mirror of
git://code.qt.io/qt/qt5.git
synced 2026-10-19 13:38:15 +08:00
Joerg Bornemann
7776c20e0d
Walk an installed vcpkg tree, convert each port's SPDX document into a qt_attribution.json next to it, and write an index mapping installed library paths to port names. Qt's SBOM machinery reads qt_attribution.json, so this gets license and provenance information for vcpkg provided third party libraries into Qt's SBOM without duplicating that data in Qt repositories. Ports that install nothing outside share/ and tools/ are skipped. They are metaports that exist only to depend on other ports, can never be linked, and are also the only ports whose license metadata is unusable. Filtering on that rather than on a missing license keeps a real library with broken metadata visible, which is the case that must not be hidden. The index exists because a MODULE mode find_package sets no <Package>_DIR to resolve, and because the vcpkg install database is not shipped in the developer archives. Its keys are relative to the prefix, so the same file serves both the vcpkg installed tree and the flattened archive. A port whose .list file is missing still gets an attribution file, since emitting nothing would hide a real library. A missing install database directory, by contrast, is fatal: it would silently disable the whole feature for every port. Task-number: QTBUG-150865 Change-Id: I6383169ee321cd88dfe90477e92aa071448c4d6d Reviewed-by: Alexandru Croitor <[email protected]>