Re: git: e1e9bd085a96 - main - security/cdxgen: New port

On 2026-03-29 23:04, Torsten Zuehlsdorff wrote:
> The branch main has been updated by tz:
>
> URL: https://cgit.FreeBSD.org/ports/commit/?id=e1e9bd085a96566bf8fc124e6211cc7882bb7567
>
> commit e1e9bd085a96566bf8fc124e6211cc7882bb7567
> Author:     Torsten Zuehlsdorff <tz@FreeBSD.org>
> AuthorDate: 2026-03-29 21:01:07 +0000
> Commit:     Torsten Zuehlsdorff <tz@FreeBSD.org>
> CommitDate: 2026-03-29 21:04:40 +0000
>
>      security/cdxgen: New port
>      
>        cdxgen generates CycloneDX SBOMs for multiple programming
>        languages and ecosystems.
>      
>        It supports scanning source code, containers, and binaries
>        to produce Software Bill of Materials outputs.
>      
>        Project page:
>        https://github.com/CycloneDX/cdxgen
>      
>      Sponsored by:   OTTRIA
> ---
>   security/Makefile         |    1 +
>   security/cdxgen/Makefile  |   44 +
>   security/cdxgen/distinfo  |    5 +
>   security/cdxgen/pkg-descr |    5 +
>   security/cdxgen/pkg-plist | 7850 +++++++++++++++++++++++++++++++++++++++++++++
>   5 files changed, 7905 insertions(+)
>
> diff --git a/security/Makefile b/security/Makefile
> index e3e8b829822e..38391054232a 100644
> --- a/security/Makefile
> +++ b/security/Makefile
> @@ -74,6 +74,7 @@
>       SUBDIR += cargo-audit
>       SUBDIR += ccrypt
>       SUBDIR += ccsrch
> +    SUBDIR += cdxgen
>       SUBDIR += certificate_maker
>       SUBDIR += certmgr
>       SUBDIR += certmonger
> diff --git a/security/cdxgen/Makefile b/security/cdxgen/Makefile
> new file mode 100644
> index 000000000000..8d842290ed54
> --- /dev/null
> +++ b/security/cdxgen/Makefile
> @@ -0,0 +1,44 @@
> +PORTNAME=	cdxgen
Please review 
https://docs.freebsd.org/en/books/porters-handbook/book/#makefile-master_sites-github
DISTVERSIONPREFIX is missing
PORTVERSION --> DISTVERSION
> +PORTVERSION=	12.1.2
> +CATEGORIES=	security devel
> +
> +MAINTAINER=	miguel@ottria.eu
> +COMMENT=	CycloneDX SBOM generator CLI
> +WWW=		https://github.com/CycloneDX/cdxgen
> +
> +LICENSE=	APACHE20
> +LICENSE_FILE=	${WRKSRC}/LICENSE
> +
> +USES=		nodejs:run shebangfix
> +SHEBANG_FILES=	bin/*.js contrib/jupyter-notebook-example/setup.sh
> +
Below should be placed under CATEGORIES and there have been discussions 
recently that instructions on how to assets are generated should be 
documented.
You probably also want to use MASTER_SITES+=
https://lists.freebsd.org/archives/dev-commits-ports-all/2026-February/192668.html
See also, 
https://docs.freebsd.org/en/books/porters-handbook/book/#porting-master-sites-n 

> +MASTER_SITES=	https://github.com/OTTRIA/freebsd-port-cdxgen-node-modules/raw/refs/heads/master/
> +DISTFILES+=	cdxgen-${PORTVERSION}-node_modules.tar.gz
> +
> +USE_GITHUB=	yes
> +GH_ACCOUNT=	CycloneDX
> +GH_PROJECT=	cdxgen
> +GH_TAGNAME=	v${PORTVERSION}
Defining GH_TAGNAME is unnecessary, see GitHub section in Porters Handbook
> +
> +NO_BUILD=	yes
> +INSTDIR=	${STAGEDIR}${PREFIX}/lib/node_modules/@cyclonedx/${PORTNAME}
> +
> +do-install:
> +	${MKDIR} ${INSTDIR}
> +	${CP} -a ${WRKSRC}/ ${INSTDIR}/
Using cp instead of helpers is probably not what you want to use here?
> +	${CHMOD} +x ${INSTDIR}/bin/*.js
> +	${MKDIR} ${STAGEDIR}${PREFIX}/bin
> +
> +.for bin in cdxgen evinse repl verify
You probably want ${RLN]?
> +	${LN} -sf ../lib/node_modules/@cyclonedx/${PORTNAME}/bin/${bin}.js ${STAGEDIR}${PREFIX}/bin/${bin}
> +.endfor
> +
> +post-extract:
> +	cd ${WRKSRC} && ${TAR} -xzf ${DISTDIR}/cdxgen-${PORTVERSION}-node_modules.tar.gz
The above should be handled by the framework?
> +
> +post-install:
> +	${RM} -rf ${INSTDIR}/.github ${INSTDIR}/test ${INSTDIR}/docs
Pass --exclude instead to tar instead?
> +	@${FIND} ${INSTDIR} -type f -perm -002 -exec ${CHMOD} o-w {} \;
> +	@${FIND} ${INSTDIR} -type d -perm -002 -exec ${CHMOD} o-w {} \;
> +
> +.include <bsd.port.mk>

Best regards,
Daniel