Thanks, applied as f02fc7ed33f83ea82a9a728fc282ba7ce79b5a61. Michael
[sent from post-receive hook] On Mon, 21 Sep 2026 08:38:20 +0200, Alexander Dahl <[email protected]> wrote: > pyspdxtools -i image-root-tgz-spdx-sbom.json gives the following error: > > externalPackageRef type in category SECURITY must be one of ['cpe22Type', > 'cpe23Type', 'advisory', 'fix', 'url', 'swid'], but is: > http://spdx.org/rdf/references/cpe23Type > > Could not find any location in spec which requires that URL in the > referenceType field. > > Link: > https://spdx.github.io/spdx-spec/v2.3/package-information/#721-external-reference-field > Link: > https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f2-security > Signed-off-by: Alexander Dahl <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/scripts/report/spdx_sbom.py b/scripts/report/spdx_sbom.py > index f39b37487222..7c4f1c6bbd1b 100644 > --- a/scripts/report/spdx_sbom.py > +++ b/scripts/report/spdx_sbom.py > @@ -121,7 +121,7 @@ class SpdxSbomGenerator(SbomGenerator): > for cpe_id in self.create_cpe_ids(pkg): > cpe = spdx.SPDXExternalReference() > cpe.referenceCategory = "SECURITY" > - cpe.referenceType = "http://spdx.org/rdf/references/cpe23Type"; > + cpe.referenceType = "cpe23Type" > cpe.referenceLocator = cpe_id > spdx_pkg.externalRefs.append(cpe) >
