staging/jow/scripts/package-metadata.pl, branch main

build: add explicit timezone in CycloneDX SBOM

2024-06-07T10:05:49Z

The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Per the CycloneDX 1.4 spec, the `metadata.timestamp` field contains the date/time when the BOM was created [1]. Before the change, the value generated by the package-metadata.pl script would look like this: 2024-06-03T15:51:10 CycloneDX 1.4 relies on the JSON Schema specification version draft-07, which defines the `date-time` format [2] as derived from RFC 3339, section 5.6 [3]. In this format, the `time-offset` component is required, however in the original version of package-metadata.pl it is omitted. This is causing problems with OWASP Dependency-Track version 4.11.0 or newer, where it now validates submitted SBOMs against the JSON schema by default [4]. SBOMs with incorrect timestamp values are rejected with the following error: { "detail": "Schema validation failed", "errors": [ "$.metadata.timestamp: 2024-06-03T15:51:10 is an invalid date-time" ], "status": 400, "title": "The uploaded BOM is invalid" } Add explicit `Z` (UTC) timezone offset in the `timestamp` field to satisfy the CycloneDX schema. [1]: https://github.com/CycloneDX/specification/blob/1.4/schema/bom-1.4.schema.json#L116-L121 [2]: https://json-schema.org/draft-07/draft-handrews-json-schema-validation-01#rfc.section.7.3.1 [3]: https://datatracker.ietf.org/doc/html/rfc3339#section-5.6 [4]: https://github.com/DependencyTrack/dependency-track/pull/3522 Signed-off-by: Roman Azarenko

build: fix version info in cyclonedx sbom

2024-05-25T17:27:06Z

Prior e8725a932e16eaf6ec51add8c084d959cbe32ff2, version used to be VERSION:=$(PKG_VERSION)-$(PKG_RELEASE) After e8725a932e16eaf6ec51add8c084d959cbe32ff2, the version is: VERSION:=$(PKG_VERSION)-r$(PKG_RELEASE) Hence the gen_*_cyclonedxsbom functions need to be updated to remove the trailing -r prefix in the version in order to generate correct version info in the SBOM. Signed-off-by: Akshay Bhat

build: add APK package build capabilities

2024-05-17T20:21:26Z

A new option called `USE_APK` is added which generated APK packages (.apk) instead of OPKG packages (.ipk). Some features like fstools `snapshot` command are not yet ported Signed-off-by: Paul Spooren

build: fix kernel component in CycloneDX SBOM

2024-03-01T15:42:34Z

As stated in the cycloneDX documentation, the field "type" is mandatory for all components. More details here (https://cyclonedx.org/docs/1.5/json/#components_items_type) Signed-off-by: Cedric DOURLENT

build: add CycloneDX SBOM JSON support

2023-11-01T11:14:41Z

CycloneDX is an open source standard developed by the OWASP foundation. It supports a wide range of development ecosystems, a comprehensive set of use cases, and focuses on automation, ease of adoption, and progressive enhancement of SBOMs (Software Bill Of Materials) throughout build pipelines. So lets add support for CycloneDX SBOM for packages and images manifests. Signed-off-by: Petr Štetiar

package-metadata: add CPE information to JSON package manifests

2023-11-01T11:14:39Z

Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. In order for the information to be processed further, it should also be available in JSON package manifests. Signed-off-by: Petr Štetiar

scripts/package-metadata.pl: strip already selected conditions from dependencies

2023-09-01T17:30:32Z

When a dependency is pulled in via conditional depends, and the condition is already selected earlier in the chain, drop the condition. This avoids some corner cases that trigger recursive dependencies. Signed-off-by: Felix Fietkau

Revert "scripts/package-metadata.pl: fix handling transitive conditional dependencies"

2023-09-01T16:34:58Z

This reverts commit 6c3eff9dd8bb8d0f268e8a0dbedbc6a33bdac796. This appears to cause some regressions in generated config. Will be replaced with a fixed version later Signed-off-by: Felix Fietkau

scripts/package-metadata.pl: sort dependency keys

2023-09-01T16:34:20Z

This makes it easier to keep track of changes in the generated output, when the script is modified Signed-off-by: Felix Fietkau

scripts/package-metadata.pl: fix handling transitive conditional dependencies

2023-09-01T10:18:13Z

When a package foo depends on PACKAGE_foo:bar (in order to make build dependencies conditional), tracking transitive dependencies can fail because the internal seen flag is checked/set before eliminating the fake conditional dependency. This can show up as a depends on not properly turned into a select further down in the dependency chain Signed-off-by: Felix Fietkau