How to properly use the script to improve the kernel cve report?

Hello everyone,

I want to use this script
https://github.com/yoctoproject/poky/blob/scarthgap/scripts/contrib/improve_kernel_cve_report.py
that was recently merged (to mark the CVEs impacting files I don't compile
as not applicable).

My platform is based on a STM32MP1 MCU and I'm using the layer provided by
ST https://github.com/STMicroelectronics/meta-st-stm32mp

I have added
SPDX_INCLUDE_COMPILED_SOURCES = "1"
inherit create-spdx

in the bbappend of my kernel recipe and I now run the following command:
./layers/openembedded-core/scripts/improve_kernel_cve_report.py --spdx
build/tmp/deploy/spdx/2.2/<MACHINE>/recipes/recipe-linux-stm32mp.spdx.json
--kernel-version 6.6.78 --datadir ./vulns

And the output is:
[improve_kernel_cve_report.py:419] Total compiled files 82017
[improve_kernel_cve_report.py:93] CVE-2024-0000 doesn't have good metadata
[improve_kernel_cve_report.py:93] CVE-2024-0053 doesn't have good metadata
[improve_kernel_cve_report.py:199] Total CVEs ignored due to not applicable
config: 37
[improve_kernel_cve_report.py:200] Total CVEs not vulnerable due
version-not-in-range: 8453
[improve_kernel_cve_report.py:201] Total vulnerable CVEs: 1950
[improve_kernel_cve_report.py:203] Total CVEs already backported in 6.6:
1618
[improve_kernel_cve_report.py:454] Total kernel cves from kernel CNA: 10720
[improve_kernel_cve_report.py:456] Total kernel before processing cves: 0
[improve_kernel_cve_report.py:464] Total kernel cves after processing: 10720

I see that some CVEs were ignored but for the majority of the other non
applicable ones they were not. I digged a bit in the code and found out
that the spdx file generated by my kernel contained basically all source
files and not only the compiled ones. Did I miss any configuration to have
the proper SPDX report?

Thanks in advance.