CycloneDX / CycloneDX/cyclonedx-python-lib

feat: add `cyclonedx.model.dependency.Dependency.provides`

未关闭
#691 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
enhancement help wanted schema 1.6
主要语言
Python
星标
116
派生
67
平均合并
8 天 2 小时
30 天内合并 PR
2

描述

**Library Version:** `7.6.1`

**Description:**

**Steps to Reproduce:**
1. Use the example JSON provided in the [CycloneDX bom-examples repository](https://github.com/CycloneDX/bom-examples/blob/c0436d86cd60693f01d19fe1aacfd01e70e17036/CBOM/Example-With-Dependencies/bom.json).
2. Run the following script:

```python
import json
from cyclonedx.model.bom import Bom

# source: https://github.com/CycloneDX/bom-examples/blob/c0436d86cd60693f01d19fe1aacfd01e70e17036/CBOM/Example-With-Dependencies/bom.json

sample = '''{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
"version": 1,
"metadata": {
"component": {
"type": "application",
"bom-ref": "acme-application",
"name": "Acme Application",
"version": "1.0"
}
},
"components": [
{
"type": "cryptographic-asset",
"bom-ref": "aes128gcm",
"name": "AES",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "ae",
"parameterSetIdentifier": "128",
"executionEnvironment": "software-plain-ram",
"implementationPlatform": "x86_64",
"certificationLevel": [ "none" ],
"mode": "gcm",
"cryptoFunctions": ["keygen", "encrypt", "decrypt", "tag"],
"classicalSecurityLevel": 128,
"nistQuantumSecurityLevel": 1
},
"oid": "2.16.840.1.101.3.4.1.6"
}
},
{
"type": "library",
"bom-ref": "crypto-library",
"name": "Crypto library",
"version": "1.0.0"
},
{
"type": "library",
"bom-ref": "some-library",
"name": "Some library",
"version": "1.0.0"
}
],
"dependencies": [
{
"ref": "acme-application",
"dependsOn": ["crypto-library"]
},
{
"ref": "crypto-library",
"provides": ["aes128gcm"],
"dependsOn": ["some-library"]
}
]
}'''

data = json.loads(sample)

Bom.from_json(data=data)
```

**Observed Behavior:**
The code fails with the following exception:

```
Traceback (most recent call last):
...
ValueError: Unexpected key provides/provides in data being serialized to cyclonedx.model.dependency.Dependency
```

**Environment:**
- Python version: `3.10`
- Operating System: `macOS`
- Library version: `7.6.1`

Let me know if this works!

贡献指南

打开贡献指南

调研方向

Start at cyclonedx.model.dependency.Dependency and the Bom.from_json(data=data) entry point; inspect how dependency fields are deserialized. Add support for the provides field shown in the CycloneDX 1.6 example, then run the reproduction script and confirm Bom.from_json no longer raises the reported ValueError.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
security
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。