fragments/yocto/sbom-cve-check: fix conflict with tag=

Fixes: 00864cf5bc meta: Add tag in SRC_URI to multiple recipes
When this fragment is enabled, SRCREV is set to AUTOREV, but this then
causes do_unpack to fail for both sbom-cve-check-update-cvelist-native
and sbom-cve-check-update-nvd-native, since the tag SRCREV does not
match with the 'main' HEAD AUTOREV.

Rather than allow the tag to float, for those that desire reproducible
builds with just IMAGES_CLASSES:append = " sbom-cve-check" and not
this fragment, set SRC_URI **without** the tag= in this fragment.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/conf/fragments/yocto/sbom-cve-check.conf b/meta/conf/fragments/yocto/sbom-cve-check.conf
index 73ed35be270ebb30483b3203b102c8646c460463..46f6965a0d592ba5cfce3bd3c2133c4a9a40bf09 100644 (file)
--- a/meta/conf/fragments/yocto/sbom-cve-check.conf
+++ b/meta/conf/fragments/yocto/sbom-cve-check.conf
@@ -13,6 +13,9 @@ IMAGE_CLASSES:append = " sbom-cve-check"
 
 SRCREV:pn-sbom-cve-check-update-nvd-native = "${AUTOREV}"
 SRCREV:pn-sbom-cve-check-update-cvelist-native = "${AUTOREV}"
+# Drop the tag= or else do_unpack fails
+SRC_URI:pn-sbom-cve-check-update-cvelist-native = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
+SRC_URI:pn-sbom-cve-check-update-nvd-native = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 
 SPDX_INCLUDE_VEX = "all"
 SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"