mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

utils/generate-cyclonedx: use direct dependencies

Browse Source 
Since the introduction of the `generate-cyclonedx` script in [1] the
dependencies were 'recursive'. This means that the dependencies of a
package dependency were included.

The CycloneDX spec [2] states that only direct dependencies needs to be
included.

This patch drop the recursive dependencies.

[1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] https://cyclonedx.org/docs/1.6/json/#dependencies

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Thomas Perale
2026-01-26 14:04:12 +01:00
committed by Peter Korsgaard
parent 189a983c7d
commit dc4af8bfa9
1 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
utils/generate-cyclonedx
View File

@@ -337,10 +337,9 @@ def cyclonedx_vulnerabilities(show_info_dict):
} for cve, components in cves.items()] } for cve, components in cves.items()]
def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]): def br2_parse_deps(ref, show_info_dict, virtual=False):
"""Parse dependencies from the show-info output. This function will """This function will collect all dependencies from the show-info output.
recursively collect all dependencies, and return a list where each dependency
is stated at most once.
The dependency on virtual package will collect the final dependency without The dependency on virtual package will collect the final dependency without
including the virtual one. including the virtual one.
@@ -350,18 +349,14 @@ def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]):
show_info_dict (dict): The JSON output of the show-info show_info_dict (dict): The JSON output of the show-info
command, parsed into a Python dictionary. command, parsed into a Python dictionary.
Kwargs:
deps (list): A list, to which dependencies will be appended. If set to None,
a new empty list will be created. Defaults to None.
Returns: Returns:
list: A list of dependencies of the 'ref' package. list: A list of dependencies of the 'ref' package.
""" """
deps = []
for dep in show_info_dict.get(ref, {}).get("dependencies", []): for dep in show_info_dict.get(ref, {}).get("dependencies", []):
if dep not in deps: if virtual or show_info_dict.get(dep, {}).get("virtual") is False:
if virtual or show_info_dict.get(dep, {}).get("virtual") is False: deps.append(dep)
deps.append(dep)
br2_parse_deps_recursively(dep, show_info_dict, virtual, deps)
return deps return deps
@@ -429,7 +424,7 @@ def main():
], ],
"dependencies": [ "dependencies": [
cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)), cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)),
*[cyclonedx_dependency(ref, br2_parse_deps_recursively(ref, show_info_dict, args.virtual)) *[cyclonedx_dependency(ref, br2_parse_deps(ref, show_info_dict, args.virtual))
for ref in filtered_show_info_dict], for ref in filtered_show_info_dict],
], ],
"vulnerabilities": cyclonedx_vulnerabilities(show_info_dict), "vulnerabilities": cyclonedx_vulnerabilities(show_info_dict),