[ptxdist] [PATCH 0/3] report: spdx_sbom: Assorted minor improvements

[ptxdist] [PATCH 0/3] report: spdx_sbom: Assorted minor improvements

[Alexander Dahl via ptxdist]

Hello everyone,

while reviewing CPE identifiers, and experimenting with SBOM files,
I came across some minor issues with the SPDX SBOM generator.
Not entirely sure if this can cause compatibility problems, maybe
depends on what people use that sbom for already.  So review carefully!

(Did not look into the other SBOM format (yet?).)

Greets
Alex

Alexander Dahl (3):
  report: spdx_sbom: Fixed "created" field format
  report: spdx_sbom: Fix externalPackageRef type in category SECURITY
  report: spdx_sbom: Convert pkg_name into valid idstring

 scripts/report/spdx_sbom.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


base-commit: c19a3c3a7191849f857ca396792ae919197ae9c8
-- 
2.47.3

[ptxdist] [PATCH 1/3] report: spdx_sbom: Fixed "created" field format

[Alexander Dahl via ptxdist]

SPDX tools like pyspdxtools or the online validator complain about the
timezone suffix.  While both are valid ISO-8601 strings, apparently 'Z'
is expected instead of '+00:00'.

    Error while parsing Document: ["time data '2026-09-09T12:20:03+00:00' does not match format '%Y-%m-%dT%H:%M:%SZ'"]

Link: https://tools.spdx.org/app/validate/
Link: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#69-created-field
Link: https://stackoverflow.com/a/63731605/462636
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index b9132f43c..f39b37487 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -145,7 +145,7 @@ class SpdxSbomGenerator(SbomGenerator):
     def build(self, data):
         creationInfo = spdx.SPDXCreationInfo()
         creationInfo.created = (
-            datetime.now(timezone.utc).replace(microsecond=0).isoformat()
+            datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
         )
         creationInfo.creators = [
             f"Organization: {data['bsp']['vendor']}",
-- 
2.47.3

[ptxdist] [PATCH 2/3] report: spdx_sbom: Fix externalPackageRef type in category SECURITY

[Alexander Dahl via ptxdist]

pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error:

    externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type

Could not find any location in spec which requires that URL in the
referenceType field.

Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field
Link: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index f39b37487..7c4f1c6bb 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator):
         for cpe_id in self.create_cpe_ids(pkg):
             cpe = spdx.SPDXExternalReference()
             cpe.referenceCategory = "SECURITY"
-            cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"
+            cpe.referenceType = "cpe23Type"
             cpe.referenceLocator = cpe_id
             spdx_pkg.externalRefs.append(cpe)
 
-- 
2.47.3

[ptxdist] [PATCH 3/3] report: spdx_sbom: Convert pkg_name into valid idstring

[Alexander Dahl via ptxdist]

For referenced elements the SPDX spec does not allow '_' in names, but
we have packages like for example 'lm_sensors'.

Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#72-package-spdx-identifier-field
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 scripts/report/spdx_sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
index 7c4f1c6bb..252828bc5 100644
--- a/scripts/report/spdx_sbom.py
+++ b/scripts/report/spdx_sbom.py
@@ -50,7 +50,7 @@ class SpdxSbomGenerator(SbomGenerator):
 
         spdx_pkg = spdx.SPDXPackage()
         spdx_pkg.name = pkg_name
-        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name
+        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name.replace('_', '-')
         if "version" in pkg:
             spdx_pkg.versionInfo = pkg["version"]
         if "url" in pkg:
-- 
2.47.3

Re: [ptxdist] [APPLIED] report: spdx_sbom: Fixed "created" field format

[Michael Olbrich]

Thanks, applied as 080d3d32cbc0407f3faa316415c2eee6af831ce4.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:19 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> SPDX tools like pyspdxtools or the online validator complain about the
> timezone suffix.  While both are valid ISO-8601 strings, apparently 'Z'
> is expected instead of '+00:00'.
> 
>     Error while parsing Document: ["time data '2026-09-09T12:20:03+00:00' does not match format '%Y-%m-%dT%H:%M:%SZ'"]
> 
> Link: https://tools.spdx.org/app/validate/
> Link: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#69-created-field
> Link: https://stackoverflow.com/a/63731605/462636
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914112311.93693-2-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
> index b9132f43c74e..f39b37487222 100644
> --- a/scripts/report/spdx_sbom.py
> +++ b/scripts/report/spdx_sbom.py
> @@ -145,7 +145,7 @@ class SpdxSbomGenerator(SbomGenerator):
>      def build(self, data):
>          creationInfo = spdx.SPDXCreationInfo()
>          creationInfo.created = (
> -            datetime.now(timezone.utc).replace(microsecond=0).isoformat()
> +            datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
>          )
>          creationInfo.creators = [
>              f"Organization: {data['bsp']['vendor']}",

Re: [ptxdist] [APPLIED] report: spdx_sbom: Fix externalPackageRef type in category SECURITY

[Michael Olbrich]

Thanks, applied as f02fc7ed33f83ea82a9a728fc282ba7ce79b5a61.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:20 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error:
> 
>     externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type
> 
> Could not find any location in spec which requires that URL in the
> referenceType field.
> 
> Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field
> Link: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914112311.93693-3-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
> index f39b37487222..7c4f1c6bbd1b 100644
> --- a/scripts/report/spdx_sbom.py
> +++ b/scripts/report/spdx_sbom.py
> @@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator):
>          for cpe_id in self.create_cpe_ids(pkg):
>              cpe = spdx.SPDXExternalReference()
>              cpe.referenceCategory = "SECURITY"
> -            cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"
> +            cpe.referenceType = "cpe23Type"
>              cpe.referenceLocator = cpe_id
>              spdx_pkg.externalRefs.append(cpe)
>  

Re: [ptxdist] [APPLIED] report: spdx_sbom: Convert pkg_name into valid idstring

[Michael Olbrich]

Thanks, applied as 484097bacab0b8987074a54b86b28969bbe351c9.

Michael

[sent from post-receive hook]

On Mon, 21 Sep 2026 08:38:21 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> For referenced elements the SPDX spec does not allow '_' in names, but
> we have packages like for example 'lm_sensors'.
> 
> Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#72-package-spdx-identifier-field
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914112311.93693-4-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
> index 7c4f1c6bbd1b..252828bc5136 100644
> --- a/scripts/report/spdx_sbom.py
> +++ b/scripts/report/spdx_sbom.py
> @@ -50,7 +50,7 @@ class SpdxSbomGenerator(SbomGenerator):
>  
>          spdx_pkg = spdx.SPDXPackage()
>          spdx_pkg.name = pkg_name
> -        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name
> +        spdx_pkg.SPDXID = "SPDXRef-" + pkg_name.replace('_', '-')
>          if "version" in pkg:
>              spdx_pkg.versionInfo = pkg["version"]
>          if "url" in pkg: