utils/generate-cyclonedx: remove indirect dependencies from root component

Commit dc4af8bfa9 ("utils/generate-cyclonedx: use direct dependencies")
removes indirect dependencies from any listed component, as required by
CycloneDX. The root component, however, still includes indirect dependencies,
as it just takes the components from the show-info output.

Fix this by collecting all component dependencies, and then filter the root
component dependencies to include direct dependencies only.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This commit is contained in:
Martin Willi
2026-04-09 10:13:57 +02:00
committed by Arnout Vandecappelle
parent 929e7cb005
commit cc41cc3fcd
2 changed files with 23 additions and 1 deletions

View File

@@ -129,6 +129,9 @@ class TestGenerateCycloneDX(unittest.TestCase):
bar_deps = next(d for d in result["dependencies"] if d["ref"] == "package-bar")
self.assertEqual(bar_deps["dependsOn"], ["package-foo"])
project_deps = next(d for d in result["dependencies"] if d["ref"] == "buildroot")
self.assertEqual(project_deps["dependsOn"], ["host-tool", "package-foo"])
def test_virtual(self):
result = self._run_script(["--virtual"])