From 074e650219f98357fe051f82e9fbfe007851a865 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 24 Jun 2026 12:13:34 +0200 Subject: [PATCH] utils/generate-cyclonedx: add "id" property to resolves The CycloneDX spec defines the "components.pedigree.patches.resolves" object [1] as supporting both a "name" & "id" property. The definition provided for the "id" property is the following [2]: > The identifier of the issue assigned by the source of the issue And for the "name" property [3]: > The name of the issue The "resolves" object was introduced in commit [4] and only used the "name" property to link to the vulnerability it resolves. In example [5] provided on the CycloneDX website, both the "name" & "id" properties are set in the security example. In the vulnerability context, and more precisely the CVEs, the "name" and the "id" are the same and thus the value can be duplicated across the two properties. This commit replicates the behavior documented in [5] to improve compatibility with tools. [1] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves [2] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_id [3] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_name [4] 9415529923 utils/generate-cyclonedx: add support for 'resolved_with_pedigree' [5] https://cyclonedx.org/use-cases/pedigree/ Signed-off-by: Thomas Perale Reviewed-by: Quentin Schulz Signed-off-by: Arnout Vandecappelle --- utils/generate-cyclonedx | 1 + 1 file changed, 1 insertion(+) diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index 45f9682da6..098f62bf2c 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -233,6 +233,7 @@ def cyclonedx_patches(patch_list: list[str]): "resolves": [ { "type": "security", + "id": cve, "name": cve } for cve in cves ]