagedata.read_pkgdata(dep_pn, localdata)
if not recipe_data: