mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity

utils/generate-cyclonedx: use direct dependencies

Browse Source 
Since the introduction of the `generate-cyclonedx` script in [1] the
dependencies were 'recursive'. This means that the dependencies of a
package dependency were included.

The CycloneDX spec [2] states that only direct dependencies needs to be
included.

This patch drop the recursive dependencies.

[1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] https://cyclonedx.org/docs/1.6/json/#dependencies

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Thomas Perale
2026-01-26 14:04:12 +01:00
committed by Peter Korsgaard
parent 189a983c7d
commit dc4af8bfa9
1 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
utils/generate-cyclonedx
View File

@@ -337,10 +337,9 @@ def cyclonedx_vulnerabilities(show_info_dict):
} for cve, components in cves.items()]
def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]):
"""Parse dependencies from the show-info output. This function will
recursively collect all dependencies, and return a list where each dependency
is stated at most once.
def br2_parse_deps(ref, show_info_dict, virtual=False):
"""This function will collect all dependencies from the show-info output.
The dependency on virtual package will collect the final dependency without
including the virtual one.
@@ -350,18 +349,14 @@ def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]):
show_info_dict (dict): The JSON output of the show-info
command, parsed into a Python dictionary.
Kwargs:
deps (list): A list, to which dependencies will be appended. If set to None,
a new empty list will be created. Defaults to None.
Returns:
list: A list of dependencies of the 'ref' package.
"""
deps = []
for dep in show_info_dict.get(ref, {}).get("dependencies", []):
if dep not in deps:
if virtual or show_info_dict.get(dep, {}).get("virtual") is False:
deps.append(dep)
br2_parse_deps_recursively(dep, show_info_dict, virtual, deps)
if virtual or show_info_dict.get(dep, {}).get("virtual") is False:
deps.append(dep)
return deps
@@ -429,7 +424,7 @@ def main():
],
"dependencies": [
cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)),
*[cyclonedx_dependency(ref, br2_parse_deps_recursively(ref, show_info_dict, args.virtual))
*[cyclonedx_dependency(ref, br2_parse_deps(ref, show_info_dict, args.virtual))
for ref in filtered_show_info_dict],
],
"vulnerabilities": cyclonedx_vulnerabilities(show_info_dict),