[{"id":3669135,"web_url":"http://patchwork.ozlabs.org/comment/3669135/","msgid":"<20260325145817.387805-1-thomas.perale@mind.be>","list_archive_url":null,"date":"2026-03-25T14:58:17","subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","submitter":{"id":87308,"url":"http://patchwork.ozlabs.org/api/people/87308/","name":"Thomas Perale","email":"thomas.perale@mind.be"},"content":"Hi Martin,\n\nIn reply of:\n> BSI TR-03183-2 5.4.2 [1] lists source code URIs under \"Additional data fields\n> for each component\", and as such \"MUST additionally be provided, if it exists\".\n> \n> If a http or https source download URI is available from show-info, extract\n> it and include it as an externalReference of type \"source-distribution\" in the\n> CycloneDX output.\n> \n> [1] https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2_v2_1_0.pdf?__blob=publicationFile&v=5\n> \n> Signed-off-by: Martin Willi \n\n> ---\n> .../tests/utils/test_generate_cyclonedx.py | 27 +++++++++++++\n> utils/generate-cyclonedx | 40 +++++++++++++++++++\n> 2 files changed, 67 insertions(+)\n> \n> diff --git a/support/testing/tests/utils/test_generate_cyclonedx.py b/support/testing/tests/utils/test_generate_cyclonedx.py\n> index 9b041ffb61fb..9c2bd2bc9180 100644\n> --- a/support/testing/tests/utils/test_generate_cyclonedx.py\n> +++ b/support/testing/tests/utils/test_generate_cyclonedx.py\n> @@ -137,3 +137,30 @@ class TestGenerateCycloneDX(unittest.TestCase):\n> \n> foo_deps = next(d for d in result[\"dependencies\"] if d[\"ref\"] == \"package-foo\")\n> self.assertEqual(foo_deps[\"dependsOn\"], [\"package-bar\", \"package-virtual\", \"skeleton-baz\"])\n> +\n> + def test_external_references(self):\n> + info = self._make_show_info()\n> + info[\"package-foo\"][\"downloads\"] = [\n> + {\n> + \"source\": \"foo-1.2.tar.gz\",\n> + \"uris\": [\n> + \"git+https://git.example.org/foo\",\n> + \"https+https://sources.buildroot.net/foo\",\n> + \"http|https+https://mirror.example.org/foo\",\n> + ],\n> + },\n> + ]\n> +\n> + result = self._run_script(show_info=info)\n> + foo = self._find_component(result, \"package-foo\")\n> +\n> + self.assertIn(\"externalReferences\", foo)\n> + self.assertEqual(\n> + foo[\"externalReferences\"],\n> + [\n> + {\n> + \"type\": \"source-distribution\",\n> + \"url\": \"https://mirror.example.org/foo/foo-1.2.tar.gz\",\n> + }\n> + ],\n> + )\n> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx\n> index 70abd7af7c89..3946380ae3ef 100755\n> --- a/utils/generate-cyclonedx\n> +++ b/utils/generate-cyclonedx\n> @@ -14,6 +14,8 @@ import gzip\n> import json\n> import os\n> from pathlib import Path\n> +from typing import Iterator\n> +import urllib.parse\n> import urllib.request\n> import subprocess\n> import sys\n> @@ -261,6 +263,43 @@ def cyclonedx_patches(patch_list: list[str]):\n> }\n> \n> \n> +def usable_download_uris(uris: list[str]) -> Iterator[str]:\n> + \"\"\"Filter the download URIs to find usable HTTP/HTTPS URLs.\n> +\n> + Args:\n> + uris (list): Array of URI strings from the show-info output.\n> + Returns:\n> + Iterator[str]: An iterator over usable HTTP/HTTPS URLs.\n> + \"\"\"\n> + for uri in uris:\n> + parts = uri.split(\"+\", 1)\n\nNIT: To make it more clear what your are splitting maybe ?