Skip to content

spdx: migrate from SPDX 2.2 to SPDX 3.0 - #208

Draft
SandeepR-NI wants to merge 2 commits into
ni:nilrt/master/nextfrom
SandeepR-NI:spdx-3.0-migration
Draft

spdx: migrate from SPDX 2.2 to SPDX 3.0#208
SandeepR-NI wants to merge 2 commits into
ni:nilrt/master/nextfrom
SandeepR-NI:spdx-3.0-migration

Conversation

@SandeepR-NI

Copy link
Copy Markdown

Summary

Reverts the two NI-added commits that pinned SPDX generation to version 2.2,
restoring the upstream default of SPDX 3.0.

Background

Upstream OE-Core switched the default SPDX version to 3.0 (commit beef4c1).
NI temporarily pinned back to 2.2 (commit ad7d668) because NI Central
components expected the legacy spdx.tar.zst artifact only produced by SPDX 2.2.
The 2.2 class was also restored (commit b924800) after upstream removed it.

Changes

Commit 1 — Reapply "Remove SPDX 2.2 support" (reverts b924800)

  • Deletes meta/classes/create-spdx-2.2.bbclass
  • Deletes meta/lib/oe/sbom.py (SPDX 2.2 helpers)
  • Deletes meta/lib/oe/spdx.py (SPDX 2.2 data model)
  • Removes SPDX 2.2 selftests from meta/lib/oeqa/selftest/cases/spdx.py

Commit 2 — Reapply "Switch default spdx version to 3.0" (reverts ad7d668)

  • meta/classes/create-spdx.bbclass: inherit create-spdx-2.2inherit create-spdx-3.0

Verification

Tested locally with bitbake base-files:

  • do_create_spdx and do_create_package_spdx tasks succeed
  • Per-recipe .spdx.json files produced under deploy/spdx/3.0.1/
  • JSON contains "specVersion": "3.0.1"
  • No .spdx.tar.zst produced by the new build

Dependencies

NI Central consumers of spdx.tar.zst (rtos_cross_toolchain.mak,
generate_cdx_sboms.mak) must be updated to consume .spdx.json before
this is merged to production.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant