diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index 04ce8fc3a1..2b6c6d63d3 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -337,7 +337,25 @@ def cyclonedx_vulnerabilities(show_info_dict): } for cve, components in cves.items()] -def br2_parse_deps(ref, show_info_dict, virtual=False): +def br2_virtual_is_provided_by(ref, show_info_dict) -> list: + """Retrieve the list of packages that provide a virtual package. + + Args: + ref (str): The identifier of the virtual package. + show_info_dict (dict): The JSON output of the show-info + command, parsed into a Python dictionary. + + Returns: + list: package list that provides the virtual package. + """ + return [ + name + for name, comp in show_info_dict.items() + if "provides" in comp and ref in comp["provides"] + ] + + +def br2_parse_deps(ref, show_info_dict, virtual=False) -> list: """This function will collect all dependencies from the show-info output. The dependency on virtual package will collect the final dependency without @@ -352,13 +370,15 @@ def br2_parse_deps(ref, show_info_dict, virtual=False): Returns: list: A list of dependencies of the 'ref' package. """ - deps = [] + deps = set() for dep in show_info_dict.get(ref, {}).get("dependencies", []): - if virtual or show_info_dict.get(dep, {}).get("virtual") is False: - deps.append(dep) + if not virtual and show_info_dict.get(dep, {}).get("virtual"): + deps.update(br2_virtual_is_provided_by(dep, show_info_dict)) + else: + deps.add(dep) - return deps + return list(deps) def main():