\n\n```\nscheme, _, strippeduri = uri.partition(\"+\")\n```\n\n> + if len(parts) == 2 and {\"http\", \"https\"} & set(parts[0].split(\"|\")):\n> + if urllib.parse.urlparse(parts[1]).hostname != \"sources.buildroot.net\":\n> + yield parts[1]\n\nWhat about 'git' repos ? If I understand correctly URI such as:\n\n```\ngit+https://github.com/containers/aardvark-dns\n```\n\nWon't be part of the 'source-distribution'. Which looks to make sense in regard\nof the CDX spec. Could we use maybe the \"distribution\" property for those ?\nDoes it make sense ?\n\nhttps://cyclonedx.org/use-cases/external-resource-links/\n\n> +\n> +\n> +def cyclonedx_external_refs(comp):\n> + \"\"\"Create CycloneDX external references for a component.\n> +\n> + Args:\n> + comp (dict): The component information from the show-info output.\n> + Returns:\n> + dict: External reference information in CycloneDX format, or empty dict\n> + \"\"\"\n> + for download in comp.get(\"downloads\", []):\n> + for uri in usable_download_uris(download.get(\"uris\", [])):\n> + if source := download.get(\"source\"):\n> + return {\n> + \"externalReferences\": [\n> + {\n> + \"type\": \"source-distribution\",\n> + \"url\": f\"{uri}/{source}\",\n> + }\n> + ]\n> + }\n> + return {}\n> +\n> +\n> def cyclonedx_component(name, comp):\n> \"\"\"Translate a component from the show-info output, to a component entry in CycloneDX format.\n> \n> @@ -284,6 +323,7 @@ def cyclonedx_component(name, comp):\n> **({\n> \"cpe\": comp[\"cpe-id\"],\n> } if \"cpe-id\" in comp else {}),\n> + **cyclonedx_external_refs(comp),\n> **(cyclonedx_patches(comp[\"patches\"]) if comp.get(\"patches\") else {}),\n> \"properties\": [{\n> \"name\": \"BR_TYPE\",\n> -- \n> 2.43.0\n> \n> _______________________________________________\n> buildroot mailing list\n> buildroot@buildroot.org\n> https://lists.buildroot.org/mailman/listinfo/buildroot","headers":{"Return-Path":"","X-Original-To":["incoming-buildroot@patchwork.ozlabs.org","buildroot@buildroot.org"],"Delivered-To":["patchwork-incoming-buildroot@legolas.ozlabs.org","buildroot@buildroot.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=buildroot.org header.i=@buildroot.org\n header.a=rsa-sha256 header.s=default header.b=fEXyRxBx;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=buildroot.org\n (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org;\n envelope-from=buildroot-bounces@buildroot.org; receiver=patchwork.ozlabs.org)"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fgqm46pR9z1y1K\n\tfor ;\n Thu, 26 Mar 2026 01:58:28 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 7991361376;\n\tWed, 25 Mar 2026 14:58:26 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id 5zZmZ1vz1tLh; Wed, 25 Mar 2026 14:58:24 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 2406C60ECB;\n\tWed, 25 Mar 2026 14:58:24 +0000 (UTC)","from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])\n by lists1.osuosl.org (Postfix) with ESMTP id 5B1CA1D3\n for ; Wed, 25 Mar 2026 14:58:22 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp4.osuosl.org (Postfix) with ESMTP id 4100041104\n for ; Wed, 25 Mar 2026 14:58:22 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id QQWFlJg6zqUw for ;\n Wed, 25 Mar 2026 14:58:21 +0000 (UTC)","from mail-wr1-x429.google.com (mail-wr1-x429.google.com\n [IPv6:2a00:1450:4864:20::429])\n by smtp4.osuosl.org (Postfix) with ESMTPS id 02341410F5\n for ; Wed, 25 Mar 2026 14:58:20 +0000 (UTC)","by mail-wr1-x429.google.com with SMTP id\n ffacd0b85a97d-439cd6b09f8so4798301f8f.3\n for ; Wed, 25 Mar 2026 07:58:20 -0700 (PDT)","from arch ([79.132.232.220]) by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43b91942e52sm347043f8f.9.2026.03.25.07.58.18\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 25 Mar 2026 07:58:18 -0700 (PDT)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=buildroot-bounces@buildroot.