I noticed that in recent Toradex BSP 7.5.0, there is the bbclass to build SBOM in the format SPDX v3.0.
We want to use that for our image (for Colibri-IMX8x), but the whole thing has 2 issues, where 1 of them is likely toradex specific:
I add this configuration to my local.conf:
INHERIT:remove = “create-spdx”
INHERIT:append = " create-spdx-3.0 "
Issue 1 (Likely Toradex specific):
When building linux-toradex, the function do_populate_lic fails.
WARNING: linux-toradex-6.6+git-r0 do_populate_lic: Could not copy license file /home/xxx…/build/tmp/work/nox_imx8x-tdx-linux/linux-toradex/6.6+git/git/COPYING to /home/xxx…/build/tmp/work/nox_imx8x-tdx-linux/linux-toradex/6.6+git/license-destdir/nox_imx8x/linux-toradex/COPYING: [Errno 2] No such file or directory: ‘/home/xxx…/build/tmp/work/nox_imx8x-tdx-linux/linux-toradex/6.6+git/git/COPYING’
ERROR: linux-toradex-6.6+git-r0 do_populate_lic: QA Issue: linux-toradex: LIC_FILES_CHKSUM points to an invalid file: /home/xxx…/build/tmp/work/nox_imx8x-tdx-linux/linux-toradex/6.6+git/git/COPYING [license-checksum]
ERROR: linux-toradex-6.6+git-r0 do_populate_lic: Fatal QA errors were found, failing task.
ERROR: Logfile of failure stored in: /home/xxx…/build/tmp/work/nox_imx8x-tdx-linux/linux-toradex/6.6+git/temp/log.do_populate_lic.3602930
ERROR: Task (/home/xxx…/build/../layers/meta-toradex-nxp/recipes-kernel/linux/linux-toradex_6.6-2.2.x.bb:do_populate_lic) failed with exit code ‘1’
This is likely becausedo_create_spdx seems to move the source from ../git to ../spdx/3.0.1/work/git
I was able to workaround this adding this to my .bbappend:
python do_populate_lic:prepend() {
import os, glob
s = d.getVar('S')
copying = os.path.join(s, 'COPYING')
if not os.path.exists(copying):
pattern = os.path.join(d.getVar('WORKDIR'), 'spdx', '*', 'work', 'git', 'COPYING')
matches = glob.glob(pattern)
if matches:
spdx_git = os.path.dirname(matches[0])
bb.warn(f"do_populate_lic: {s} is empty, symlinking from {spdx_git}")
if os.path.islink(s):
os.remove(s)
elif os.path.isdir(s):
os.rmdir(s)
os.symlink(spdx_git, s)
else:
bb.warn(f"do_populate_lic: {s} is empty and no spdx source found either!")
}
This is only a workaround, IMO there should be a proper fix addressing this.
Issue 2:
It seems that do_create_spdx consumes a lot more memory for 3.0 than for 2.2.
We are using a Ryzen 5900X with 64GB of RAM as a build server, so we build on 24Threads. When the SPDX is generated, we run out of memory quickly and have to restart the build several times to complete it. I can see the amount of RAM beeing used growing steady from ~2GB to almost full, then the processes in yocto start to fail with error 137.
Example:
ERROR: Task (/home/xxx.../build/../layers/openembedded-core/meta/recipes-bsp/u-boot/libubootenv_0.3.5.bb:do_create_spdx) failed with exit code ‘137’
After that, no more processes are spawned/build is soft-cancelled, and if the others complete, the RAM usage goes down again.
Not sure if this is expected to happen with SPDX 3.0, AI suggested that it consumes way more memory than generating SPDX 2.2?
Is anyone able to reproduce this two issues?
Thanks and regards,
Simon
