Re: [Buildroot] [PATCH v5 5/8] utils/generate-cyclonedx: optional bump to v1.7

[Quentin Schulz via buildroot <buildroot@buildroot.org>]

Hi Thomas,

On 3/11/26 3:04 PM, Thomas Perale via buildroot wrote:
> See changes:
> 
> - https://cyclonedx.org/news/cyclonedx-v1.7-released/
> - https://github.com/CycloneDX/specification/releases/tag/1.7
> 
> Since some tools like DependencyTrack don't support CycloneDX SBOM v1.7
> this bump is optional and default remains v1.6.
> 
> To allow generation of CycloneDX based on the current version of the
> spec we are using a 'Context' datastructure is created that reference
> the CycloneDX version spec currently in use.
> 
> This Context datastructure is then passed down to functions that
> generate part of the CycloneDX SBOM.
> 
> All the top level datastructure are moved into the Context
> datastructure that will be generated after the arguments from the
> command line are interpreted.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   utils/generate-cyclonedx | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index 24c15df94e..cbce3364de 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -21,8 +21,7 @@ import re
>   from typing import Mapping, Tuple
>   from dataclasses import dataclass, field
>   
> -
> -CYCLONEDX_VERSION = (1, 6)
> +DEFAULT_CYCLONEDX_VERSION = (1, 6)
>   
>   brpath = Path(__file__).parent.parent
>   
> @@ -493,6 +492,9 @@ def main():
>                           help="Specify the project name to use in the SBOM metadata (default:'buildroot')")
>       parser.add_argument("--project-version", type=str, default=f"{BR2_VERSION_FULL}",
>                           help="Specify the project version to use in the SBOM metadata (default: builroot version)")
> +    parser.add_argument("--v17", dest='cdx_version', action='store_const',
> +                        const=(1, 7), default=DEFAULT_CYCLONEDX_VERSION,
> +                        help=f"Use CycloneDX version 1.7 (default: {DEFAULT_CYCLONEDX_VERSION})")
>   

How about making this a choice instead so we can easily extend this 
later on? c.f. https://docs.python.org/3/library/argparse.html#choices

Then use it with generate-cyclonedx --cyclone-sbom-vers 1.7 for example.

Otherwise I'm afraid we're going to have to add more --v arguments and 
handle them separately (or I guess with a mutual exclusion group).

Cheers,
Quentin
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot