utils/generate-cyclonedx: remove indirect dependencies from root component

Commit dc4af8bfa9 ("utils/generate-cyclonedx: use direct dependencies")
removes indirect dependencies from any listed component, as required by
CycloneDX. The root component, however, still includes indirect dependencies,
as it just takes the components from the show-info output.

Fix this by collecting all component dependencies, and then filter the root
component dependencies to include direct dependencies only.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit cc41cc3fcd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Martin Willi
2026-04-09 10:13:57 +02:00
committed by Thomas Perale
parent 8745d88263
commit bc790abf4e
2 changed files with 23 additions and 1 deletions

View File

@@ -129,6 +129,9 @@ class TestGenerateCycloneDX(unittest.TestCase):
bar_deps = next(d for d in result["dependencies"] if d["ref"] == "package-bar")
self.assertEqual(bar_deps["dependsOn"], ["package-foo"])
project_deps = next(d for d in result["dependencies"] if d["ref"] == "buildroot")
self.assertEqual(project_deps["dependsOn"], ["host-tool", "package-foo"])
def test_virtual(self):
result = self._run_script(["--virtual"])