feat(package): track if binary packages are essential

src/debsbom/dpkg/package.py

@@ -569,6 +569,7 @@ class BinaryPackage(Package):
     provides: list[VirtualPackage]
     built_using: list[Dependency]
     description: str | None
+    essential: bool
     manually_installed: bool
     status: DpkgStatus
     _locator: str | None = None
@@ -585,6 +586,7 @@ def __init__(
         provides: list[VirtualPackage] = [],
         built_using: list[Dependency] = [],
         description: str | None = None,
+        essential: bool = False,
         homepage: str | None = None,
         checksums: dict[ChecksumAlgo, str] | None = None,
         manually_installed: bool = True,
@@ -600,6 +602,7 @@ def __init__(
         self.provides = provides
         self.built_using = built_using
         self.description = description
+        self.essential = essential
         self.homepage = homepage
         self.checksums = checksums or {}
         self.manually_installed = manually_installed
@@ -654,6 +657,7 @@ def merge_with(self, other: "BinaryPackage"):
             self.source = other.source
         if not self.description:
             self.description = other.description
+        self.essential |= other.essential
         self.manually_installed |= other.manually_installed
         # we cannot merge the status, but if the other package is
         # marked as installed, consider all as installed.
@@ -759,6 +763,7 @@ def from_deb822(cls, package) -> "BinaryPackage":
             provides=provides,
             built_using=sdepends,
             description=cls._cleanup_description(package.get("Description")),
+            essential=package.get("Essential") == "yes",
             homepage=package.get("Homepage"),
             checksums=checksums_from_package(package),
             status=status,

src/debsbom/generate/cdx.py

@@ -79,6 +79,9 @@ def cdx_package_repr(
     if package.is_binary():
         entry.description = package.description
         entry.properties.add(cdx_model.Property(name="section", value=package.section))
+        entry.properties.add(
+            cdx_model.Property(name="essential", value="yes" if package.essential else "no")
+        )
         logger.debug(f"Created binary component: {entry}")
     elif package.is_source():
         if package.vcs:

tests/test_download.py

@@ -143,12 +143,12 @@ def test_package_resolver_resolve_spdx(spdx_bomfile, tmpdir, sdl):
     rs_cache = PersistentResolverCache(cachedir)
     urs = UpstreamResolver(sdl, rs_cache)
 
-    files = list(urs.resolve(next(prs)))
+    files = list(urs.resolve(next(filter(lambda p: p.name == "binutils", prs))))
     assert "binutils" in files[0].filename
 
     # resolve with cache
     prs = PackageResolver.create(spdx_bomfile)
-    files = list(urs.resolve(next(prs)))
+    files = list(urs.resolve(next(filter(lambda p: p.name == "binutils", prs))))
     assert "binutils" in files[0].filename
 
 
@@ -210,7 +210,7 @@ def test_repack(tmpdir, spdx_bomfile, cdx_bomfile, http_session, sdl):
 
         # download a single package
         dl = PackageDownloader(dl_dir, session=http_session)
-        for p in filter_sources(pkgs):
+        for p in filter(lambda p: p.name == "binutils", filter_sources(pkgs)):
             dl.register(urs.resolve(p), p)
         files = list(dl.download())
         assert len(files) == 3