From 504bb61bc68dabc6d0124901c8e5bec1aa93dc32 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 24 Jun 2026 12:13:37 +0200 Subject: [PATCH] utils/generate-cyclonedx: support custom schema version Support using minor revision for CycloneDX 1.6 by passing the version from the command line. Currently supported: - 1.6 - 1.6.1 [1] - 1.6.2 (default) [2] This is used to fetch the latest SPDX license list available upstream. [1] https://github.com/CycloneDX/specification/releases/tag/1.6.1 [2] https://github.com/CycloneDX/specification/releases/tag/1.6.2 Signed-off-by: Thomas Perale [Arnout: also rename the SPDX schema in the test] Signed-off-by: Arnout Vandecappelle --- .../testing/tests/utils/test_generate_cyclonedx.py | 2 +- utils/generate-cyclonedx | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/support/testing/tests/utils/test_generate_cyclonedx.py b/support/testing/tests/utils/test_generate_cyclonedx.py index b91add2349..4ecd90e347 100644 --- a/support/testing/tests/utils/test_generate_cyclonedx.py +++ b/support/testing/tests/utils/test_generate_cyclonedx.py @@ -21,7 +21,7 @@ class TestGenerateCycloneDX(unittest.TestCase): cyclonedx_dir = Path(self.schema_dir.name) / "cyclonedx" cyclonedx_dir.mkdir(parents=True) - schema_path = cyclonedx_dir / "spdx-1.6.schema.json" + schema_path = cyclonedx_dir / "spdx-1.6.2.schema.json" schema_path.write_text(json.dumps({"enum": SCHEMA_LICENSES})) self.env = os.environ.copy() diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index 290c3f96e5..a60c8e9526 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -22,7 +22,7 @@ import sys import re -CYCLONEDX_VERSION = "1.6" +DEFAULT_CYCLONEDX_VERSION = "1.6.2" brpath = Path(__file__).parent.parent @@ -538,6 +538,9 @@ def main(): help="Specify the project name to use in the SBOM metadata (default:'buildroot')") parser.add_argument("--project-version", type=str, default=f"{BR2_VERSION_FULL}", help="Specify the project version to use in the SBOM metadata (default: builroot version)") + parser.add_argument("--cdx-version", type=str, default=DEFAULT_CYCLONEDX_VERSION, + choices=["1.6", "1.6.1", "1.6.2"], + help=f"Set CycloneDX version (default: {DEFAULT_CYCLONEDX_VERSION})") args = parser.parse_args() @@ -545,7 +548,7 @@ def main(): parser.print_help() sys.exit(1) - SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(CYCLONEDX_VERSION)) + SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(args.cdx_version)) show_info_dict = json.load(args.in_file) # Remove rootfs and virtual packages if not explicitly included @@ -553,10 +556,11 @@ def main(): filtered_show_info_dict = {k: v for k, v in show_info_dict.items() if ("rootfs" not in v["type"]) and (args.virtual or v["virtual"] is False)} + cdx_spec_version = ".".join(args.cdx_version.split(".")[:2]) cyclonedx_dict = { "bomFormat": "CycloneDX", - "$schema": f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json", - "specVersion": f"{CYCLONEDX_VERSION}", + "$schema": f"http://cyclonedx.org/schema/bom-{cdx_spec_version}.schema.json", + "specVersion": cdx_spec_version, "metadata": { "component": { "bom-ref": args.project_name,