All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Joseph Reynolds" <jrey@linux.ibm.com>
To: openembedded-core@lists.openembedded.org
Subject: Re: Can create-spdx handle multiple components per recipe
Date: Wed, 15 Feb 2023 14:14:21 -0800	[thread overview]
Message-ID: <30063.1676499261660321328@lists.openembedded.org> (raw)
In-Reply-To: <CAJdd5GbfXCF=sEx8Y8g3DF0=TurNipemT9b2A1iXdOOg2xsA4g@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 896 bytes --]

Thanks for confirming.  I wouldn't expect OE to be able to have any knowledge of "sneaky" downloads of additional packages.

I have an idea to enhance create-spdx.bbclass so sneaky recipes can fess-up and tell create-spdx about any additional packages they downloaded.   If you could implement something like the following, it would help me.  If not, I'll just have to combine the OE-produced SBOM with my own custom-produced SBOMs.  The idea is:

Idea: Enhance create-spdx.bbclass so a recipe can add multiple additional SBOM entries.  For example, if recipeX is sneaky and downloads componentY without bitbake or OE knowing about it, then the recipe will have some way to tell create-spdx that it downloaded componentY at versionZ and also give its license information.

If I had this, then I think we could enhance our webui-vue recipe to use this to report all the NPM packages.

[-- Attachment #2: Type: text/html, Size: 944 bytes --]

      reply	other threads:[~2023-02-15 22:14 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-14 20:27 Can create-spdx handle multiple components per recipe Joseph Reynolds
2023-02-15 20:53 ` [OE-core] " Joshua Watt
2023-02-15 22:14   ` Joseph Reynolds [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=30063.1676499261660321328@lists.openembedded.org \
    --to=jrey@linux.ibm.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.