Re: [Buildroot] [PATCH v5 6/8] utils/generate-cyclonedx: mark host packages as external

[Quentin Schulz via buildroot <buildroot@buildroot.org>]

Hi Thomas,

On 3/11/26 3:04 PM, Thomas Perale via buildroot wrote:
> Mark Buildroot's host packages as 'external' with the 'isExternal'
> property. Starting CycloneDX v1.7 [1][2] the CycloneDX spec defines this
> property like the following [3].
> 
>> An external component is one that is not part of an assembly, but is
>> expected to be provided by the environment, regardless of the
>> component's .scope. This setting can be useful for distinguishing which
>> components are bundled with the product and which can be relied upon to
>> be present in the deployment environment.
> 
> This fits the usage of 'host' packages : a package provided by the
> environment and not bundled with the target.
> 

That's not my understanding. None of the examples provided in the GitHub 
issue match a requirement on host executables (in the context of 
cross-compilation). They all are related to runtime dependencies 
(dynamic linking, interpreters, hardware-limitation (which SoC/CPU can 
this run on)) you need to use with the binary(ies) associated with that 
SBOM. What Buildroot generates is likely self-sufficient? A Buildroot 
SDK is kinda different, but then the host packages wouldn't be external 
anyway since they would be part of the SDK and thus "internal". Do you 
have a different reading of the spec on this? (We just started to look 
at CycloneDX generated by Buildroot so I wouldn't trust my own 
gut-feeling on that :) ).

> [1] https://github.com/CycloneDX/specification/releases/tag/1.7
> [2] https://cyclonedx.org/docs/1.7/json/#components_items_isExternal
> [3] https://github.com/CycloneDX/specification/issues/321
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   utils/generate-cyclonedx | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index cbce3364de..35d8c72057 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -373,6 +373,9 @@ class CycloneDX:
>           return {
>               "bom-ref": name,
>               "type": "library",
> +            **({
> +                "isExternal": True
> +            } if self.options.cyclonedx_version >= (1, 7) and comp["type"] == "host" else {}),
>               **({
>                   "name": comp["name"],
>               } if "name" in comp else {}),

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot