From: Stefano Tondo <[email protected]>
This commit adds support for setting supplier information on image and SDK
SBOMs using the suppliedBy property on root elements.
New configuration variables:
SPDX_IMAGE_SUPPLIER (optional):
- Base variable name to describe the Agent supplying the image SBOM
- Follows the same Agent variable pattern as SPDX_PACKAGE_SUPPLIER
- Sets suppliedBy on all root elements of the image SBOM
SPDX_SDK_SUPPLIER (optional):
- Base variable name to describe the Agent supplying the SDK SBOM
- Follows the same Agent variable pattern as SPDX_PACKAGE_SUPPLIER
- Sets suppliedBy on all root elements of the SDK SBOM
Implementation:
- create_image_sbom_spdx(): After create_sbom() returns, uses
objset.new_agent() to create supplier and sets suppliedBy on
sbom.rootElement
- create_sdk_sbom(): After create_sbom() returns, uses objset.new_agent()
to create supplier and sets suppliedBy on sbom.rootElement
- Uses existing agent infrastructure (objset.new_agent()) for proper
de-duplication and metadata handling
- No changes to generic create_sbom() function which is used for recipes,
images, and SDKs
Usage example in local.conf:
SPDX_IMAGE_SUPPLIER = "acme"
SPDX_IMAGE_SUPPLIER_acme_name = "Acme Corporation"
SPDX_IMAGE_SUPPLIER_acme_type = "organization"
SPDX_IMAGE_SUPPLIER_acme_id_email = "[email protected]"
This enables compliance workflows that require supplier metadata on image
and SDK SBOMs while following existing OpenEmbedded SPDX patterns.
Signed-off-by: Stefano Tondo <[email protected]>
---
meta/classes/create-spdx-3.0.bbclass | 10 ++++++++++
meta/lib/oe/spdx30_tasks.py | 24 ++++++++++++++++++++++++
2 files changed, 34 insertions(+)
diff --git a/meta/classes/create-spdx-3.0.bbclass
b/meta/classes/create-spdx-3.0.bbclass
index 96c0b9722b..9f9066eeb5 100644
--- a/meta/classes/create-spdx-3.0.bbclass
+++ b/meta/classes/create-spdx-3.0.bbclass
@@ -124,6 +124,16 @@ SPDX_ON_BEHALF_OF[doc] = "The base variable name to
describe the Agent on who's
SPDX_PACKAGE_SUPPLIER[doc] = "The base variable name to describe the Agent who
\
is supplying artifacts produced by the build"
+SPDX_IMAGE_SUPPLIER[doc] = "The base variable name to describe the Agent who \
+ is supplying the image SBOM. The supplier will be set on all root elements
\
+ of the image SBOM using the suppliedBy property. If not set, no supplier \
+ information will be added to the image SBOM."
+
+SPDX_SDK_SUPPLIER[doc] = "The base variable name to describe the Agent who \
+ is supplying the SDK SBOM. The supplier will be set on all root elements \
+ of the SDK SBOM using the suppliedBy property. If not set, no supplier \
+ information will be added to the SDK SBOM."
+
SPDX_PACKAGE_VERSION ??= "${PV}"
SPDX_PACKAGE_VERSION[doc] = "The version of a package, software_packageVersion
\
in software_Package"
diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index c86b088b61..2883e2202a 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -1305,6 +1305,18 @@ def create_image_sbom_spdx(d):
objset, sbom = oe.sbom30.create_sbom(d, image_name, root_elements)
+ # Set supplier on root elements if SPDX_IMAGE_SUPPLIER is defined
+ supplier = objset.new_agent("SPDX_IMAGE_SUPPLIER", add=False)
+ if supplier is not None:
+ supplier_id = supplier if isinstance(supplier, str) else supplier._id
+ # Add supplier to objset if it's not already there
+ if not isinstance(supplier, str):
+ objset.add(supplier)
+ # Set suppliedBy on all root elements
+ for elem in sbom.rootElement:
+ if hasattr(elem, "suppliedBy"):
+ elem.suppliedBy = supplier_id
+
oe.sbom30.write_jsonld_doc(d, objset, spdx_path)
def make_image_link(target_path, suffix):
@@ -1416,6 +1428,18 @@ def create_sdk_sbom(d, sdk_deploydir, spdx_work_dir,
toolchain_outputname):
d, toolchain_outputname, sorted(list(files)), [rootfs_objset]
)
+ # Set supplier on root elements if SPDX_SDK_SUPPLIER is defined
+ supplier = objset.new_agent("SPDX_SDK_SUPPLIER", add=False)
+ if supplier is not None:
+ supplier_id = supplier if isinstance(supplier, str) else supplier._id
+ # Add supplier to objset if it's not already there
+ if not isinstance(supplier, str):
+ objset.add(supplier)
+ # Set suppliedBy on all root elements
+ for elem in sbom.rootElement:
+ if hasattr(elem, "suppliedBy"):
+ elem.suppliedBy = supplier_id
+
oe.sbom30.write_jsonld_doc(
d, objset, sdk_deploydir / (toolchain_outputname + ".spdx.json")
)
--
2.52.0
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#229057):
https://lists.openembedded.org/g/openembedded-core/message/229057
Mute This Topic: https://lists.openembedded.org/mt/117150256/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
