Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Support for CycloneDX v1.6 #576

Merged
merged 34 commits into from
Apr 9, 2024
Merged

feat: Support for CycloneDX v1.6 #576

merged 34 commits into from
Apr 9, 2024

Conversation

madpah
Copy link
Collaborator

@madpah madpah commented Apr 3, 2024

Work in progress to add initial support for CycloneDX v1.6 specification (still in draft as this PR starts).

Resolves #577 whilst NOT resolving #578 currently.

This means new fields and values introduced by CycloneDX v1.6 are being added / supported, and fields marked as Deprecated in v1.6 are being marked as such, but any gap notes in #578 is not being addressed by this PR currently.

Whilst producing this PR gaps in v1.5 were captured in #578 and for v1.4 in #581 .

Summary of Changes

  • Deprecated bom.metadata.manufacture
  • Added bom.metadata.manufacturer
    • Set bom.metadata.component.manufacturer if bom.metadata.manufacture used?
  • Added .component.manufacturer
  • Added .component.authors
  • Deprecated .component.author
    • Set .component.manufacturer or .component.authors if .component.author used?
  • Added .component.omniborId
    • Add validation to ensure is a valid GitOID - Basic Regex validation added
  • Added .component.swhid
    • Add validation? - Basic Regex validation added
  • Added .component.cryptoProperties
  • Added .component.tags
  • Added model for postalAddress
    • Added address to OrganizationalEntity
  • Component.Version max length 1024 restriction raises a Warning if exceeded
  • Added acknowledgement attribute to licenseChoiceType.expression via add acknowledgement to LicenseExpression #582

Signed-off-by: Paul Horton <paul.horton@owasp.org>
@madpah madpah added documentation Improvements or additions to documentation enhancement New feature or request schema 1.6 labels Apr 3, 2024
@madpah madpah self-assigned this Apr 3, 2024
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Copy link

codacy-production bot commented Apr 3, 2024

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation Diff coverage
-0.75% 90.27% (target: 80.00%)
Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (35749c6) 3424 3204 93.57%
Head commit (42c6f25) 4434 (+1010) 4116 (+912) 92.83% (-0.75%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#576) 1130 1020 90.27%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

You may notice some variations in coverage metrics with the latest Coverage engine update. For more details, visit the documentation

Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
…onent.manufacturer`

Signed-off-by: Paul Horton <paul.horton@owasp.org>
…fail due to schema differences (`.component.author` not in 1.6)

Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
… deserialization to XML

Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
madpah added 14 commits April 5, 2024 08:28
Signed-off-by: Paul Horton <paul.horton@owasp.org>
…ion < 1.6

Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
tests/test_output_json.py Outdated Show resolved Hide resolved
tests/__init__.py Outdated Show resolved Hide resolved
Signed-off-by: Paul Horton <paul.horton@owasp.org>
Signed-off-by: Paul Horton <paul.horton@owasp.org>
@madpah madpah marked this pull request as ready for review April 9, 2024 06:58
@madpah madpah requested a review from a team as a code owner April 9, 2024 06:58
@madpah
Copy link
Collaborator Author

madpah commented Apr 9, 2024

@jkowalleck - ready for review. Kept this PR to the minimum requirements to support v1.6 without resolving gaps in v1.5 or v1.4 schema support as noted in #578 and #581 .

If we can ship this as is, happy to tackle the gaps separately.

@madpah madpah requested a review from jkowalleck April 9, 2024 07:03
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
cyclonedx/model/__init__.py Show resolved Hide resolved
cyclonedx/model/__init__.py Show resolved Hide resolved
cyclonedx/model/bom.py Show resolved Hide resolved
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck and others added 2 commits April 9, 2024 16:45
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Automatically generated by python-semantic-release

Signed-off-by: semantic-release <semantic-release>
@madpah madpah merged commit 8bbdf46 into main Apr 9, 2024
2 of 3 checks passed
@madpah madpah deleted the feat/support-cyclonedx-1.6 branch April 10, 2024 06:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking change documentation Improvements or additions to documentation enhancement New feature or request schema 1.6
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support for CycloneDX 1.6
2 participants