Re: [Buildroot] [PATCH 6/9] utils/generate-cyclonedx: support custom version

Hi Thomas,

On 6/24/26 12:13 PM, Thomas Perale wrote:
> Support using minor revision for CycloneDX 1.6 by passing the version
> from the command line. Currently supported:
> 
> - 1.6
> - 1.6.1 [1]
> - 1.6.2 (default) [2]
> 
> This is used to fetch the latest SPDX license list available upstream.
> 

Yeah it's kinda confusing to use the CycloneDX version to fetch 
something that's very little related to it (SPDX license list). I'm not 
even sure if it is actually required by the CycloneDX spec to use a 
specific version of the SPDX license list? Like I wouldn't understand 
why it needs to be a specific version, it's a list of SPDX-supported 
license, there's nothing that should break 
backward/forward-compatibility no?

> [1] https://github.com/CycloneDX/specification/releases/tag/1.6.1
> [2] https://github.com/CycloneDX/specification/releases/tag/1.6.2
> 
> Signed-off-by: Thomas Perale <[email protected]>
> ---
>   utils/generate-cyclonedx | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index 9738db71d6..8d055c3bbd 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -22,7 +22,7 @@ import sys
>   import re
>   
>   
> -CYCLONEDX_VERSION = "1.6"
> +DEFAULT_CYCLONEDX_VERSION = "1.6.2"
>   
>   brpath = Path(__file__).parent.parent
>   
> @@ -538,6 +538,9 @@ def main():
>                           help="Specify the project name to use in the SBOM metadata (default:'buildroot')")
>       parser.add_argument("--project-version", type=str, default=f"{BR2_VERSION_FULL}",
>                           help="Specify the project version to use in the SBOM metadata (default: builroot version)")
> +    parser.add_argument("--cdx-version", type=str, default=DEFAULT_CYCLONEDX_VERSION,
> +                        choices=["1.6", "1.6.1", "1.6.2"],
> +                        help=f"Set CycloneDX version (default: {DEFAULT_CYCLONEDX_VERSION})")

Simply use %(default)s in lieu of {DEFAULT_CYCLONEDX_VERSION} (and 
remove the f that makes the string an f-string). c.f. 
https://docs.python.org/3/library/argparse.html#help

I could nitpick here and say you should first add support for picking a 
version, and then another commit to modify the default version.

>   
>       args = parser.parse_args()
>   
> @@ -545,7 +548,7 @@ def main():
>           parser.print_help()
>           sys.exit(1)
>   
> -    SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(CYCLONEDX_VERSION))
> +    SPDX_LICENSES.extend(br2_retrieve_spdx_licenses(args.cdx_version))
>       show_info_dict = json.load(args.in_file)
>   
>       # Remove rootfs and virtual packages if not explicitly included
> @@ -553,10 +556,11 @@ def main():
>       filtered_show_info_dict = {k: v for k, v in show_info_dict.items()
>                                  if ("rootfs" not in v["type"]) and (args.virtual or v["virtual"] is False)}
>   
> +    cdx_spec_version = ".".join(args.cdx_version.split(".")[:2])

Please add a comment here to explain why we're doing this.

Looks good to me otherwise.

Cheers,
Quentin
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot