mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-27 19:22:55 -09:00
03e9ac7d9c
Add test for CycloneDX vulnerability generation. If multiple packages ignore the same vulnerability but provide different analyses, the generator must produce multiple vulnerability entries with the same vulnerability ID but different analysis information. This situation can occur when generating a CycloneDX SBOM from the output of 'make show-info-all'. The resulting SBOM includes packages that exist in multiple versions within Buildroot (gnupg for instance). In such a case, one package version may ignore a vulnerability because it is not affected, while another package version may address it through a patch. Therefore, multiple vulnerability entries must be generated, each with its own analysis and reference information. This adds a test case for this scenario. Signed-off-by: Thomas Perale <thomas.perale@mind.be> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> [Arnout: give next() a None default to return None instead of raise StopIteration] Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>