[Buildroot] [PATCH v5 3/8] utils/generate-cyclonedx: move utility function
Thomas Perale
thomas.perale at mind.be
Wed Mar 11 14:04:52 UTC 2026
Move all the utility functions that are not generating CycloneDX
structure to the top of the script and group the CycloneDX generation
function together.
Signed-off-by: Thomas Perale <thomas.perale at mind.be>
---
utils/generate-cyclonedx | 178 +++++++++++++++++++--------------------
1 file changed, 89 insertions(+), 89 deletions(-)
diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index 52fb8cc3e9..facbd6c78f 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -78,65 +78,48 @@ def br2_retrieve_spdx_licenses(version: Tuple[int, int]):
return ret
-def split_top_level_comma(subj):
- """Split a string at comma's, but do not split at comma's in between parentheses.
+def br2_virtual_is_provided_by(ref, show_info_dict) -> list:
+ """Retrieve the list of packages that provide a virtual package.
Args:
- subj (str): String to be split.
+ ref (str): The identifier of the virtual package.
+ show_info_dict (dict): The JSON output of the show-info
+ command, parsed into a Python dictionary.
Returns:
- list: A list of substrings
+ list: package list that provides the virtual package.
"""
- counter = 0
- substring = ""
-
- for char in subj:
- if char == "," and counter == 0:
- yield substring
- substring = ""
- else:
- if char == "(":
- counter += 1
- elif char == ")":
- counter -= 1
- substring += char
+ return [
+ name
+ for name, comp in show_info_dict.items()
+ if "provides" in comp and ref in comp["provides"]
+ ]
- yield substring
+def br2_parse_deps(ref, show_info_dict, virtual=False) -> list:
+ """This function will collect all dependencies from the show-info output.
-def cyclonedx_license(lic):
- """Given the name of a license, create an individual entry in
- CycloneDX format. In CycloneDX, the 'id' keyword is used for
- names that are recognized as SPDX License abbreviations. All other
- license names are placed under the 'name' keyword.
+ The dependency on virtual package will collect the final dependency without
+ including the virtual one.
Args:
- lic (str): Name of the license
+ ref (str): The identifier of the package for which the dependencies have
+ to be looked up.
+ show_info_dict (dict): The JSON output of the show-info
+ command, parsed into a Python dictionary.
Returns:
- dict: An entry for the license in CycloneDX format.
+ list: A list of dependencies of the 'ref' package.
"""
- key = "id" if lic in SPDX_LICENSES else "name"
- return {
- key: lic,
- }
-
-
-def cyclonedx_licenses(lic_list):
- """Create a licenses list formatted for a CycloneDX component
+ deps = set()
- Args:
- lic_list (str): A comma separated list of license names.
+ for dep in show_info_dict.get(ref, {}).get("dependencies", []):
+ if not virtual and show_info_dict.get(dep, {}).get("virtual"):
+ deps.update(br2_virtual_is_provided_by(dep, show_info_dict))
+ else:
+ deps.add(dep)
- Returns:
- dict: A dictionary with license information for the component,
- in CycloneDX format.
- """
- return {
- "licenses": [
- {"license": cyclonedx_license(lic.strip())} for lic in split_top_level_comma(lic_list)
- ]
- }
+ return list(deps)
def extract_cves_from_header(header: str) -> list[str]:
@@ -169,7 +152,7 @@ def patch_retrieve_header(content: str) -> str:
DIFF_LINE_REGEX = re.compile(r"^diff\s+(?:--git|-[-\w]+)\s+(\S+)\s+(\S+)$")
INDEX_LINE_REGEX = re.compile(r"^Index:\s+(\S+)$")
- lines = content.split('\n')
+ lines = content.split("\n")
header = []
for i, line in enumerate(lines):
@@ -218,6 +201,67 @@ def read_patch_file(patch_path: Path) -> str:
return content
+def split_top_level_comma(subj):
+ """Split a string at comma's, but do not split at comma's in between parentheses.
+
+ Args:
+ subj (str): String to be split.
+
+ Returns:
+ list: A list of substrings
+ """
+ counter = 0
+ substring = ""
+
+ for char in subj:
+ if char == "," and counter == 0:
+ yield substring
+ substring = ""
+ else:
+ if char == "(":
+ counter += 1
+ elif char == ")":
+ counter -= 1
+ substring += char
+
+ yield substring
+
+
+def cyclonedx_license(lic):
+ """Given the name of a license, create an individual entry in
+ CycloneDX format. In CycloneDX, the 'id' keyword is used for
+ names that are recognized as SPDX License abbreviations. All other
+ license names are placed under the 'name' keyword.
+
+ Args:
+ lic (str): Name of the license
+
+ Returns:
+ dict: An entry for the license in CycloneDX format.
+ """
+ key = "id" if lic in SPDX_LICENSES else "name"
+ return {
+ key: lic,
+ }
+
+
+def cyclonedx_licenses(lic_list):
+ """Create a licenses list formatted for a CycloneDX component
+
+ Args:
+ lic_list (str): A comma separated list of license names.
+
+ Returns:
+ dict: A dictionary with license information for the component,
+ in CycloneDX format.
+ """
+ return {
+ "licenses": [
+ {"license": cyclonedx_license(lic.strip())} for lic in split_top_level_comma(lic_list)
+ ]
+ }
+
+
def cyclonedx_patches(patch_list: list[str]):
"""Translate a list of patches from the show-info JSON to a list of
patches in CycloneDX format.
@@ -358,50 +402,6 @@ def cyclonedx_vulnerabilities(show_info_dict):
} for cve, components in cves.items()]
-def br2_virtual_is_provided_by(ref, show_info_dict) -> list:
- """Retrieve the list of packages that provide a virtual package.
-
- Args:
- ref (str): The identifier of the virtual package.
- show_info_dict (dict): The JSON output of the show-info
- command, parsed into a Python dictionary.
-
- Returns:
- list: package list that provides the virtual package.
- """
- return [
- name
- for name, comp in show_info_dict.items()
- if "provides" in comp and ref in comp["provides"]
- ]
-
-
-def br2_parse_deps(ref, show_info_dict, virtual=False) -> list:
- """This function will collect all dependencies from the show-info output.
-
- The dependency on virtual package will collect the final dependency without
- including the virtual one.
-
- Args:
- ref (str): The identifier of the package for which the dependencies have
- to be looked up.
- show_info_dict (dict): The JSON output of the show-info
- command, parsed into a Python dictionary.
-
- Returns:
- list: A list of dependencies of the 'ref' package.
- """
- deps = set()
-
- for dep in show_info_dict.get(ref, {}).get("dependencies", []):
- if not virtual and show_info_dict.get(dep, {}).get("virtual"):
- deps.update(br2_virtual_is_provided_by(dep, show_info_dict))
- else:
- deps.add(dep)
-
- return list(deps)
-
-
def main():
parser = argparse.ArgumentParser(
description='''Create a CycloneDX SBoM for the Buildroot configuration.
--
2.53.0
More information about the buildroot
mailing list