On 31 Mar 2026, at 16:13, Marta Rybczynska <[email protected]> wrote: > On Tue, Mar 31, 2026 at 5:05 PM Ross Burton <[email protected]> wrote: > On 31 Mar 2026, at 15:43, Marta Rybczynska via lists.openembedded.org > <[email protected]> wrote: > > For the record, I do not agree with this removal. SPDX3 has still not > > reached mature usage outside of the LF ecosystem. > > Is there an ecosystem of tooling that uses the Yocto-specific JSON format > that vex.bbclass generates? > > Yes there are tools that support YP cve-check JSON format as input and, by > extension, they can use the vex.bbclass too. > > Not sure how many of them want to manifest, this is usually internal tooling.
IMHO, if these users don’t want to move to SPDX, then they can copy the vex.bbclass from current master into their distro. Ross
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#234301): https://lists.openembedded.org/g/openembedded-core/message/234301 Mute This Topic: https://lists.openembedded.org/mt/118596049/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
