Skip to content

Commit 2ae5445

Browse files
nscuronscuro
committed
feat(spec1-5): add support for additional compositions and composition identity
Signed-off-by: nscuro <[email protected]>
1 parent b02255f commit 2ae5445

6 files changed

+104
-11
lines changed

‎convert.go

+27
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,10 @@ func (b *BOM) convert(specVersion SpecVersion) {
9090
convertVulnerabilities(b.Vulnerabilities, specVersion)
9191
}
9292

93+
if b.Compositions != nil {
94+
convertCompositions(b.Compositions, specVersion)
95+
}
96+
9397
if b.ExternalReferences != nil {
9498
convertExternalReferences(b.ExternalReferences, specVersion)
9599
}
@@ -145,6 +149,19 @@ func componentConverter(specVersion SpecVersion) func(*Component) {
145149
}
146150
}
147151

152+
func convertCompositions(comps *[]Composition, specVersion SpecVersion) {
153+
if comps == nil {
154+
return
155+
}
156+
157+
for i := range *comps {
158+
comp := &(*comps)[i]
159+
if !specVersion.supportsCompositionAggregate(comp.Aggregate) {
160+
comp.Aggregate = CompositionAggregateUnknown
161+
}
162+
}
163+
}
164+
148165
// convertExternalReferences modifies an ExternalReference slice such that it adheres to a given SpecVersion.
149166
func convertExternalReferences(extRefs *[]ExternalReference, specVersion SpecVersion) {
150167
if extRefs == nil {
@@ -342,6 +359,16 @@ func (sv SpecVersion) supportsComponentType(cType ComponentType) bool {
342359
return false
343360
}
344361

362+
func (sv SpecVersion) supportsCompositionAggregate(ca CompositionAggregate) bool {
363+
switch ca {
364+
case CompositionAggregateIncompleteFirstPartyOpenSourceOnly, CompositionAggregateIncompleteFirstPartyProprietaryOnly,
365+
CompositionAggregateIncompleteThirdPartyOpenSourceOnly, CompositionAggregateIncompleteThirdPartyProprietaryOnly:
366+
return sv >= SpecVersion1_5
367+
}
368+
369+
return sv >= SpecVersion1_3
370+
}
371+
345372
func (sv SpecVersion) supportsExternalReferenceType(ert ExternalReferenceType) bool {
346373
switch ert {
347374
case ERTypeAdversaryModel,

‎cyclonedx.go

+15-9
Original file line numberDiff line numberDiff line change
@@ -169,20 +169,26 @@ type Component struct {
169169
}
170170

171171
type Composition struct {
172-
Aggregate CompositionAggregate `json:"aggregate" xml:"aggregate"`
173-
Assemblies *[]BOMReference `json:"assemblies,omitempty" xml:"assemblies>assembly,omitempty"`
174-
Dependencies *[]BOMReference `json:"dependencies,omitempty" xml:"dependencies>dependency,omitempty"`
172+
BOMRef string `json:"bom-ref,omitempty" xml:"bom-ref,attr,omitempty"`
173+
Aggregate CompositionAggregate `json:"aggregate" xml:"aggregate"`
174+
Assemblies *[]BOMReference `json:"assemblies,omitempty" xml:"assemblies>assembly,omitempty"`
175+
Dependencies *[]BOMReference `json:"dependencies,omitempty" xml:"dependencies>dependency,omitempty"`
176+
Vulnerabilities *[]BOMReference `json:"vulnerabilities,omitempty" xml:"vulnerabilities>vulnerability,omitempty"`
175177
}
176178

177179
type CompositionAggregate string
178180

179181
const (
180-
CompositionAggregateComplete CompositionAggregate = "complete"
181-
CompositionAggregateIncomplete CompositionAggregate = "incomplete"
182-
CompositionAggregateIncompleteFirstPartyOnly CompositionAggregate = "incomplete_first_party_only"
183-
CompositionAggregateIncompleteThirdPartyOnly CompositionAggregate = "incomplete_third_party_only"
184-
CompositionAggregateUnknown CompositionAggregate = "unknown"
185-
CompositionAggregateNotSpecified CompositionAggregate = "not_specified"
182+
CompositionAggregateComplete CompositionAggregate = "complete"
183+
CompositionAggregateIncomplete CompositionAggregate = "incomplete"
184+
CompositionAggregateIncompleteFirstPartyOnly CompositionAggregate = "incomplete_first_party_only"
185+
CompositionAggregateIncompleteFirstPartyOpenSourceOnly CompositionAggregate = "incomplete_first_party_opensource_only"
186+
CompositionAggregateIncompleteFirstPartyProprietaryOnly CompositionAggregate = "incomplete_first_party_proprietary_only"
187+
CompositionAggregateIncompleteThirdPartyOnly CompositionAggregate = "incomplete_third_party_only"
188+
CompositionAggregateIncompleteThirdPartyOpenSourceOnly CompositionAggregate = "incomplete_third_party_opensource_only"
189+
CompositionAggregateIncompleteThirdPartyProprietaryOnly CompositionAggregate = "incomplete_third_party_proprietary_only"
190+
CompositionAggregateNotSpecified CompositionAggregate = "not_specified"
191+
CompositionAggregateUnknown CompositionAggregate = "unknown"
186192
)
187193