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org 2406C60ECB","OpenDKIM Filter v2.11.0 smtp4.osuosl.org 02341410F5"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=buildroot.org;\n\ts=default; t=1774450704;\n\tbh=aQPUpktPJuylCzi24Z76kHKQFFyOCkRCpZJ1PyNrKb4=;\n\th=To:Cc:Date:In-Reply-To:References:Subject:List-Id:\n\t List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:\n\t From:Reply-To:From;\n\tb=fEXyRxBxw9z2nuLHDO8foxmpOoO4a6i0gZowXWqzTWhgskjxVwooVh5SDGHkoxs8T\n\t W22fCM7xrmJ/3ndPbD8kHCExYbBGAdjKhrkjpzjf4XE9Mwgl1xKisu+XANRzhb7M/m\n\t bJrRm72iNhLzQSZ8tk5/fnxo/8Rjj1fbtWqkwUA5YPfIhgz4emZ6V4zEwwfVZX74U9\n\t YDmZoXyj5iQArRymDtI3qw6noENM1hlRLPps6buNu42yzXYv7SXKfslCSteypzYQsq\n\t b/M59xPzNXkN7mcNiD+pLZpWqppLjsjIDsXZYlz71dcaTA0neq2+3YuZf6L4Wy4Mrk\n\t B7hbwKSIRv0Mg==","Received-SPF":"Pass (mailfrom) identity=mailfrom;\n client-ip=2a00:1450:4864:20::429; helo=mail-wr1-x429.google.com;\n envelope-from=thomas.perale@essensium.com; receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp4.osuosl.org 02341410F5","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774450699; x=1775055499;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=3PXdGRiwnd1nZfkX8yChKrMU8DeRREyisPeiw7Cp/Zg=;\n b=HTq8WYLpg3igFg+zaOykmIhN4PjlMFSG9dPLqEy4A37tlngThvygftMlTdl0Xtp50h\n 0fX6jcdIvURAAmPifDFaApzobUVei3NGOh9otNac4uJlsa42Ec26AsXoH2K6mvM0oB0z\n q7FYAW6NOI7YsYLmYllGlKdjZLPa2I9MMHc5G1GzpjbOEQ5+D3fa5zzazWPNCa5sWid/\n LKf7d5heLikXSWhzrTxSbYN6Q+jiItnJZSVX22vXmIbbavFyPKxhjvaDP9Oa79LZsACk\n 9/JgMufyj+yLgqXF5rwNjQrmzkc0H+2r8IWuJAjjJ51U6L9CH0QZDgS7BTeo8djhphhr\n z+NA==","X-Forwarded-Encrypted":"i=1;\n AJvYcCXf/0/F7749Oww7JIqv4eI+tM4ywOMgptXtuf3lYaPkyhoChk6lK5yfLX6giK59EWZ7h4uYXo47deY=@buildroot.org","X-Gm-Message-State":"AOJu0YylB/nqepiMufDM5paahIZhvO8sJ4ePemrR1gO83ke5SVxCkZc7\n +KIumc/x6MZwluLzklYOlk7h5cXISU7Et8auFhq1pHmFgFSpCvoM4GA6Karm522iNQsTJ97D3vQ\n Ndfo225U=","X-Gm-Gg":"ATEYQzxtNoFB5IxJqheWnDbiirHv2DMBcUqMFpnN+NILBCU9oa+wfXCTHlzTVQBjQZt\n WZxEJYnrFTgJuk+1HsU4wJToNstWmiVm7b/zfNoJr9RR+ifb0XwedJO+iDHGBqhtPsOL0b+gUpV\n yjS2CTlqAUw5oYu4GYZ9CuViONx83LXSLpGj6XCGDhZRPszL8ecyn2ax+fWoxrnXheMYUvBcIEP\n QahuEJ+iEBNTwc/ZprBlwNe/oet2OkUA74XXvKaCrKKba0go9M+BsWyJWtYwE2nMnMZdVwefLXa\n z9YHOHdBPxQHq04uDkXGRqbW1JPhJY8yaSs7/7v6TseQdwTFaixC98M5tPELCU3qCWMA4N8j+Cm\n KtoT+qdtypd+Ty0P3/YF+mSSzrznTUhx3ECVjusg+UVQcmu2CwQM29rauWmUpzGSk6dCc0/zqRP\n 9n2yAHs4HXKum8e/zm","X-Received":"by 2002:a05:6000:2502:b0:43b:4dd4:684f with SMTP id\n ffacd0b85a97d-43b88a410f3mr5353741f8f.47.1774450698605;\n Wed, 25 Mar 2026 07:58:18 -0700 (PDT)","To":"Martin Willi ","Cc":"Thomas Perale ,\n\tbuildroot@buildroot.org","Date":"Wed, 25 Mar 2026 15:58:17 +0100","Message-ID":"<20260325145817.387805-1-thomas.perale@mind.be>","X-Mailer":"git-send-email 2.53.0","In-Reply-To":"<20260325133343.1008245-4-martin@strongswan.org>","References":"<20260325133343.1008245-4-martin@strongswan.org>","MIME-Version":"1.0","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=mind.be; s=google; t=1774450699; x=1775055499; darn=buildroot.