[Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Heiko Thiery]

In CycloneDX the serialNumber field is an optional top-level field that
uniquely identified a SBOM using a URN RFC 4122 UUID format.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
---
 utils/generate-cyclonedx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index df12ee84c0..c3b614b6be 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -19,6 +19,7 @@ import urllib.request
 import subprocess
 import sys
 import re
+import uuid
 
 
 CYCLONEDX_VERSION = "1.6"
@@ -534,6 +535,7 @@ def main():
         "bomFormat": "CycloneDX",
         "$schema": f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json",
         "specVersion": f"{CYCLONEDX_VERSION}",
+        "serialNumber": uuid.uuid4().urn,
         "metadata": {
             "component": {
                 "bom-ref": args.project_name,
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Perale via buildroot]

Hi Heiko,

Thanks for the submission !

In reply of:
> In CycloneDX the serialNumber field is an optional top-level field that
> uniquely identified a SBOM using a URN RFC 4122 UUID format.
> 

Initially I didn't include this field for reproducibility concerns: generating
an SBOM from the same configuration wouldn't generate the same output.

Of course this is exactly the goal of this field from the spec point of view
but I was concerned this could be an issue for Buildroot. So I didn't include
this field and thought it could be set by the end user if needed like other
fields such as:

- version
- metadata
- ...

One of the idea I thought about to solve this would be for user to be able to
define a template the `generate-cyclonedx` would take as basis for the
generation.

```json
{
  "serialNumber": "{uuid.uuid4().urn}",
  "metadata": {
    "timestamp": "{datetime.now}"
    "authors": {
      "name": "..."
    }
  }
}
```

But i don't know if it feasible or nice to deal with from a user point of view.

Is there a tool you are using that enforce setting this field ?

Also in the commit message I would include the link to the spec:

https://cyclonedx.org/docs/1.6/json/#serialNumber

PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Heiko Thiery]

Hi Thomas,

Am Fr., 18. Sept. 2026 um 10:32 Uhr schrieb Thomas Perale
<thomas.perale@mind.be>:
>
> Hi Heiko,
>
> Thanks for the submission !
>
> In reply of:
> > In CycloneDX the serialNumber field is an optional top-level field that
> > uniquely identified a SBOM using a URN RFC 4122 UUID format.
> >
>
> Initially I didn't include this field for reproducibility concerns: generating
> an SBOM from the same configuration wouldn't generate the same output.
>
> Of course this is exactly the goal of this field from the spec point of view
> but I was concerned this could be an issue for Buildroot. So I didn't include
> this field and thought it could be set by the end user if needed like other
> fields such as:

Yes you are right, the spec says: "Every BOM generated SHOULD have a
unique serial number, even if the contents of the BOM have not changed
over time"

So I understand your concerns.

>
> - version
> - metadata
> - ...
>
> One of the idea I thought about to solve this would be for user to be able to
> define a template the `generate-cyclonedx` would take as basis for the
> generation.
>
> ```json
> {
>   "serialNumber": "{uuid.uuid4().urn}",
>   "metadata": {
>     "timestamp": "{datetime.now}"
>     "authors": {
>       "name": "..."
>     }
>   }
> }
> ```

Currently I use a post step to add the serialNumber field:

```
jq --arg sn "urn:uuid:$(cat /proc/sys/kernel/random/uuid)"
'{bomFormat, "$schema": .["$schema"], specVersion, serialNumber: $sn}
+ .' sbom.json
 ```
Having a template sounds also a good idea. With that you would be free
in adding all info in addition without modifying the script.

>
>
> But i don't know if it feasible or nice to deal with from a user point of view.
>
> Is there a tool you are using that enforce setting this field ?

There is no tool, but our company's security office requested this
field for their process.

>
> Also in the commit message I would include the link to the spec:
>
> https://cyclonedx.org/docs/1.6/json/#serialNumber

I can submit a v2 that adds this information.

> PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Petazzoni via buildroot]

Thomas, Heiko,

On Fri, Sep 18, 2026 at 10:58:26AM +0200, Heiko Thiery wrote:

> > But i don't know if it feasible or nice to deal with from a user point of view.
> >
> > Is there a tool you are using that enforce setting this field ?
> 
> There is no tool, but our company's security office requested this
> field for their process.
> 
> >
> > Also in the commit message I would include the link to the spec:
> >
> > https://cyclonedx.org/docs/1.6/json/#serialNumber
> 
> I can submit a v2 that adds this information.

So where do we stand with this?

If the CycloneDX spec requires this UUID, I would suggest that we
include it, and people who want to compared CycloneDX files in terms
of reproducibility will have to ignore this field.

