Re: [PATCH v2 00/14] Add SPDX SBOM generation tool

[Luis Augenstein <luis.augenstein@tngtech.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1520 bytes --]

Hi Nathan,

> 2. This depends on having a clean initial build tree (either empty
>    directory or 'clean' as a make target) due to needing to parse the
>    .cmd files, which could be stale if someone builds a kernel, changes
>    their config, and rebuilds, right? This should be documented since I
>    do not think it is possible to do something like what Masahiro did in
>    commit 3d32285fa995 ("kbuild: wire up the build rule of
>    compile_commands.json to Makefile") because of the drawback that it
>    misses too many things.

There might be edge cases, but in general stale .cmd files should not be
an issue.

The script does not scan the build tree for .cmd files. It starts from a
set of root build artifacts (kernel image and .ko modules listed in
modules.order). From these roots, it parses the corresponding .cmd files
to discover the immediate dependencies, and then recursively processes
the .cmd files of those dependencies, effectively walking the entire
dependency graph up to the individual source files.

Stale .cmd files should not be referenced as dependencies by the root
artifacts and therefore not be part of the resulting dependency graph.

Best,
Luis

-- 
Luis Augenstein * luis.augenstein@tngtech.com * +49-152-25275761
TNG Technology Consulting GmbH, Beta-Str. 13, 85774 Unterföhring
Geschäftsführer: Henrik Klagges, Dr. Robert Dahlke, Thomas Endres
Aufsichtsratsvorsitzender: Christoph Stock
Sitz: Unterföhring * Amtsgericht München * HRB 135082

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3207 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]