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=3PXdGRiwnd1nZfkX8yChKrMU8DeRREyisPeiw7Cp/Zg=;\n b=MQzei+lf0NngfZUbUZ9DKTJl9swhlXYooabI49ayyeRGyluUa70v271QKl2errApxX\n qBzx8F2Pa9io/ER7RBD78AF1V+PbcZYwyd84v3AC4sAfI3CUqO/m2oJKBn5r3+Pgtxzv\n 9fMF6z8kBIfk8wiZtSN9X7cuIzzUcYyCSUrwwPBakLc6L1YCJZJNlFY96p8akYCcnZ3Q\n 7th0EqqeRgMqZZBoagHd35Z1R/XavmBwRG4Kqslms0nWVY/28AQan3Gf8/Ab/PO83vq3\n TRQ20Rf3wM+SsK1/Llq9Vcr1aXXJftLlU7k3EUNmcW3GnmxtHY807yQ9lNe14EKhKnPU\n gUtg==","X-Mailman-Original-Authentication-Results":["smtp4.osuosl.org;\n dmarc=pass (p=quarantine dis=none)\n header.from=mind.be","smtp4.osuosl.org;\n dkim=pass (2048-bit key) header.d=mind.be header.i=@mind.be\n header.a=rsa-sha256 header.s=google header.b=MQzei+lf"],"Subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","X-BeenThere":"buildroot@buildroot.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Thomas Perale via buildroot ","Reply-To":"Thomas Perale ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"buildroot-bounces@buildroot.org","Sender":"\"buildroot\" "}},{"id":3672233,"web_url":"http://patchwork.ozlabs.org/comment/3672233/","msgid":"","list_archive_url":null,"date":"2026-04-01T12:43:56","subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","submitter":{"id":736,"url":"http://patchwork.ozlabs.org/api/people/736/","name":"Martin Willi","email":"martin@strongswan.org"},"content":"Hi Thomas,\n\nThanks for your review.\n\n> > If a http or https source download URI is available from show-info,\n> > extract it and include it as an externalReference of type\n> > \"source-distribution\" in the CycloneDX output.\n\n> What about 'git' repos ? If I understand correctly URI such as:\n> \n> ```\n> git+https://github.com/containers/aardvark-dns\n> ```\n> \n> Won't be part of the 'source-distribution'. Which looks to make sense\n> in regard of the CDX spec. Could we use maybe the \"distribution\"\n> property for those ? Does it make sense ?\n> \n> https://cyclonedx.org/use-cases/external-resource-links/\n\nIt makes sense, yes, but there are some questions that arise:\n\n * There is also a \"vcs\" type, would that match better than\n \"distribution\"?\n * There are (a few) other VCS types in use, so we probably should do\n this for svn/cvs/hg/bzr as well?\n * Most git SITEs use https:// URLs. From the URL alone, it may not be\n obvious that this is an URL for a git repository. Shall we add a\n \"comment\"?\n * Adding hashes from .hash files probably does not make sense, as it\n is for a locally computed tarball, not a git reference or something.\n We probably should just not add hashes for repository references?\n\nBest Regards\nMartin","headers":{"Return-Path":"","X-Original-To":["incoming-buildroot@patchwork.ozlabs.org","buildroot@buildroot.org"],"Delivered-To":["patchwork-incoming-buildroot@legolas.ozlabs.org","buildroot@buildroot.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=buildroot.org header.i=@buildroot.org\n header.a=rsa-sha256 header.s=default header.b=GCrjdrpk;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=buildroot.org\n (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org;\n envelope-from=buildroot-bounces@buildroot.org; receiver=patchwork.ozlabs.org)"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fm4Rx69jYz1yFv\n\tfor ;\n Wed, 01 Apr 2026 23:44:13 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 64E7261187;\n\tWed, 1 Apr 2026 12:44:11 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id GH9Ra9Te2w0j; Wed, 1 Apr 2026 12:44:10 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 1A3CF60FDF;\n\tWed, 1 Apr 2026 12:44:10 +0000 (UTC)","from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n by lists1.osuosl.org (Postfix) with ESMTP id DF0DC2A2\n for ; Wed, 1 Apr 2026 