From af55c1a39b34a4359edf9cc6f65244ff6a0738ee Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 29 May 2026 17:06:29 +0200 Subject: [PATCH] support/scripts/cve-check: remove 'bom-ref' for vulnerabilities The 'bom-ref' are optional and since we don't reference the vulnerabilities from anywhere else in the SBOM they are not necessary in this case. In the following commit, cve-check will potentially emit multiple vulnerabilities that have the same id. So using the vulnerability id as 'bom-ref' won't be correct as the 'bom-ref' needs to be unique unlike the id property. Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni --- support/scripts/cve-check | 1 - 1 file changed, 1 deletion(-) diff --git a/support/scripts/cve-check b/support/scripts/cve-check index 0d0ad833a2..4d01fa5f23 100755 --- a/support/scripts/cve-check +++ b/support/scripts/cve-check @@ -147,7 +147,6 @@ def nvd_cve_to_cdx_vulnerability(nvd_cve): [1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities """ vulnerability = { - "bom-ref": nvd_cve["id"], "id": nvd_cve["id"], "description": cve_api_get_lang_from_list(nvd_cve.get("descriptions", [])) or "", "source": {