188194
type Copyright struct {

‎testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-compositions.json

+16
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
],
4747
"compositions": [
4848
{
49+
"bom-ref": "composition-1",
4950
"aggregate": "complete",
5051
"assemblies": [
5152
"pkg:maven/partner/[email protected]"
@@ -59,6 +60,21 @@
5960
"assemblies": [
6061
"pkg:maven/acme/[email protected]"
6162
]
63+
},
64+
{
65+
"aggregate": "incomplete_first_party_only",
66+
"vulnerabilities": [
67+
"vulnerability-1"
68+
]
69+
}
70+
],
71+
"vulnerabilities": [
72+
{
73+
"bom-ref": "vulnerability-1",
74+
"id": "ACME-12345",
75+
"source": {
76+
"name": "Acme Inc"
77+
}
6278
}
6379
]
6480
}

‎testdata/snapshots/cyclonedx-go-TestRoundTripXML-func1-valid-compositions.xml

+15-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
</dependency>
3333
</dependencies>
3434
<compositions>
35-
<composition>
35+
<composition bom-ref="composition-1">
3636
<aggregate>complete</aggregate>
3737
<assemblies>
3838
<assembly ref="pkg:maven/partner/[email protected]"></assembly>
@@ -47,5 +47,19 @@
4747
<assembly ref="pkg:maven/acme/[email protected]"></assembly>
4848
</assemblies>
4949
</composition>
50+
<composition>
51+
<aggregate>incomplete_first_party_only</aggregate>
52+
<assemblies>
53+
<assembly ref="vulnerability-1"></assembly>
54+
</assemblies>
55+
</composition>
5056
</compositions>
57+
<vulnerabilities>
58+
<vulnerability bom-ref="vulnerability-1">
59+
<id>ACME-12345</id>
60+
<source>
61+
<name>Acme Inc</name>
62+
</source>
63+
</vulnerability>
64+
</vulnerabilities>
5165
</bom>

‎testdata/valid-compositions.json

+16
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,18 @@
4444
]
4545
}
4646
],
47+
"vulnerabilities": [
48+
{
49+
"bom-ref": "vulnerability-1",
50+
"id": "ACME-12345",
51+
"source": {
52+
"name": "Acme Inc"
53+
}
54+
}
55+
],
4756
"compositions": [
4857
{
58+
"bom-ref": "composition-1",
4959
"aggregate": "complete",
5060
"assemblies": [
5161
"pkg:maven/partner/[email protected]"
@@ -59,6 +69,12 @@
5969
"assemblies": [
6070
"pkg:maven/acme/[email protected]"
6171
]
72+
},
73+
{
74+
"aggregate": "incomplete_first_party_only",
75+
"vulnerabilities": [
76+
"vulnerability-1"
77+
]
6278
}
6379
]
6480
}

‎testdata/valid-compositions.xml

+15-1
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,16 @@
3131
<dependency ref="pkg:maven/acme/[email protected]"/>
3232
</dependency>
3333
</dependencies>
34+
<vulnerabilities>
35+
<vulnerability bom-ref="vulnerability-1">
36+
<id>ACME-12345</id>
37+
<source>
38+
<name>Acme Inc</name>
39+
</source>
40+
</vulnerability>
41+
</vulnerabilities>
3442
<compositions>
35-
<composition>
43+
<composition bom-ref="composition-1">
3644
<aggregate>complete</aggregate>
3745
<assemblies>
3846
<assembly ref="pkg:maven/partner/[email protected]"/>
@@ -47,5 +55,11 @@
4755
<assembly ref="pkg:maven/acme/[email protected]"/>
4856
</assemblies>
4957
</composition>
58+
<composition>
59+
<aggregate>incomplete_first_party_only</aggregate>
60+
<assemblies>
61+
<assembly ref="vulnerability-1"/>
62+
</assemblies>
63+
</composition>
5064
</compositions>
5165
</bom>

0 commit comments

Comments
 (0)