From: Tim Orling Date: Thu, 23 Jul 2026 20:48:31 +0000 (-0700) Subject: fragments/yocto/sbom-cve-check: fix conflict with tag= X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=ff6f41cc6e951198d928ea935f2b796cd9d2cf21;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git fragments/yocto/sbom-cve-check: fix conflict with tag= Fixes: 00864cf5bc meta: Add tag in SRC_URI to multiple recipes When this fragment is enabled, SRCREV is set to AUTOREV, but this then causes do_unpack to fail for both sbom-cve-check-update-cvelist-native and sbom-cve-check-update-nvd-native, since the tag SRCREV does not match with the 'main' HEAD AUTOREV. Rather than allow the tag to float, for those that desire reproducible builds with just IMAGES_CLASSES:append = " sbom-cve-check" and not this fragment, set SRC_URI **without** the tag= in this fragment. Signed-off-by: Tim Orling Signed-off-by: Richard Purdie --- diff --git a/meta/conf/fragments/yocto/sbom-cve-check.conf b/meta/conf/fragments/yocto/sbom-cve-check.conf index 73ed35be270..46f6965a0d5 100644 --- a/meta/conf/fragments/yocto/sbom-cve-check.conf +++ b/meta/conf/fragments/yocto/sbom-cve-check.conf @@ -13,6 +13,9 @@ IMAGE_CLASSES:append = " sbom-cve-check" SRCREV:pn-sbom-cve-check-update-nvd-native = "${AUTOREV}" SRCREV:pn-sbom-cve-check-update-cvelist-native = "${AUTOREV}" +# Drop the tag= or else do_unpack fails +SRC_URI:pn-sbom-cve-check-update-cvelist-native = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix=" +SRC_URI:pn-sbom-cve-check-update-nvd-native = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix=" SPDX_INCLUDE_VEX = "all" SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"