When building a non-image firmware aggregation recipe that pulls in multiple firmware components as dependencies, SPDX is only generated for the top-level recipe once dependencies are cached in sstate. In this case, bitbake -c build <recipe> produces only: - recipes/recipe-<recipe>.spdx.json - common_package/<recipe>-package-common.spdx.json - by-spdxid-hash/ with only two links No SPDX is emitted for dependencies when they are restored from sstate (subsequent/warm builds). On a cold build, before sstate is populated, dependency SPDX are generated as expected. Workaround: bitbake <recipe> --runall do_create_spdx bitbake <recipe> --runall do_create_packaged_spdx This forces SPDX generation across the dependency tree, filling both recipes/ and packages/ directory. Expected: SPDX should be generated for the recipe and all of its dependencies, similar to building an image (e.g. core-image-minimal), without needing --runall, even when dependencies are retrieved from sstate.
Joshua has a patch to generate the combined SPDX for a single recipe rather than an image. This should probably be opt-in rather than default.
Quoting from Josh in private chat: "Ya that's expected behavior currently. The package spdx would only be pulled in by an image recipe currently" Two alternatives: 1) If separated SPDX files are acceptable then --runall is a good workaround, and the missing dependency to ensure that do_build causes do_create_spdx to run recursively is simple. 2) If the actual need is a combined SPDX (as you get with images currently), then Josh does have some WIP to allow this to happen for any recipe, not just images. Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX?
> Gianluca: are individual SPDX files acceptable, or would you prefer a combined SPDX? A combined SPDX would be preferable.