utils/generate-cyclonedx: support custom schema version

Support using minor revision for CycloneDX 1.6 by passing the version
from the command line. Currently supported:

- 1.6
- 1.6.1 [1]
- 1.6.2 (default) [2]

This is used to fetch the latest SPDX license list available upstream.

[1] https://github.com/CycloneDX/specification/releases/tag/1.6.1
[2] https://github.com/CycloneDX/specification/releases/tag/1.6.2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: also rename the SPDX schema in the test]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

support/testing/tests/utils/test_generate_cyclonedx.py

@@ -21,7 +21,7 @@ class TestGenerateCycloneDX(unittest.TestCase):
 
         cyclonedx_dir = Path(self.schema_dir.name) / "cyclonedx"
         cyclonedx_dir.mkdir(parents=True)
-        schema_path = cyclonedx_dir / "spdx-1.6.schema.json"
+        schema_path = cyclonedx_dir / "spdx-1.6.2.schema.json"
         schema_path.write_text(json.dumps({"enum": SCHEMA_LICENSES}))
 
         self.env = os.environ.copy()

utils/generate-cyclonedx

@@ -22,7 +22,7 @@ import sys
 import re
 
 
-CYCLONEDX_VERSION = "1.6"
+DEFAULT_CYCLONEDX_VERSION = "1.6.2"
 
 brpath = Path(__file__).parent.parent
 
@@ -538,6 +538,9 @@ def main():
                         help="Specify the project name to use in the SBOM metadata (default:'buildroot')")
     parser.add_argument("--project-version", type=str, default=f"{BR2_VERSION_FULL}",
                         help="Specify the project version to use in the SBOM metadata (default: builroot version)")
+    parser.add_argument("--cdx-version", type=str, default=DEFAULT_CYCLONEDX_VERSION,
+                        choices=["1.6", "1.6.1", "1.6.2"],
+                        help=f"Set CycloneDX version (default: {DEFAULT_CYCLONEDX_VERSION})")
 
     args = parser.parse_args()
 
@@ -545,7 +548,7 @@ def main():
         parser.print_help()
         sys.exit(1)
 
-    SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(CYCLONEDX_VERSION))
+    SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(args.cdx_version))
     show_info_dict = json.load(args.in_file)
 
     # Remove rootfs and virtual packages if not explicitly included
@@ -553,10 +556,11 @@ def main():
     filtered_show_info_dict = {k: v for k, v in show_info_dict.items()
                                if ("rootfs" not in v["type"]) and (args.virtual or v["virtual"] is False)}
 
+    cdx_spec_version = ".".join(args.cdx_version.split(".")[:2])
     cyclonedx_dict = {
         "bomFormat": "CycloneDX",
-        "$schema": f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json",
-        "specVersion": f"{CYCLONEDX_VERSION}",
+        "$schema": f"http://cyclonedx.org/schema/bom-{cdx_spec_version}.schema.json",
+        "specVersion": cdx_spec_version,
         "metadata": {
             "component": {
                 "bom-ref": args.project_name,