From 958ddb5d5adb40efb546babfdea66f5d9510e28f Mon Sep 17 00:00:00 2001
From: Sanjeev Rohila <sanjeev.rohila@delphix.com>
Date: Fri, 14 Aug 2026 16:42:30 +0530
Subject: [PATCH] Add syft/cyclonedx-cli as linux-pkg packages

PR URL: https://www.github.com/delphix/linux-pkg/pull/414
---
 package-lists/build/main.pkgs    |  7 +++++++
 packages/cyclonedx-cli/config.sh | 29 +++++++++++++++++++++++++++++
 packages/syft/config.sh          | 29 +++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+)
 create mode 100755 packages/cyclonedx-cli/config.sh
 create mode 100755 packages/syft/config.sh

diff --git a/package-lists/build/main.pkgs b/package-lists/build/main.pkgs
index 429b5c7..af386e2 100644
--- a/package-lists/build/main.pkgs
+++ b/package-lists/build/main.pkgs
@@ -7,6 +7,11 @@ challenge-response
 cloud-init
 crash-python
 crypt-blowfish
+# cyclonedx-cli and syft (below) are build-host-only tooling for appliance-build's
+# CycloneDX SBOM generation (CP-13464/CP-13600) -- like delphix-go, they must never
+# be referenced by any appliance-build chroot package list, so they never ship
+# inside the appliance image despite being listed here.
+cyclonedx-cli
 delphix-go
 delphix-platform
 delphix-rust
@@ -28,6 +33,8 @@ ptools
 python-rtslib-fb
 savedump
 sdb
+# see the cyclonedx-cli comment above -- same build-host-only rule applies here.
+syft
 targetcli-fb
 virtualization
 windows-connector
diff --git a/packages/cyclonedx-cli/config.sh b/packages/cyclonedx-cli/config.sh
new file mode 100755
index 0000000..64ac6e9
--- /dev/null
+++ b/packages/cyclonedx-cli/config.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 Delphix
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# shellcheck disable=SC2034
+
+#
+# TODO(CP-13600): points at a personal dev repo while this is prototyped --
+# the author has no delphix/ org repo-creation rights. Swap to
+# https://github.com/delphix/delphix-cyclonedx-cli.git once that repo exists.
+#
+DEFAULT_PACKAGE_GIT_URL="https://github.com/justsanjeev/delphix-cyclonedx-cli.git"
+
+function build() {
+	logmust mkdir -p "$WORKDIR/repo"
+	logmust dpkg_buildpackage_default
+}
diff --git a/packages/syft/config.sh b/packages/syft/config.sh
new file mode 100755
index 0000000..ea3ec9d
--- /dev/null
+++ b/packages/syft/config.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 Delphix
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# shellcheck disable=SC2034
+
+#
+# TODO(CP-13600): points at a personal dev repo while this is prototyped --
+# the author has no delphix/ org repo-creation rights. Swap to
+# https://github.com/delphix/delphix-syft.git once that repo exists.
+#
+DEFAULT_PACKAGE_GIT_URL="https://github.com/justsanjeev/delphix-syft.git"
+
+function build() {
+	logmust mkdir -p "$WORKDIR/repo"
+	logmust dpkg_buildpackage_default
+}