CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX

Browse Source 
Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes
PACKAGECONFIG features to be recorded in the SPDX document as build parameters.

Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG:<feature>
and value enabled or disabled, depending on whether the feature is active in
the current build.

This makes the build-time configuration more transparent in SPDX output and
improves reproducibility tracking.

This makes the build-time configuration more transparent in SPDX output and
improves reproducibility tracking. In particular, it allows consumers of the
SBOM to identify enabled/disabled features that may affect security posture
or feature set.

Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
(From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Kamel Bouhara (Schneider Electric) 2025-12-15 16:54:23 +01:00 committed by Steve Sakoman
parent 6d222750d5
commit 707dce4f01
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
meta/classes/create-spdx-3.0.bbclass
View File

@ -56,6 +56,11 @@ and each CONFIG_* value will be included in the Build.build_parameter list as Di
items. Set to '0' to disable exporting kernel configuration to improve performance or reduce \
SPDX document size."
SPDX_INCLUDE_PACKAGECONFIG ??= "0"
SPDX_INCLUDE_PACKAGECONFIG[doc] = "If set to '1', each PACKAGECONFIG feature is recorded in the \
build_Build object's build_parameter list as a DictionaryEntry with key \
'PACKAGECONFIG:<feature>' and value 'enabled' or 'disabled'"
SPDX_IMPORTS ??= ""
SPDX_IMPORTS[doc] = "SPDX_IMPORTS is the base variable that describes how to \
reference external SPDX ids. Each import is defined as a key in this \

20
meta/lib/oe/spdx30_tasks.py
View File

@ -809,6 +809,26 @@ def create_spdx(d):
sorted(list(build_inputs)) + sorted(list(debug_source_ids)),
)
if d.getVar("SPDX_INCLUDE_PACKAGECONFIG", True) != "0":
packageconfig = (d.getVar("PACKAGECONFIG") or "").split()
all_features = (d.getVarFlags("PACKAGECONFIG") or {}).keys()
if all_features:
enabled = set(packageconfig)
all_features_set = set(all_features)
disabled = all_features_set - enabled
for feature in sorted(all_features):
status = "enabled" if feature in enabled else "disabled"
build.build_parameter.append(
oe.spdx30.DictionaryEntry(
key=f"PACKAGECONFIG:{feature}",
value=status
)
)
bb.note(f"Added PACKAGECONFIG entries: {len(enabled)} enabled, {len(disabled)} disabled")
oe.sbom30.write_recipe_jsonld_doc(d, build_objset, "recipes", deploydir)