Some packages in customer BSPs have internaly set proprietary in their license tag. Those packages should be ignored in the license parsing.
Signed-off-by: Michael Grzeschik <[email protected]> --- scripts/report/cyclonedx_sbom.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/report/cyclonedx_sbom.py b/scripts/report/cyclonedx_sbom.py index 70bf7ab7a..594824f3f 100644 --- a/scripts/report/cyclonedx_sbom.py +++ b/scripts/report/cyclonedx_sbom.py @@ -72,7 +72,7 @@ class CycloneDXSbomGenerator(SbomGenerator): ) if licenses := pkg.get('licenses', None): - if licenses != 'ignore': + if licenses != 'ignore' and licenses != 'proprietary': component.licenses = [ self.lc_factory.make_from_string(licenses)] @@ -93,7 +93,7 @@ class CycloneDXSbomGenerator(SbomGenerator): lic.url = prefix + file_path license_list.append(lic) component.evidence = ComponentEvidence(licenses=license_list) - elif licenses != 'ignore' and not parent: + elif licenses != 'ignore' and licenses != 'proprietary' and not parent: print(f'Warning: missing license-files for "{pkg_name}"') if urls := pkg.get('url', None): -- 2.47.3