12:44:07 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp3.osuosl.org (Postfix) with ESMTP id CFBED60FDF\n for ; Wed, 1 Apr 2026 12:44:07 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id hHLeHvNaq4Zl for ;\n Wed, 1 Apr 2026 12:44:07 +0000 (UTC)","from mail.codelabs.ch (mail.codelabs.ch [IPv6:2a02:168:860f:1::35])\n by smtp3.osuosl.org (Postfix) with ESMTPS id F138D6068B\n for ; Wed, 1 Apr 2026 12:44:03 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by mail.codelabs.ch (Postfix) with ESMTP id 986EB5A0002;\n Wed, 01 Apr 2026 14:43:58 +0200 (CEST)","from mail.codelabs.ch ([127.0.0.1])\n by localhost (fenrir.codelabs.ch [127.0.0.1]) (amavis, port 10024) with ESMTP\n id z63XtxSKiyjF; Wed, 1 Apr 2026 14:43:56 +0200 (CEST)","from [10.6.32.201] (unknown [185.12.128.224])\n by mail.codelabs.ch (Postfix) with ESMTPSA id 48D765A0003;\n Wed, 01 Apr 2026 14:43:56 +0200 (CEST)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=buildroot-bounces@buildroot.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org 1A3CF60FDF","OpenDKIM Filter v2.11.0 smtp3.osuosl.org F138D6068B"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=buildroot.org;\n\ts=default; t=1775047450;\n\tbh=3pJbmGICRNpj6rdLnMgMH/uEB++JL+YQmvBdGGEuO2M=;\n\th=From:To:Cc:Date:In-Reply-To:References:Subject:List-Id:\n\t List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:\n\t From;\n\tb=GCrjdrpk9wNNMt2MIMkUZRTEDPc/NA/o02yrhTEDyzAfz3+VJ+DjByuCq549G6uAe\n\t WFiR6TSth6wjZfMUoyqXszD7FcEbl+ZC25+4D2Kp/pRRCvuhfXWrS907txmsoyQHbT\n\t DXao37n31F/cN6Isc+Zuks+vnErjcCmlYQMBuHxeyKYvln0fodFZnJlmdjZM3VGCPm\n\t R48oaJ9fGfPY9J5KWQ//S6iSDbOl/FDNmyLq7Ia9UAtTYUobZTQlVGd97Tuuj3XXpe\n\t nS6l8Bwfhq3yGE+wvyTbmuc0HgGHKoenuvmDVy42czhZ/NuwDQfemCP4tfWpSZMOZZ\n\t GwTh3cWsU+2xQ==","Received-SPF":"Pass (mailfrom) identity=mailfrom;\n client-ip=2a02:168:860f:1::35;\n helo=mail.codelabs.ch; envelope-from=martin@strongswan.org;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp3.osuosl.org F138D6068B","Message-ID":"","From":"Martin Willi ","To":"Thomas Perale ","Cc":"buildroot@buildroot.org","Date":"Wed, 01 Apr 2026 14:43:56 +0200","In-Reply-To":"<20260325145817.387805-1-thomas.perale@mind.be>","References":"<20260325133343.1008245-4-martin@strongswan.org>\n <20260325145817.387805-1-thomas.perale@mind.be>","Autocrypt":"addr=martin@strongswan.org; prefer-encrypt=mutual;\n keydata=mQENBEhbeIwBCADbKW4rqhkBsvQumeWTAfy+Q+YciIbbqLvxwRZPKpxz19nxJQPbWF7pG\n oiPb3TWLK3TitWVKKZuNILStsKTGiR4RqLUs8n3sESPoz5HmRqsijm6yJDzzPAE3/B7IWHBeAOssV\n TWS7b9ROz4iFI+fNLnqMqE22zMEItC2r9zi6GpDmi/QP3CcxHFzPMF5iQkMPp6QJMwOdPvYR9kBb1\n x1ubDOjsfWqI41neJTGlv3EVFc5nkv0s7PfoYxMkf8/VStd29pMe4csKJUaPDkLqenLl8Omq8Z3F+\n sbjdo+hcim4i3EsROYh59kA4/UuMFfI0hxaIaoW6UAb6gyqOHkS6vC+VABEBAAG0Jk1hcnRpbiBXa\n WxsaSA8bWFydGluLndpbGxpQHJldm9zZWMuY2g+iQE4BBMBAgAiBQJRsHoSAhsvBgsJCAcDAgYVCA\n IJCgsEFgIDAQIeAQIXgAAKCRAQGu6ewTL0wxf8B/9EThZXuVqNTK2nH2QuRi2zQntFXkK2QbU11sv\n zkfZV8xDfWKHdq67LLako/FOE1dXN6iurWFChgMexs0bSMzaftCmHGSSgGaQhBhANSObKu8M+UyHd\n bes88zNpQKdwVd9guIo6oRrX33IYkb63ifZReChcBffu6cjXQky7/79kpnl6f3qlP5ZluyNGX9Iwe\n z1EpmG2zHkJlc+3oPQbsQbFKjUOdR1hfyKbcVVQHs1ddv830Z0cpM6QbcknR81VsCQ7FYBrH5Hw3N\n AKhrfbIaZMvwBgQfXIgc7mwPZFg2oONZMzauzX6EpZ29Z+kCsy3AArnZssVAwxk+ydRJhUWlZmtCR\n NYXJ0aW4gV2lsbGkgPG1hcnRpbkBzdHJvbmdzd2FuLm9yZz6JATYEEwECACAFAkhbeIwCGy8GCwkI\n BwMCBBUCCAMEFgIDAQIeAQIXgAAKCRAQGu6ewTL0w9ruCADDGN0JgrImHOPGgsJwdP2nKwBytO8mM\n Z/Z/folgH20zqiMqyNR4lOZW9L3DF4rz83fKXQFbP7nCf6GZ/tmjmrImiTZBkKwr37ZsaBRaCz3i9\n