From 189a983c7d8f1d24310bd9e142dbc950f86863b8 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 26 Jan 2026 14:04:11 +0100 Subject: [PATCH] utils/generate-cyclonedx: fix 'project' dependency The definition of the project name & version is stored under the `metadata:component` CycloneDX property. Since the introduction of the `generate-cyclonedx` script [1] a 'buildroot' dependency entry that depends on every components has been part of the generated SBOM. Tools such as 'DependencyTrack' relies on such entry to create graph of the entire project. With the commit [2] that introduced the option to pass a custom project name and version, this dependency reference was not updated to match the custom 'bom-ref'. This patch fixes the reference to match the custom project name. [1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM [2] 9cbbc47762 utils/generate-cyclonedx: add project name and version options Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- utils/generate-cyclonedx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index a103b7b707..e864edf181 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -428,7 +428,7 @@ def main(): cyclonedx_component(name, comp) for name, comp in filtered_show_info_dict.items() ], "dependencies": [ - cyclonedx_dependency("buildroot", list(filtered_show_info_dict)), + cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)), *[cyclonedx_dependency(ref, br2_parse_deps_recursively(ref, show_info_dict, args.virtual)) for ref in filtered_show_info_dict], ],