[ptxdist] [PATCH 2/3] report: spdx_sbom: Fix externalPackageRef type in category SECURITY

[Alexander Dahl via ptxdist <ptxdist@pengutronix.de>]

pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error:

    externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type

Could not find any location in spec which requires that URL in the
referenceType field.

Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field
Link: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index f39b37487..7c4f1c6bb 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator):
         for cpe_id in self.create_cpe_ids(pkg):
             cpe = spdx.SPDXExternalReference()
             cpe.referenceCategory = "SECURITY"
-            cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"
+            cpe.referenceType = "cpe23Type"
             cpe.referenceLocator = cpe_id
             spdx_pkg.externalRefs.append(cpe)
 
-- 
2.47.3