cdxgen: new port, version 13.1.0 - #34520
Open
jrjsmrtn wants to merge 2 commits into
Open
Conversation
Only obom uses osquery, so it is a +obom variant rather than a dependency of every SBOM. package.json requires node 24, which the npm PortGroup's path:bin/node dependency does not guarantee; a pre-fetch check reports an older one. npm.version 11 to match, since npm10 pulls the conflicting nodejs22.
jrjsmrtn
force-pushed
the
add-cdxgen-port
branch
from
September 5, 2026 10:01
a3a0681 to
22020df
Compare
cdxgen's macOS profile queries homebrew_packages but has no MacPorts equivalent, so an OBOM on a MacPorts system lists applications, launch agents and installer receipts while every installed port is invisible. The query needs a macports_packages table, which osquery does not ship (osquery/osquery#9074 proposes one); until then an Automatic Table Construction config over the registry supplies it. Where neither is present cdxgen skips the query silently, since executeOsQuery suppresses "no such table". Applied in post-destroot rather than through patchfiles: the npm PortGroup installs the package during destroot, so worksrcpath is empty when the patch phase runs and patchfiles has nothing to act on. The block errors out if the query profile is not where it is expected, rather than producing a port that quietly lacks the query. Measured on an Intel Mac with the ATC table configured: the OBOM went from 2503 to 3011 components, the 508 extra rows being the installed ports.
barracuda156
left a comment
barracuda156
left a comment
Contributor
There was a problem hiding this comment.
Please at least review what you submit. Formatting is broken.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
New port:
cdxgen, which generates CycloneDX bills of materials from manifests andlockfiles.
Related to #34515: the
+obomvariant needsport:osquery, and only the update in thatPR is installable. The default variant has no such dependency, so this can merge either
way — only
+obomis affected.Only
obomuses osquery, hence a variant rather than a dependency of every SBOM; it alsowraps the
cdxgenandobomlaunchers soOSQUERY_CMDdefaults to the port, sincecdxgen otherwise downloads its own binary at run time.
package.jsonrequires node 24,which
path:bin/nodedoes not guarantee, so apre-fetchcheck reports an older one.Type(s)
Tested on
macOS 26.6.2 25G83 arm64
Xcode 26.6 17F113
Verification
Have you
port lint?sudo port -vs install?Both variants tested: default gave a 334-component SBOM,
+oboma 3227-componentoperations BOM. Trace mode is unavailable on arm64, so
-vsrather than-vst.