[Buildroot] [PATCH 2/4] support/scripts/cve-check: remove 'bom-ref' for vulnerabilities

[Thomas Perale via buildroot <buildroot@buildroot.org>]

The 'bom-ref' are optionnal and since we don't reference the
vulnerabilities from anywhere else in the SBOM they are not necessary in
this case.

In the following commit, it will introduce multiple vulnerabilities that
have the same id. So using the vulnerability id as 'bom-ref' won't be
correct as the 'bom-ref' needs to be unique unlike the id property.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 support/scripts/cve-check | 1 -
 1 file changed, 1 deletion(-)

diff --git a/support/scripts/cve-check b/support/scripts/cve-check
index 2bb3524014..1c006e4ce4 100755
--- a/support/scripts/cve-check
+++ b/support/scripts/cve-check
@@ -129,7 +129,6 @@ def nvd_cve_to_cdx_vulnerability(nvd_cve):
     [1] https://cyclonedx.org/docs/1.6/json/#vulnerabilities
     """
     vulnerability = {
-        "bom-ref": nvd_cve["id"],
         "id": nvd_cve["id"],
         "description": cve_api_get_lang_from_list(nvd_cve.get("descriptions", [])) or "",
         "source": {
-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot