[OE-core] RFC: exposing information about the SRC_URI(s)/branch via buildhistory (or similar mechanism)

[chris.laplante at agilent.com]

> I'd be curious to see the patches.
> It's definitely something we could use here; we used to have nightly
> build checking the build using AUTOREV as well.
> 
> On Fri, Aug 2, 2019 at 3:43 AM <Mikko.Rapeli at bmw.de> wrote:
> >
> > Hi,
> >
> > On Thu, Aug 01, 2019 at 04:51:38PM +0000, chris.laplante--- via Openembedded-core wrote:
> > <snip>
> > > I'm interesting in adding SRC_URI support to buildhistory (or a similar mechanism), and would like to get some input.
> >
> > Yes to this.
> >
> > Also would be nice if there was an easy way to add bitbake variables to
> > buildhistory.
> >
> > I've patched our tree so that SRC_URI, LICENSE and CVE_PRODUCT are archived
> > in buildhistory. SRC_URI has many uses and changes and patches can
> > be easily identified. Same with LICENSE, any changes trigger a review.
> > CVE_PRODUCT is exported so that we can do QA check to make sure mapping
> > from CVE_PRODUCT for non CLOSED licenses exists to NVD database product
> > names (maintaining a white list of recipes which don't have any CVEs yet).
> >
> > We've also changed the SDK name to be stable across builds and added
> > DISTRO to the path. In our case IMAGE_NAME and SDK_NAME will include
> > git tree tag and hash if tree is dirty, which changes buildhistory SDK paths
> > for every build with different input.
> >
> > I could submit the patches if there is interest in them.

I like the idea of including LICENSE and CVE_PRODUCT as well. I will look into to making it extensible via a variable, e.g. BUILDHISTORY_PACKAGE_EXTRA_VARIABLES or something.

Chris