[Buildroot] [PATCH v5 7/8] utils/generate-cyclonedx: add 'id' property to resolves

[Thomas Perale via buildroot <buildroot@buildroot.org>]

The CycloneDX spec defines the `components.pedigree.patches.resolves`
object [1] as supporting both a 'name' & 'id' property.

The definition provided for the `id` property is the following [2]:

> The identifier of the issue assigned by the source of the issue

And for the `name` property [3]:

> The name of the issue

The `resolves` object was introduced in commit [4] and only used the
`name` property to link to the vulnerability it resolves.

In example [5] provided on the CycloneDX website, both the `name` & `id`
properties are set in the security example.

In the vulnerability context, and more precisely the CVEs, the `name`
and the `id' are the same and thus the value can be duplicated across
the two properties.

This commit replicates the behavior documented in [5] to improve
compatibility with tools.

[1] https://cyclonedx.org/docs/1.7/json/#components_items_pedigree_patches_items_resolves
[2] https://cyclonedx.org/docs/1.7/json/#components_items_pedigree_patches_items_resolves_items_id
[3] https://cyclonedx.org/docs/1.7/json/#components_items_pedigree_patches_items_resolves_items_name
[4] 9415529923 utils/generate-cyclonedx: add support for 'resolved_with_pedigree'
[5] https://cyclonedx.org/use-cases/pedigree/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 utils/generate-cyclonedx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index 35d8c72057..43167d12d0 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -329,6 +329,7 @@ class CycloneDX:
                         "resolves": [
                             {
                                 "type": "security",
+                                "id": cve,
                                 "name": cve
                             } for cve in cves
                         ]
-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot