Skip to content

west spdx does not produce valid SBOMs for native_sim #91785

@kartben

Description

@kartben

Describe the bug

It would appear that native_sim is maybe a bit special in that it doesn't has a zephyr_final CMake target, which prevent the SPDX tooling to generate a valid SBOM for it does not know what the "main" target is (it's expecting it to be zephyr_final) and there does not include the quite important "Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-zephyr-final" entry in the resulting SBOM.

Flagging as "annoyance" given it's reasonably easy to build with another emulated target if one is only interested in a general evaluation of SPDX support in Zephyr with no particular ties to a given hardware target (and the dependencies it may be pulling).

Regression

  • This is a regression.

Steps to reproduce

  1. west spdx --init -d BUILD_DIR
  2. west build -d BUILD_DIR samples/hello_world -b native_sim -- -DCONFIG_BUILD_OUTPUT_META=y
  3. west spdx -d BUILD_DIR --spdx-version 2.2

Notice how while generation is not failing, the build.spdx file is missing an Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-zephyr-final entry.

Relevant log output

Impact

Annoyance – Minor irritation; no significant impact on usability or functionality.

Environment

macOS
SDK 0.17.1
main @d4758f02b18b9261c0b98df244ff0bad7e824551

Additional Context

zephyr/CMakeLists.txt

Lines 53 to 54 in 8ab712a

# When only a single linking stage is required, the `zephyr_pre0` will be mapped
# into the `zephyr_final` target.
seems to indicate zephyr_final should exist even for native_sim, but this doesn't seem to be the case. zephyr_pre0 is there though.

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions