mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-09 17:03:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

utils/generate-cyclonedx: remove indirect dependencies from root component

Browse Source 
Commit dc4af8bfa9 ("utils/generate-cyclonedx: use direct dependencies")
removes indirect dependencies from any listed component, as required by
CycloneDX. The root component, however, still includes indirect dependencies,
as it just takes the components from the show-info output.

Fix this by collecting all component dependencies, and then filter the root
component dependencies to include direct dependencies only.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit cc41cc3fcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Martin Willi
2026-04-09 10:13:57 +02:00
committed by Thomas Perale
parent 8745d88263
commit bc790abf4e
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
support/testing/tests/utils/test_generate_cyclonedx.py
View File

@@ -129,6 +129,9 @@ class TestGenerateCycloneDX(unittest.TestCase):
bar_deps = next(d for d in result["dependencies"] if d["ref"] == "package-bar")
self.assertEqual(bar_deps["dependsOn"], ["package-foo"])
project_deps = next(d for d in result["dependencies"] if d["ref"] == "buildroot")
self.assertEqual(project_deps["dependsOn"], ["host-tool", "package-foo"])
def test_virtual(self):
result = self._run_script(["--virtual"])

21
utils/generate-cyclonedx
View File

@@ -385,6 +385,25 @@ def br2_parse_deps(ref, show_info_dict, virtual=False) -> list:
return list(deps)
def br2_root_deps(show_info_dict, virtual=False) -> list:
"""Retrieve the list of direct dependencies of the root component.
This function returns all components that are not a dependency of any
other component.
Args:
show_info_dict (dict): The JSON output of the show-info command.
virtual (bool): Whether to resolve virtual dependencies to their providers.
Returns:
list: List of direct dependencies of the root component.
"""
indirect = set()
for ref in show_info_dict:
indirect.update(br2_parse_deps(ref, show_info_dict, virtual))
return [ref for ref in show_info_dict if ref not in indirect]
def main():
parser = argparse.ArgumentParser(
description='''Create a CycloneDX SBoM for the Buildroot configuration.
@@ -447,7 +466,7 @@ def main():
cyclonedx_component(name, comp) for name, comp in filtered_show_info_dict.items()
],
"dependencies": [
cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)),
cyclonedx_dependency(args.project_name, br2_root_deps(filtered_show_info_dict, args.virtual)),
*[cyclonedx_dependency(ref, br2_parse_deps(ref, show_info_dict, args.virtual))
for ref in filtered_show_info_dict],
],