From: Michael Olbrich <m.olbrich@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Alexander Dahl <ada@thorsis.com>
Subject: Re: [ptxdist] [APPLIED] report: spdx_sbom: Fix externalPackageRef type in category SECURITY
Date: Mon, 21 Sep 2026 08:38:20 +0200 [thread overview]
Message-ID: <20260921063820.3168418-1-m.olbrich@pengutronix.de> (raw)
In-Reply-To: <20260914112311.93693-3-ada@thorsis.com>
Thanks, applied as f02fc7ed33f83ea82a9a728fc282ba7ce79b5a61.
Michael
[sent from post-receive hook]
On Mon, 21 Sep 2026 08:38:20 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error:
>
> externalPackageRef type in category SECURITY must be one of ['cpe22Type', 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: http://spdx.org/rdf/references/cpe23Type
>
> Could not find any location in spec which requires that URL in the
> referenceType field.
>
> Link: https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field
> Link: https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260914112311.93693-3-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>
> diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py
> index f39b37487222..7c4f1c6bbd1b 100644
> --- a/scripts/report/spdx_sbom.py
> +++ b/scripts/report/spdx_sbom.py
> @@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator):
> for cpe_id in self.create_cpe_ids(pkg):
> cpe = spdx.SPDXExternalReference()
> cpe.referenceCategory = "SECURITY"
> - cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"
> + cpe.referenceType = "cpe23Type"
> cpe.referenceLocator = cpe_id
> spdx_pkg.externalRefs.append(cpe)
>
next prev parent reply other threads:[~2026-09-21 6:38 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-14 11:23 [ptxdist] [PATCH 0/3] report: spdx_sbom: Assorted minor improvements Alexander Dahl via ptxdist
2026-09-14 11:23 ` [ptxdist] [PATCH 1/3] report: spdx_sbom: Fixed "created" field format Alexander Dahl via ptxdist
2026-09-21 6:38 ` [ptxdist] [APPLIED] " Michael Olbrich
2026-09-14 11:23 ` [ptxdist] [PATCH 2/3] report: spdx_sbom: Fix externalPackageRef type in category SECURITY Alexander Dahl via ptxdist
2026-09-21 6:38 ` Michael Olbrich [this message]
2026-09-14 11:23 ` [ptxdist] [PATCH 3/3] report: spdx_sbom: Convert pkg_name into valid idstring Alexander Dahl via ptxdist
2026-09-21 6:38 ` [ptxdist] [APPLIED] " Michael Olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921063820.3168418-1-m.olbrich@pengutronix.de \
--to=m.olbrich@pengutronix.de \
--cc=ada@thorsis.com \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox