15983 2025-09-29 10:05:46 +0000 No dependency SPDX for non-image recipe with sstate 2026-04-09 15:16:58 +0000 1 1 7 Build System, Metadata & Runtime OE-Core oe-core other unspecified All Multiple NEW Medium normal 6.99 1 Gianluca.Andreotti JPEWhacker JPEWhacker randy.macleod ross.burton --- --- No (bug/feature does not impact docs) oldest_to_newest 102845 0 Gianluca.Andreotti 2025-09-29 10:05:46 +0000 When building a non-image firmware aggregation recipe that pulls in multiple firmware components as dependencies, SPDX is only generated for the top-level recipe once dependencies are cached in sstate. In this case, bitbake -c build <recipe> produces only: - recipes/recipe-<recipe>.spdx.json - common_package/<recipe>-package-common.spdx.json - by-spdxid-hash/ with only two links No SPDX is emitted for dependencies when they are restored from sstate (subsequent/warm builds). On a cold build, before sstate is populated, dependency SPDX are generated as expected. Workaround: bitbake <recipe> --runall do_create_spdx bitbake <recipe> --runall do_create_packaged_spdx This forces SPDX generation across the dependency tree, filling both recipes/ and packages/ directory. Expected: SPDX should be generated for the recipe and all of its dependencies, similar to building an image (e.g. core-image-minimal), without needing --runall, even when dependencies are retrieved from sstate. 102867 1 randy.macleod 2025-10-02 14:48:57 +0000 Joshua has a patch to generate the combined SPDX for a single recipe rather than an image. This should probably be opt-in rather than default. 102868 2 ross.burton 2025-10-02 15:02:53 +0000 Quoting from Josh in private chat: "Ya that's expected behavior currently. The package spdx would only be pulled in by an image recipe currently" Two alternatives: 1) If separated SPDX files are acceptable then --runall is a good workaround, and the missing dependency to ensure that do_build causes do_create_spdx to run recursively is simple. 2) If the actual need is a combined SPDX (as you get with images currently), then Josh does have some WIP to allow this to happen for any recipe, not just images. Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX? 102879 3 Gianluca.Andreotti 2025-10-02 16:38:45 +0000 > Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX? A combined SPDX would be preferable.