From d8d02d28fb64f69e97d2169740687f761f93667f Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 24 Jun 2026 12:13:35 +0200 Subject: [PATCH] utils/generate-cyclonedx: mark host packages as excluded Mark Buildroot's host packages as 'excluded' with the scope property [1]. The excluded scope is defined like the following: > Components that are excluded provide the ability to document component > usage for test and other non-runtime purposes. Excluded components are > not reachable within a call graph at runtime. This fits the usage of 'host' packages : a package without a runtime purpose. See the mailing list discussion around this property [2][3][4][5] [1] https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_scope [2] https://lore.kernel.org/r/ [3] https://lore.kernel.org/r/<20260409204208.302842-1-thomas.perale@mind.be> [4] https://lore.kernel.org/r/ [5] https://lore.kernel.org/r/<176c5c42-50bc-4b39-a7b3-845b085f010e@rnout.be> Signed-off-by: Thomas Perale Reviewed-by: Quentin Schulz Signed-off-by: Arnout Vandecappelle --- utils/generate-cyclonedx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index 098f62bf2c..44b9b80847 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -371,6 +371,9 @@ def cyclonedx_component(name, comp): return { "bom-ref": name, "type": "library", + **({ + "scope": "excluded" + } if comp["type"] == "host" else {}), **({ "name": comp["name"], } if "name" in comp else {}),