rYITY94njenYp7jy6roMcvlBMhNjSI04AvLjaA/hcPuSexqqso+qoNTa7+VplF7OpikB8vKPt+fMp\n XuGP8TF/q8v9TrY+gcVv0c8ZOrGDnI5vJt1Fp0PvoH/vXFx3Jy90g+hRUYFbLW2S76geiGVML9AeK\n IQKjEpp2bxsd+JYGo91MeKBqjlllonxZ17eKNtlA+X+iluwcDJZzdabB19EQG7ZEf0jAy6Sy09au6\n MYFtCBNYXJ0aW4gV2lsbGkgPG1hcnRpbkByZXZvc2VjLmNoPokBNgQTAQIAIAUCSzjspgIbLwYLCQ\n gHAwIEFQIIAwQWAgMBAh4BAheAAAoJEBAa7p7BMvTDaP4IALJRUmUEagBRrdAi1SrxxcsgPDr5vo8\n 1UrPADXKnMdf6KXPqfPMN4hIeS4zbFyC/FA9cg0T9680pVk8hLmcD3iCRMMnL9d38hOQmMxw2TYnd\n 7rth1LuoDRhIwI1bfADw3EJGEMsTy49zVtVl1KwmqBZDDk3PGHvukHYawleOrTRVitOEvavg0vfgg\n CgqvSeSBy3tkX2EIlagC/5eXpYLguj1iI84xG01M4bZ9PU+PuzZADaHL+a9iPelBvk0uNjwKvKjPx\n OPDfaxsmEgjNG7M9gZjBkjSjvclRUlLMpe+3qHhGEYf2yKsv72hCLYy8my5jRnu59eZq72lX9YWVs\n jlXU=","User-Agent":"Evolution 3.52.3-0ubuntu1.1 ","MIME-Version":"1.0","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n d=strongswan.org; s=default; t=1775047436;\n bh=aBJzwbYjhGXDgf6OGTmJz9+quhITNF3Df/hdlvD6p30=;\n h=Subject:From:To:Cc:Date:In-Reply-To:References:From;\n b=LKE5a7Me5kkNA/02Pj+viyTPDl9Q0CTBB/E5sy6cJoQUYCw37jDlv/4I9Iin1O6LC\n 2GghLh+bZm1K2HkZh8fjkw5BU70nh5LYBzg+u91+LAQDZuRDFCZP1xSzzh/wD3bKXy\n tOgx6zIJRNVVEeG/sJKp5eWu7Nhe6Xq3d/kUios/V3AAcqYq6Z4y7LeOwhkIo+q0n2\n JCYwLgEfm06AYfUgSPS9+iDrlUrBHAynJquqRghR13JfgrIKqlEH6K81vUHt2ebfxl\n eFsChPhXenAd/AvX5Hmr0RlF5y4lY8j1n9p33dmMJEGyy4GHacV+2/Ne0AFBi2bIw2\n 51dOjM4rMPBtg==","X-Mailman-Original-Authentication-Results":["smtp3.osuosl.org;\n dmarc=pass (p=none dis=none)\n header.from=strongswan.org","smtp3.osuosl.org;\n dkim=pass (2048-bit key,\n unprotected) header.d=strongswan.org header.i=@strongswan.org\n header.a=rsa-sha256 header.s=default header.b=LKE5a7Me"],"Subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","X-BeenThere":"buildroot@buildroot.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"buildroot-bounces@buildroot.org","Sender":"\"buildroot\" "}},{"id":3672607,"web_url":"http://patchwork.ozlabs.org/comment/3672607/","msgid":"<20260402083150.168514-1-thomas.perale@mind.be>","list_archive_url":null,"date":"2026-04-02T08:31:49","subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","submitter":{"id":87308,"url":"http://patchwork.ozlabs.org/api/people/87308/","name":"Thomas Perale","email":"thomas.perale@mind.be"},"content":"Hi Martin,\n\nThis was an open question, that we can explore in the future. For me I think\nthis patch is ok to be applied otherwise.\n\nIn reply of:\n> Hi Thomas,\n> \n> Thanks for your review.\n> \n> > > If a http or https source download URI is available from show-info,\n> > > extract it and include it as an externalReference of type\n> > > \"source-distribution\" in the CycloneDX output.\n> \n> > What about 'git' repos ? If I understand correctly URI such as:\n> > \n> > ```\n> > git+https://github.com/containers/aardvark-dns\n> > ```\n> > \n> > Won't be part of the 'source-distribution'. Which looks to make sense\n> > in regard of the CDX spec. Could we use maybe the \"distribution\"\n> > property for those ? Does it make sense ?\n> > \n> > https://cyclonedx.org/use-cases/external-resource-links/\n> \n> It makes sense, yes, but there are some questions that arise:\n> \n> * There is also a \"vcs\" type, would that match better than\n> \"distribution\"?\n\nIndeed it looks even better suited. I first thought it would the an identifier\nfor the VCS but according to the following example they use the repo URL.