Re: [Buildroot] [PATCH 8/9] utils/generate-cyclonedx: split vulnerabilities per state

Hi Thomas,

On 6/24/26 12:13 PM, Thomas Perale wrote:
> If a vulnerability is present in multiple components and only one of
> them has a patch that addresses that vulnerability, all components will
> currently have that vulnerability marked as `resolved_with_pedigree`.
> 
> Right now, this issue does not affect any packages, but in the future it
> might affect packages that provide multiple version options (e.g.
> gnupg and gnupg2).
> 
> There is a small chance this happens in a real-world use case, but it
> may occur in the context of maintenance when running
> `make show-info-all`.
> 
> This commit changes how vulnerabilities fixed by a patch are stored.
> Instead of placing all vulnerabilities into a single set, it now keeps an
> index of the component for which the patch has been applied.
> 
> When generating the vulnerability list, the component reference is
> checked instead of only the vulnerability ID. If a vulnerability ID has
> multiple states for different references, multiple vulnerability
> entries are created with distinct analyses.
> 
> Consider the hypothetical case where gnupg ignores a vulnerability
> because it was introduced in a later version, while gnupg2 has patched
> that vulnerability. This would result in the following JSON:
> 
> ```json
> [
>      {
>          "id": "CVE-1234-1234",
>          "analysis": {
>              "state": "in_triage",
>              "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
>          },
>          "affects": [
>              {"ref": "gnupg"}
>          ]
>      },
>      {
>          "id": "CVE-1234-1234",
>          "analysis": {
>              "state": "resolved_with_pedigree",
>              "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
>          },
>          "affects": [
>              {"ref": "gnupg2"}
>          ]
>      }
> ]
> ```
> 
> Signed-off-by: Thomas Perale <[email protected]>
> ---
>   utils/generate-cyclonedx | 21 +++++++++++++--------
>   1 file changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index 672e7ed815..e12a9a4629 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -14,6 +14,7 @@ import json
>   import os
>   from pathlib import Path
>   from typing import Iterator
> +from collections import defaultdict
>   import urllib.parse
>   import urllib.request
>   import urllib.error
> @@ -39,7 +40,7 @@ BR2_VERSION_FULL = (
>   # Set of vulnerabilities that were addressed by a patch present in buildroot
>   # tree. This set is used to set the analysis of the ignored CVEs to
>   # 'resolved_with_pedigree'.

It's not a set anymore, it's a dict with keyvalues being sets now, so 
please reflect this in the comment.

> -VULN_WITH_PEDIGREE = set()
> +VULN_WITH_PEDIGREE = defaultdict(set)
>   
>   SPDX_LICENSES = []
>   
> @@ -218,11 +219,12 @@ def read_patch_file(patch_path: Path) -> str:
>           return f.read()
>   
>   
> -def cyclonedx_patches(patch_list: list[str]):
> +def cyclonedx_patches(comp_ref: str, patch_list: list[str]):
>       """Translate a list of patches from the show-info JSON to a list of
>       patches in CycloneDX format.
>   
>       Args:
> +        comp_ref (str): Reference of the component the patches are part of.

It's the bom-ref of the component related to the patches no?

Looks good to me otherwise!

Cheers,
Quentin
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot