Commit Graph
2 Commits
Author SHA1 Message Date
Cui Shuang 67eb69a1ae scripts: fix CycloneDX BOM version type
CycloneDX 1.4 requires the top-level BOM version to be an integer.
Emit numeric 1 so SBOMs generated from both APK and opkg package
indexes conform to the schema.

Signed-off-by: Cui Shuang <imcusg@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25059
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-09-07 09:58:43 +02:00
Florian Eckert 10d9dbe838 build: add CycloneDX SBOM processing to apk
Currently, there is no SBOM generation in imagebuilder when the package
system 'apk' is used. This commit adds this feature back. This already
worked for the package system 'opkg'.

Furthermore, generating the SBOM using perl is not reproducible if the
input data has not changed. A different file is always generated. This is
not the case with Python. For this reason, Python is now used to generate
the SBOM for the imagebuilder.

The script has already been prepared so that it can also process the opkg
package system for generating the SBOM.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-05-17 12:21:09 +02:00