\n\nhttps://github.com/CycloneDX/bom-examples/blob/7d9172d00c88c05a8f1ccb90589d111870fc9d86/SBOM/laravel-7.12.0/bom.1.3.json#L109\n\nLooking at this example make the frontier between\n\"distribution\"/\"source-distribution\"/\"vsc\" even less clear as they use the\n'distribution' identifier to point to the 'zip'...\n\n> * There are (a few) other VCS types in use, so we probably should do\n> this for svn/cvs/hg/bzr as well?\n\nYes make sense.\n\n> * Most git SITEs use https:// URLs. From the URL alone, it may not be\n> obvious that this is an URL for a git repository. Shall we add a\n> \"comment\"?\n\nSure could be useful.\n\n> * Adding hashes from .hash files probably does not make sense, as it\n> is for a locally computed tarball, not a git reference or something.\n> We probably should just not add hashes for repository references?\n\nIf I look at the 'aardvark-dns' or 'libxmlrpc' example there is still an hash\nassociated to it would it make sense to add them anyway ?\n\nBest regards,\nPERALE Thomas","headers":{"Return-Path":"","X-Original-To":["incoming-buildroot@patchwork.ozlabs.org","buildroot@buildroot.org"],"Delivered-To":["patchwork-incoming-buildroot@legolas.ozlabs.org","buildroot@buildroot.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=buildroot.org header.i=@buildroot.org\n header.a=rsa-sha256 header.s=default header.b=bqBJOOij;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=buildroot.org\n (client-ip=140.211.166.136; helo=smtp3.osuosl.org;\n envelope-from=buildroot-bounces@buildroot.org; receiver=patchwork.ozlabs.org)"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fmZpS3BXhz1yFv\n\tfor ;\n Thu, 02 Apr 2026 19:32:00 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 78E7160E01;\n\tThu, 2 Apr 2026 08:31:58 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id ULTfeNlt3kUT; Thu, 2 Apr 2026 08:31:56 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id C64DD606D7;\n\tThu, 2 Apr 2026 08:31:56 +0000 (UTC)","from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138])\n by lists1.osuosl.org (Postfix) with ESMTP id 9088F2A2\n for ; Thu, 2 Apr 2026 08:31:55 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id 76338813D8\n for ; Thu, 2 Apr 2026 08:31:55 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id F2OW8H76Iosr for ;\n Thu, 2 Apr 2026 08:31:54 +0000 (UTC)","from mail-wm1-x330.google.com (mail-wm1-x330.google.com\n [IPv6:2a00:1450:4864:20::330])\n by smtp1.osuosl.org (Postfix) with ESMTPS id E45D2813CF\n for ; Thu, 2 Apr 2026 08:31:53 +0000 (UTC)","by mail-wm1-x330.google.com with SMTP id\n 5b1f17b1804b1-482f454be5bso17988005e9.0\n for ; Thu, 02 Apr 2026 01:31:53 -0700 (PDT)","from arch ([79.132.232.220]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-4887e967badsm227314345e9.14.2026.04.02.01.31.50\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Thu, 02 Apr 2026 01:31:50 -0700 (PDT)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=buildroot-bounces@buildroot.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org C64DD606D7","OpenDKIM Filter v2.11.0 smtp1.osuosl.org E45D2813CF"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=buildroot.org;\n\ts=default; t=1775118716;\n\tbh=RHRGtnMGbV/ZPMFGJl104deZBdDxKOD1LTNwvv9MGB8=;\n\th=To:Cc:Date:In-Reply-To:References:Subject:List-Id:\n\t List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:\n\t From:Reply-To:From;\n\tb=bqBJOOijKo0KIZkgIVXJyvmlTDBfuz961Bq0TM2n+A/eYYVUkk7lNxtdNkJox81Oh\n\t zHfSHdhZi+qHh5pOSMl2e8IgOmKrslEPfltC++qxUJXqV6OUA3xo7eQy5Dz3IfgW2n\n\t