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Perale via buildroot]

Thomas, Heiko,

In reply of:
> Thomas, Heiko,
> 
> On Fri, Sep 18, 2026 at 10:58:26AM +0200, Heiko Thiery wrote:
> 
> > > But i don't know if it feasible or nice to deal with from a user point of view.
> > >
> > > Is there a tool you are using that enforce setting this field ?
> > 
> > There is no tool, but our company's security office requested this
> > field for their process.
> > 
> > >
> > > Also in the commit message I would include the link to the spec:
> > >
> > > https://cyclonedx.org/docs/1.6/json/#serialNumber
> > 
> > I can submit a v2 that adds this information.
> 
> So where do we stand with this?
> 
> If the CycloneDX spec requires this UUID, I would suggest that we
> include it, and people who want to compared CycloneDX files in terms
> of reproducibility will have to ignore this field.
> 
> Thomas

It's optional in the CycloneDX spec but it _might_ be required by some
regulations to have an unique identifier.

It's OK for me to include this change but I would still like to offer
in the future a solution that can fit both uses cases: reproducibility and
output customization with product owner informations/requirements.

Best regard,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Petazzoni via buildroot]

On Thu, Oct 22, 2026 at 08:19:54PM +0200, Thomas Perale wrote:

> It's optional in the CycloneDX spec but it _might_ be required by some
> regulations to have an unique identifier.

Ah. Then maybe we should leave it out, and ask Heiko to post-process
the CycloneDX SBOM produced by Buildroot to meet his cybersecurity
folks requirements. And we can revisit that later if other people show
up and ask for the same uuid field.

> It's OK for me to include this change but I would still like to offer
> in the future a solution that can fit both uses cases: reproducibility and
> output customization with product owner informations/requirements.

Like "generate-cyclonedx --reproducible" ?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Perale via buildroot]

Thomas, Heiko,

In reply of:
> On Thu, Oct 22, 2026 at 08:19:54PM +0200, Thomas Perale wrote:
> 
> > It's optional in the CycloneDX spec but it _might_ be required by some
> > regulations to have an unique identifier.
> 
> Ah. Then maybe we should leave it out, and ask Heiko to post-process
> the CycloneDX SBOM produced by Buildroot to meet his cybersecurity
> folks requirements. And we can revisit that later if other people show
> up and ask for the same uuid field.
> 
> > It's OK for me to include this change but I would still like to offer
> > in the future a solution that can fit both uses cases: reproducibility and
> > output customization with product owner informations/requirements.
> 
> Like "generate-cyclonedx --reproducible" ?

Personal opinion but I would prefer to not add too many arguments to the
script to keep it easy to use and readable.

My idea to is to be able to pass a JSON template that contains custom information
and allows to use a set of tags that will insert information at runtime.

Here for example what the base template would look like for the reproducible SBOM:

```json
{
  "bomFormat": "CycloneDX",
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "specVersion": "1.6",
  "metadata": {
    "component": {
      "type": "firmware",
      "bom-ref": "buildroot",
      "name": "buildroot",
      "version": "@BR_VERSION@",
      "cpe": "cpe:2.3:a:buildroot:buildroot:@BR_VERSION@:*:*:*:*:*:*:*"
    },
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "Buildroot generate-cyclonedx",
          "version": "@BR_VERSION@",
          "licenses": [
            {
              "license": {
                "id": "GPL-2.0"
              }
            }
          ]
        }
      ]
    }
  }
}
```

Here another example of a template someone developping a product with buildroot
could use:

```json
{
  "bomFormat": "CycloneDX",
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "specVersion": "1.6",
  "serialNumber": "@UUID@"
  "metadata": {
    "timestamp": "@TIMESTAMP@",
    "lifecycles": [{
      "phase": "post-build"
    }],
    "author": {
      "name": "..."
    },
    "component": {
      "type": "firmware"
      "bom-ref": "my-product",
      "name": "my-product",
      "version": "@VCS_VERSION@",
      "components": [
        {
          "type": "firmware"
          "bom-ref": "buildroot",
          "name": "buildroot",
          "version": "@BR_VERSION@",
          "cpe": "cpe:2.3:a:buildroot:buildroot:@BR_VERSION@:*:*:*:*:*:*:*"
        }
      ]
    },
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "Buildroot generate-cyclonedx",
          "version": "@BR_VERSION@",
          "licenses": [
            {
              "license": {
                "id": "GPL-2.0"
              }
            }
          ]
        }
      ]
    }
  }
}
```

I don't have anything ready to present. But I think it address the needs of
multiple user that want to add custom informations to the produced SBOM. For
example:

- https://lore.kernel.org/all/20260305115752.1861153-4-martin@strongswan.org/
- https://lore.kernel.org/all/20260305115752.1861153-3-martin@strongswan.org/

Something similar is used by 'brotli' to generate their SBOM:

- https://github.com/google/brotli/blob/master/sbom.cdx.json

Personally, I think what Heiko is doing right now with 'jq' is unfortunately
the correct way until we have a better solution implemented. If this series is
applied I will have to use 'jq' to remove this property for my use cases so the
problem is just moved to someone else ;)

Let me know what you think.

Best regards,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot