Bug 15983

Summary:	No dependency SPDX for non-image recipe with sstate
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Gianluca Andreotti <Gianluca.Andreotti>
Component:	oe-core other	Assignee:	Joshua Watt <JPEWhacker>
Status:	NEW ---	QA Contact:
Severity:	normal
Priority:	Medium	CC:	JPEWhacker, randy.macleod, ross.burton
Version:	unspecified
Target Milestone:	6.99
Hardware:	All
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Gianluca Andreotti 2025-09-29 10:05:46 UTC

When building a non-image firmware aggregation recipe that pulls in
multiple firmware components as dependencies, SPDX is only generated for
the top-level recipe once dependencies are cached in sstate.

In this case, bitbake -c build <recipe> produces only:

- recipes/recipe-<recipe>.spdx.json
- common_package/<recipe>-package-common.spdx.json
- by-spdxid-hash/ with only two links
 
No SPDX is emitted for dependencies when they are restored from sstate
(subsequent/warm builds).

On a cold build, before sstate is populated, dependency SPDX are
generated as expected.

Workaround:

  bitbake <recipe> --runall do_create_spdx
  bitbake <recipe> --runall do_create_packaged_spdx

This forces SPDX generation across the dependency tree, filling both recipes/
and packages/ directory.

Expected:

SPDX should be generated for the recipe and all of its dependencies,
similar to building an image (e.g. core-image-minimal), without needing
--runall, even when dependencies are retrieved from sstate.

Comment 1 Randy MacLeod 2025-10-02 14:48:57 UTC

Joshua has a patch to generate the combined SPDX for a single recipe 
rather than an image. This should probably be opt-in rather than default.

Comment 2 Ross Burton 2025-10-02 15:02:53 UTC

Quoting from Josh in private chat:

"Ya that's expected behavior currently. The package spdx would only be pulled in by an image recipe currently"

Two alternatives:
1) If separated SPDX files are acceptable then --runall is a good workaround, and the missing dependency to ensure that do_build causes do_create_spdx to run recursively is simple.

2) If the actual need is a combined SPDX (as you get with images currently), then Josh does have some WIP to allow this to happen for any recipe, not just images.

Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX?

Comment 3 Gianluca Andreotti 2025-10-02 16:38:45 UTC

> Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX?

A combined SPDX would be preferable.