16374 2026-07-23 21:03:55 +0000 Need a builder/job which tests fragments/yocto/sbom-cve-check 2026-07-30 15:17:32 +0000 1 1 5 Infrastructure AutoBuilder autobuilder 6.1 x86 Multiple ACCEPTED Medium enhancement 6.1 1 tim.orling tim.orling infras.ab.watcher Infras.watcher paul randy.macleod --- --- Don't know oldest_to_newest 106325 0 tim.orling 2026-07-23 21:03:55 +0000 A recent change in oe-core (00864cf5bc meta: Add tag in SRC_URI to multiple recipes) had a hidden clash with fragments/yocto/sbom-cve-check: Since the fragment sets SRCREV = AUTOREV, this overrides at build time and do_unpack fails because it is comparing against the tag SRCREV in the recipes for sbom-cve-check-update-cvelist-native and sbom-cve-check-update-nvd-native. The failure looks like: ERROR: sbom-cve-check-update-nvd-native-2026.06.24-000003-r0 do_unpack: Bitbake Fetcher Error: FetchError("The revision the git tag 'v2026.06.24-000003' resolved to didn't match the SRCREV in use (11e62eba27133a54836b7a081d05ff96f72d879b vs bce4f8648122d68567c07df0260567592e36250b)", 'git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix=;tag=v2026.06.24-000003') where bce4f86 was the HEAD on branch 'main' at the time the build was run and 11e62eb is the tag SRCREV for v2026.06.24-000003. This has been fixed in oe-core commit: ff6f41cc6e fragments/yocto/sbom-cve-check: fix conflict with tag= However, we should probably test the fragment as part of patch review smoke tests to prevent future surprises. This would have caused the 'metrics' job to blow up, most likely, as that is the only place we currently utilize 'sbom-cve-check' in yocto-autobuilder-helper. 106380 1 randy.macleod 2026-07-30 14:33:59 +0000 Add a test that at least parse with that fragment enabled.- RP on YP bug review. 106390 2 tim.orling 2026-07-30 15:17:32 +0000 Since it fails in do_unpack, parsing alone is not sufficient.