diff options
| author |   Saul Wold <Saul.Wold@windriver.com> | 2023-02-13 11:54:13 -0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-02-15 10:20:44 +0000 |
| commit | 33ced8338f0facb412b5f24cf9df4a84226a2a94 (patch) | |
| tree | 1c6523c9d963bde5376863bee69c6648a465e44c /meta/classes | |
| parent | 840d55a4bf8e908e2b2841496232ffa7c00799e4 (diff) | |
| download | openembedded-core-33ced8338f0facb412b5f24cf9df4a84226a2a94.tar.gz | |
create-spdx-2.2: Add support for custom Annotations
This change adds a new variable to track which recipe variables
are added as SPDX Annotations.
Usage: add SPDX_CUSTOM_ANNOTATION_VARS = <some recipe variable>
The recipe spdx json will contain an annotation stanza that looks
something like this:
"annotations": [
{
"annotationDate": "2023-02-13T19:44:20Z",
"annotationType": "OTHER",
"annotator": "Tool: oe-spdx-creator - 1.0",
"comment": "CUSTOM_VARIABLE=some value or string"
},
Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/classes')
| -rw-r--r-- | meta/classes/create-spdx-2.2.bbclass | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass index 9aede86870..28a42e009f 100644 --- a/meta/classes/create-spdx-2.2.bbclass +++ b/meta/classes/create-spdx-2.2.bbclass @@ -32,6 +32,8 @@ SPDX_PRETTY ??= "0" SPDX_LICENSES ??= "${COREBASE}/meta/files/spdx-licenses.json" +SPDX_CUSTOM_ANNOTATION_VARS ??= "" + SPDX_ORG ??= "OpenEmbedded ()" SPDX_SUPPLIER ??= "Organization: ${SPDX_ORG}" SPDX_SUPPLIER[doc] = "The SPDX PackageSupplier field for SPDX packages created from \ @@ -404,7 +406,6 @@ def collect_dep_sources(d, dep_recipes): return sources - python do_create_spdx() { from datetime import datetime, timezone import oe.sbom @@ -481,6 +482,10 @@ python do_create_spdx() { if description: recipe.description = description + if d.getVar("SPDX_CUSTOM_ANNOTATION_VARS"): + for var in d.getVar('SPDX_CUSTOM_ANNOTATION_VARS').split(): + recipe.annotations.append(create_annotation(d, var + "=" + d.getVar(var))) + # Some CVEs may be patched during the build process without incrementing the version number, # so querying for CVEs based on the CPE id can lead to false positives. To account for this, # save the CVEs fixed by patches to source information field in the SPDX. |