Re: [Buildroot] [PATCH v5 1/8] utils/generate-cyclonedx: use tuple for version

[Quentin Schulz via buildroot <buildroot@buildroot.org>]

Hi Thomas,

On 3/11/26 3:04 PM, Thomas Perale via buildroot wrote:
> Allows to compare different (major, minor) version easily.
> 
> In next commit, an optional newer version of CycloneDX will be
> introduced and this syntax makes it easy to compare without introducing
> a dependency to 'packaging.version'.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   utils/generate-cyclonedx | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index 2b6c6d63d3..eff55bf598 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -20,13 +20,13 @@ import sys
>   import re
>   
>   
> -CYCLONEDX_VERSION = "1.6"
> -SPDX_SCHEMA_URL = f"https://raw.githubusercontent.com/CycloneDX/specification/{CYCLONEDX_VERSION}/schema/spdx.schema.json"
> +CYCLONEDX_VERSION = (1, 6)
> +SPDX_SCHEMA_URL = "https://raw.githubusercontent.com/CycloneDX/specification/{}.{}/schema/

How about generating the version with

'.'.join(str(x) for x in CYCLONEDX_VERSION)
? This way, we support when there are patch versions as well (1.6.1 
exists after all).

Maybe a class for the version would be best, then we can convert to 
(__init__) and from (__str__) the class to a string and compare two 
versions against each other (using tuples or list for example; 
__eq__/__lt__).

Now I'm wondering whether the SPDX schema version needs to be in sync 
with the BOM schema? Because while there exists a 1.6.1 SPDX schema 
which differs from 1.6 SPDX schema, see commit 5f3ee8066491 ("Updating 
SPDX license list to 3.24.0."), the BOM schema too is different but it's 
kept under the same name of bom-1.6.schema.json (and the $id is the same).

Also, are we validating that our SBOM generated by this script is 
actually CycloneDX version X.Y compatible? Should we download the 
bom-1.6.schema.json and validate it with e.g. jsonschema?

Cheers,
Quentin
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot