From dc4af8bfa979beb147cdbd7523b5ade26095a0d5 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 26 Jan 2026 14:04:12 +0100 Subject: [PATCH] utils/generate-cyclonedx: use direct dependencies Since the introduction of the `generate-cyclonedx` script in [1] the dependencies were 'recursive'. This means that the dependencies of a package dependency were included. The CycloneDX spec [2] states that only direct dependencies needs to be included. This patch drop the recursive dependencies. [1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM [2] https://cyclonedx.org/docs/1.6/json/#dependencies Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- utils/generate-cyclonedx | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx index e864edf181..04ce8fc3a1 100755 --- a/utils/generate-cyclonedx +++ b/utils/generate-cyclonedx @@ -337,10 +337,9 @@ def cyclonedx_vulnerabilities(show_info_dict): } for cve, components in cves.items()] -def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]): - """Parse dependencies from the show-info output. This function will - recursively collect all dependencies, and return a list where each dependency - is stated at most once. +def br2_parse_deps(ref, show_info_dict, virtual=False): + """This function will collect all dependencies from the show-info output. + The dependency on virtual package will collect the final dependency without including the virtual one. @@ -350,18 +349,14 @@ def br2_parse_deps_recursively(ref, show_info_dict, virtual=False, deps=[]): show_info_dict (dict): The JSON output of the show-info command, parsed into a Python dictionary. - Kwargs: - deps (list): A list, to which dependencies will be appended. If set to None, - a new empty list will be created. Defaults to None. - Returns: list: A list of dependencies of the 'ref' package. """ + deps = [] + for dep in show_info_dict.get(ref, {}).get("dependencies", []): - if dep not in deps: - if virtual or show_info_dict.get(dep, {}).get("virtual") is False: - deps.append(dep) - br2_parse_deps_recursively(dep, show_info_dict, virtual, deps) + if virtual or show_info_dict.get(dep, {}).get("virtual") is False: + deps.append(dep) return deps @@ -429,7 +424,7 @@ def main(): ], "dependencies": [ cyclonedx_dependency(args.project_name, list(filtered_show_info_dict)), - *[cyclonedx_dependency(ref, br2_parse_deps_recursively(ref, show_info_dict, args.virtual)) + *[cyclonedx_dependency(ref, br2_parse_deps(ref, show_info_dict, args.virtual)) for ref in filtered_show_info_dict], ], "vulnerabilities": cyclonedx_vulnerabilities(show_info_dict),