From: Joshua Watt <jpewhacker@gmail.com>
To: openembedded-core@lists.openembedded.org
Cc: Joshua Watt <JPEWhacker@gmail.com>
Subject: [OE-core][PATCH] classes/create-spdx-2.2: Fix SPDX dependencies for ABI Safe recipes
Date: Thu, 2 May 2024 08:57:50 -0600 [thread overview]
Message-ID: <20240502145750.1145411-1-JPEWhacker@gmail.com> (raw)
SPDX Documents can currently get into a state where they reference SPDX
IDs that do not exist (locally). The reason for this is that some
tasks/recipes are marked as ABI safe, and thus are excluded from
taskhash. This means that when SPDX creates a document, it will refer to
the SPDX ID in the dependency at the time when the document is created,
but if the dependency changes and gets a new SPDX ID, the document will
not rebuild to reference the new SPDX ID, causing it to be dangling.
Fix this by using the new field in BB_TASKDEPDATA to skip dependencies
that are not part of the taskhash calculation.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
meta/classes/create-spdx-2.2.bbclass | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
index 486efadba96..bae437f48e7 100644
--- a/meta/classes/create-spdx-2.2.bbclass
+++ b/meta/classes/create-spdx-2.2.bbclass
@@ -357,7 +357,13 @@ def collect_dep_recipes(d, doc, spdx_recipe):
with spdx_deps_file.open("r") as f:
deps = json.load(f)
- for dep_pn, dep_hashfn in deps:
+ for dep_pn, dep_hashfn, in_taskhash in deps:
+ # If this dependency is not calculated in the taskhash skip it.
+ # Otherwise, it can result in broken links since this task won't
+ # rebuild and see the new SPDX ID if the dependency changes
+ if not in_taskhash:
+ continue
+
dep_recipe_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "recipe-" + dep_pn, dep_hashfn)
if not dep_recipe_path:
bb.fatal("Cannot find any SPDX file for recipe %s, %s" % (dep_pn, dep_hashfn))
@@ -478,7 +484,7 @@ def collect_direct_deps(d, dep_task):
for dep_name in this_dep[3]:
dep_data = taskdepdata[dep_name]
if dep_data[1] == dep_task and dep_data[0] != pn:
- deps.add((dep_data[0], dep_data[7]))
+ deps.add((dep_data[0], dep_data[7], dep_name in this_dep[8]))
return sorted(deps)
@@ -721,9 +727,9 @@ def collect_package_providers(d):
providers = {}
deps = collect_direct_deps(d, "do_create_spdx")
- deps.append((d.getVar("PN"), d.getVar("BB_HASHFILENAME")))
+ deps.append((d.getVar("PN"), d.getVar("BB_HASHFILENAME"), True))
- for dep_pn, dep_hashfn in deps:
+ for dep_pn, dep_hashfn, _ in deps:
localdata = d
recipe_data = oe.packagedata.read_pkgdata(dep_pn, localdata)
if not recipe_data:
--
2.34.1
reply other threads:[~2024-05-02 14:59 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240502145750.1145411-1-JPEWhacker@gmail.com \
--to=jpewhacker@gmail.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).