CycloneDX / CycloneDX/cyclonedx-core-java
org.cyclonedx.model.Dependency is missing "provides" mapping according to CycloneDX 1.6 spec
- Langage dominant
- Java
- Étoiles
- 120
- Forks
- 90
- Merge moyen
- 12 h 43 min
- PR mergées (30 j)
- 18
Description
Hi,
looking at the CycloneDX 1.6 spec (https://cyclonedx.org/docs/1.6/json/#dependencies_items_provides), the Dependency object should be able to include a `provides` Array of Strings (bom-refs).
The current implementation of `org.cyclonedx.model.Dependency` is missing such mapping, therefore if I parse a SBOM file like:
```
{
"version": 1,
"specVersion": "1.6",
"serialNumber": "urn:uuid:fbe21a61-ba0f-3008-bc9f-fd4f0ac1aac3",
"metadata": {
"component": {
"name": "bar",
"purl": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
"timestamp": "2024-12-05T09:40:16Z"
},
"bomFormat": "CycloneDX",
"components": [
{
"name": "bar",
"purl": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"bom-ref": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
{
"name": "foo",
"purl": "pkg:maven/com.bar/foo@1.0.0?type=jar",
"bom-ref": "pkg:maven/com.bar/foo@1.0.0?type=jar",
"type": "library",
"group": "com.bar",
"version": "1.0.0"
}
],
"dependencies": [
{
"ref": "pkg:maven/com.foo/bar@1.0.0?type=jar",
"provides": [
"pkg:maven/com.bar/foo@1.0.0?type=jar"
]
}
]
}
```
using the `org.cyclonedx.parsers.JsonParser.parse(File)` method, the `org.cyclonedx.model.Bom` is returned without any issue, but it's missing the `provides` array.
Would it be possible to update the `org.cyclonedx.model.Dependency` mapping according to 1.6 spec?
Thanks!
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez par org.cyclonedx.model.Dependency et le point d’entrée JsonParser.parse(File), puis comparez le mappage du modèle avec la spécification des dépendances de CycloneDX 1.6. Vérifiez que l’analyse du JSON fourni préserve le tableau provides dans le org.cyclonedx.model.Bom renvoyé.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- java
- Domaine
- backend-api-design
- Type d'issue
- Fonctionnalité
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- À l'abandon
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 35/100