SPDX generation does not seem to work according to the documentation

[tijsmoree]

Describe the bug

The documentation states that for SPDX generation, we have to do the following (in case of the hello_world project):

• west spdx -i -d BUILD_DIR/hello_world
• west build -d BUILD_DIR/hello_world
• west spdx -d BUILD_DIR/hello_world

With a pristine project (without the BUILD_DIR folder present), this does not work, because the third command errors without BUILD_DIR/CMakeCache.txt. I solved this issue by changing the second command to west build -d BUILD_DIR --domain hello_world instead.

Another problem I encountered, is that running west build -p will undo the west spdx -i. This means that running a pristine build negates the necessary precommand to enable SPDX file generation. I ran into this problem when I used the VSCode nRF Connect Add Build Configuration button and wanted to generate SPDX files afterwards by running west spdx -i and then rebuilding it. However, it does not rebuild, because it knows nothing changed, forcing me to build "pristinely", which also does not result in a build folder that can be used to generate SPDX files, because the west spdx -i was undone.

Regression

• This is a regression.

Steps to reproduce

Open the hello_world example in nRF Connect SDK v2.8.0 (and remove the build folder if it exists), add the CONFIG_BUILD_OUTPUT_META=y configuration to the prj.conf file and run:

• west spdx -i -d build/hello_world
• west build -d build/hello_world --board nrf52840dk/nrf52840
• west spdx -d build/hello_world

Relevant log output

parsing CMake Cache file
ERROR: CONFIG_BUILD_OUTPUT_META must be enabled to generate spdx files; bailing
ERROR: SPDX walker failed; bailing

Impact

Annoyance – Minor irritation; no significant impact on usability or functionality.

Environment

• Linux
• Zephyr SDK v3.7.99-ncs1
• nRF Connect SDK v2.8.0
• nRF Connect SDK Toolchain v2.8.0

Additional Context

No response

[github-actions]

Hi @tijsmoree! We appreciate you submitting your first issue for our open-source project. 🌟

Even though I'm a bot, I can assure you that the whole community is genuinely grateful for your time and effort. 🤖💙

[henrikbrixandersen]

Thank you for reporting this. However - unless you are able to reproduce this issue with upstream Zephyr main - please report issues with the nRF Connect SDK (NCS) on the Nordic Semiconductor DevZone.

Please reopen this issue if you are able to reproduce it with upstream Zephyr main.

[kartben]

@tijsmoree you missed step #2 :)

https://docs.zephyrproject.org/latest/develop/west/zephyr-cmds.html#software-bill-of-materials-west-spdx

[tijsmoree]

@kartben Oh, I actually did not forget adding the CONFIG_BUILD_OUTPUT_META step, that was not the problem here. I did forget to add the step in my reproduction description. Edited!

[kartben]

@tijsmoree As mentioned, it seems you're errors are likely due to NCS. Following Zephyr instructions to the letter for hello world would work just fine.

west spdx --init -d BUILD_DIR
west build -d BUILD_DIR samples/hello_world -b nrf52840dk/nrf52840 -- -DCONFIG_BUILD_OUTPUT_META=y
west spdx -d BUILD_DIR

[tijsmoree]

@kartben Okay, I'm assuming NCS changes the folder structure a bit then, which causes the Zephyr documentation to not work exactly for NCS projects regarding the SPDX generation. My bad!

The other "problem" I mentioned does still persist, I guess. Running west build --pristine ... will undo the west spdx -i ... command. I don't know whether this is desired?

[kartben]

The other "problem" I mentioned does still persist, I guess. Running west build --pristine ... will undo the west spdx -i ... command. I don't know whether this is desired?

That's the whole point of pristine :) If you nuke the build folder (pristine), then it kind of make sense you'd need to init the spdx stuff again, right?

[tijsmoree]

Haha okay, fair enough. However, I feel this only makes sense now, because we actually need to run an initialization command for the SPDX generation. If the west spdx -i ... wasn't necessary, we could happily run a pristine build and generate an SPDX afterwards!

I have no idea how this all works, so this might be dumb, but maybe it's possible to automatically "run" the west spdx -i ... command if CONFIG_BUILD_OUTPUT_META is enabled?