CycloneDX / CycloneDX/cyclonedx-core-java

org.cyclonedx.model.Dependency is missing "provides" mapping according to CycloneDX 1.6 spec

Offen
#565 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Java
Sterne
120
Forks
90
Ø Merge
12 Std. 43 Min.
Gemergte PRs (30 T.)
18

Beschreibung

Hi,
looking at the CycloneDX 1.6 spec (https://cyclonedx.org/docs/1.6/json/#dependencies_items_provides), the Dependency object should be able to include a `provides` Array of Strings (bom-refs).
The current implementation of `org.cyclonedx.model.Dependency` is missing such mapping, therefore if I parse a SBOM file like:
```
{
"version": 1,
"specVersion": "1.6",
"serialNumber": "urn:uuid:fbe21a61-ba0f-3008-bc9f-fd4f0ac1aac3",
"metadata": {
"component": {
"name": "bar",
"purl": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
"timestamp": "2024-12-05T09:40:16Z"
},
"bomFormat": "CycloneDX",
"components": [
{
"name": "bar",
"purl": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"bom-ref": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
{
"name": "foo",
"purl": "pkg:maven/com.bar/foo@1.0.0?type=jar",
"bom-ref": "pkg:maven/com.bar/foo@1.0.0?type=jar",
"type": "library",
"group": "com.bar",
"version": "1.0.0"
}
],
"dependencies": [
{
"ref": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"provides": [
"pkg:maven/com.bar/foo@1.0.0?type=jar"
]
}
]
}
```

using the `org.cyclonedx.parsers.JsonParser.parse(File)` method, the `org.cyclonedx.model.Bom` is returned without any issue, but it's missing the `provides` array.

Would it be possible to update the `org.cyclonedx.model.Dependency` mapping according to 1.6 spec?

Thanks!

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start with org.cyclonedx.model.Dependency and the JsonParser.parse(File) entry point, then compare the model mapping with the CycloneDX 1.6 dependencies specification. Verify that parsing the provided JSON preserves the provides array on the returned org.cyclonedx.model.Bom.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
java
Bereich
backend-api-design
Issue-Typ
Feature
Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Aktivitätsstatus
Veraltet
Klarheit
Klar beschrieben
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.