YZ5xcN30teVxoaNQePmSw6tqhitDFvWO45tFDB0DNNfr0gFee9Xw8EQR6XRrUMF+fH\n\t 01fxDa0RfU+chLjZ2id/CSRvK2BjmW4Wn0f1imVzzkMcANdbR+1C3zzDgrCGhT8epT\n\t noEKwpcXDK00Oyn2V01lNrP1cP9WhtH4+1mlUiVw9UyN6e5z1/PSE2kWkCusPfkuJP\n\t AR60G9x/WdbXw==","Received-SPF":"Pass (mailfrom) identity=mailfrom;\n client-ip=2a00:1450:4864:20::330; helo=mail-wm1-x330.google.com;\n envelope-from=thomas.perale@essensium.com; receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp1.osuosl.org E45D2813CF","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775118711; x=1775723511;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=/I9JeRArLjNqICEHgnV9Q1GMbLnuKc3u1G/eRXSiTMY=;\n b=aJKpNX22ff7AJ/9WVoI3DpXGxGbhZtiU0HpH+p8af9GPa7b1FNYzxeBItm7x32ZAXv\n BCR1woF17FdEKsilQ2p9g8w3pi6C6LJKsv1AoiyjU+2g58P0NBVtx5ARWmjFuDWV78Bz\n tDEzup8cgaI3lGLL5OikmhvB2U1Vcs4r0YHGm2loIsc1SH5OMoHK6wWcSnXM7mTcuoj9\n JXv9mR6SXHsvYqT9rcFeU1wVbbMwILdt5qdYDsNPBbszgKJNzB23KcG3kKr3TRJLtE3o\n UpA0nxuAo1VwqcTJ4CyV/VH3XIMq1uZ2NnEXoO7FeVmtftd4UbHTzKd0egcdyuhLGID+\n m+0A==","X-Forwarded-Encrypted":"i=1;\n AJvYcCW3n8VGEZYaHUvDMtayec/6A8CmrjBKM8lon1ZnW9PSbFCNqOLcyBrk8o7+StN7ZEN/Db3f0r3j+UE=@buildroot.org","X-Gm-Message-State":"AOJu0Ywu24DB6z3i5kNVmGWidKKQugkvFyD1mt+fK4yw3gv/GIstymeJ\n bScPF5hU4SLiCZCv/F5+vCjOn8DVBflR7OPp4OZMUmS1qD1o3yKMgqJjMadMTymmc2x5NLAoo57\n UPyHwRGw=","X-Gm-Gg":"ATEYQzxtiRUdTlHEnSyzVexr89/eth4p6Ay8c+2knF4EU236Lj/WW6cuU5vD2b2L/v+\n BzPYDv3wx3LBZK3LcmFmvA/HL3itJ6AY6sN2BSIKuNzfUP0EI2BYTxMghzsTs138irtd8XadSfJ\n +5bZsFxZrGpPQONE1NkDLdtIbxW5E0n5hRo3/0r9bEDQ4mXPuo9wEvKLNLWIAZPaB+EJbV7bpek\n yLfzngBkYzuIF9o1U9z04SMskbhdnsoXX6otjdaH6NdcudzrUi7DE2YFJ+6spjN8Vfe1ipFgzM+\n yVelL3zyqePUwTUhkLKSYSmBmWYRpvf10VvJDO32ht8BVY+GkLot+qihVykV/rq25SoCDQSAtif\n F0o5PW2HWxgzqEds4qcUrnbyDV5jHPbqm5P8nkBuPHOu4av715cDfjTmINkmGhH7MuQi909IJKo\n P0f4jpQ1YFBCteC2Ff","X-Received":"by 2002:a05:600c:19d0:b0:477:9890:9ab8 with SMTP id\n 5b1f17b1804b1-4888e01f5c4mr21138145e9.3.1775118711273;\n Thu, 02 Apr 2026 01:31:51 -0700 (PDT)","To":"Martin Willi ","Cc":"Thomas Perale ,\n\tbuildroot@buildroot.org","Date":"Thu, 2 Apr 2026 10:31:49 +0200","Message-ID":"<20260402083150.168514-1-thomas.perale@mind.be>","X-Mailer":"git-send-email 2.53.0","In-Reply-To":"","References":"","MIME-Version":"1.0","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=mind.be; s=google; t=1775118711; x=1775723511; darn=buildroot.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=/I9JeRArLjNqICEHgnV9Q1GMbLnuKc3u1G/eRXSiTMY=;\n b=SDpo1odTA2Y/zjQhz22TBqBcwbY+jswt9NS6ygSpZPQIo7bIvJk3ciXqt6T6raYpUj\n JQciXfWhPcvY6sWYa0DOqitYn6PeCIZuBZtFagChk1o8hFLvtaORFBhjVghlJ8VcH/ng\n wGq0oPM/SUbnJYdvmQgAS5W4mcskar5FoyrHp5cp4L7MXVVgmDmNQw9/v4bxcs9GA9FH\n AlSCSt+uTN0s2LFei9YW2MI8WQF/2bxZNGxa34qYhGbayyCvJLzWTAKZO4g1voQx8wJP\n NSE4JS99iipovZ1um3TeQURjNF+ZPac7SL0fPRxzmdJA/DMGWjzrmE31A4fY2AJkhB+f\n 0QtA==","X-Mailman-Original-Authentication-Results":["smtp1.osuosl.org;\n dmarc=pass (p=quarantine dis=none)\n header.from=mind.be","smtp1.osuosl.org;\n dkim=pass (2048-bit key,\n unprotected) header.d=mind.be header.i=@mind.be header.a=rsa-sha256\n header.s=google header.b=SDpo1odT"],"Subject":"Re: [Buildroot] [PATCH v3 3/5] utils/generate-cyclonedx: generate\n externalReferences with source-distribution","X-BeenThere":"buildroot@buildroot.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Thomas Perale via buildroot ","Reply-To":"Thomas Perale ","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"buildroot-bounces@buildroot.org","Sender":"\"buildroot\" "}}]