[ptxdist] [PATCH 0/3] report: spdx_sbom: Assorted minor improvements

[ptxdist] [PATCH 0/3] report: spdx_sbom: Assorted minor improvements

[Alexander Dahl via ptxdist]

Hello everyone,

while reviewing CPE identifiers, and experimenting with SBOM files,
I came across some minor issues with the SPDX SBOM generator.
Not entirely sure if this can cause compatibility problems, maybe
depends on what people use that sbom for already.  So review carefully!

(Did not look into the other SBOM format (yet?).)

Greets
Alex

Alexander Dahl (3):
  report: spdx_sbom: Fixed "created" field format
  report: spdx_sbom: Fix externalPackageRef type in category SECURITY
  report: spdx_sbom: Convert pkg_name into valid idstring

 scripts/report/spdx_sbom.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


base-commit: c19a3c3a7191849f857ca396792ae919197ae9c8
-- 
2.47.3

[ptxdist] [PATCH 1/3] report: spdx_sbom: Fixed "created" field format

[Alexander Dahl via ptxdist]

SPDX tools like pyspdxtools or the online validator complain about the
timezone suffix.  While both are valid ISO-8601 strings, apparently 'Z'
is expected instead of '+00:00'.

    Error while parsing Document: ["time data '2026-09-09T12:20:03+00:00' does not match format '%Y-%m-%dT%H:%M:%SZ'"]

Link: https://tools.spdx.org/app/validate/
Link: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#69-created-field
Link: https://stackoverflow.com/a/63731605/462636
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index b9132f43c..f39b37487 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -145,7 +145,7 @@ class SpdxSbomGenerator(SbomGenerator):
     def build(self, data):
         creationInfo = spdx.SPDXCreationInfo()
         creationInfo.created = (
-            datetime.now(timezone.utc).replace(microsecond=0).isoformat()
+            datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
         )
         creationInfo.creators = [
             f"Organization: {data['bsp']['vendor']}",
-- 
2.47.3

[ptxdist] [PATCH 2/3] report: spdx_sbom: Fix externalPackageRef type in category SECURITY

[Alexander Dahl via ptxdist]

pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error:

    externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type

Could not find any location in spec which requires that URL in the
referenceType field.

Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field
Link: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index f39b37487..7c4f1c6bb 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator):
         for cpe_id in self.create_cpe_ids(pkg):
             cpe = spdx.SPDXExternalReference()
             cpe.referenceCategory = "SECURITY"
-            cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"
+            cpe.referenceType = "cpe23Type"
             cpe.referenceLocator = cpe_id
             spdx_pkg.externalRefs.append(cpe)
 
-- 
2.47.3

[ptxdist] [PATCH 3/3] report: spdx_sbom: Convert pkg_name into valid idstring

[Alexander Dahl via ptxdist]

For referenced elements the SPDX spec does not allow '_' in names, but
we have packages like for example 'lm_sensors'.

Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#72-package-spdx-identifier-field
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index 7c4f1c6bb..252828bc5 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -50,7 +50,7 @@ class SpdxSbomGenerator(SbomGenerator):
 
         spdx_pkg = spdx.SPDXPackage()
         spdx_pkg.name = pkg_name
-        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name
+        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name.replace('_', '-')
         if "version" in pkg:
             spdx_pkg.versionInfo = pkg["version"]
         if "url" in pkg:
-- 
2.47.3