CycloneDX / CycloneDX/cyclonedx-rust-cargo

Investigate using tools to generate serialization / deserialization implementations

Open
#88 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
178
Forks
66
PR merge metrics
No merged PRs in 30d

Description

Since we are splitting the internal data-model from the serialization / deserialization code in #77, we should consider auto-generating the implementations based on the [schema definitions in the `CycloneDX/specification` repository](https://github.com/CycloneDX/specification/tree/master/schema).

### Potential Options For Consideration
- For XML, there isn't a clear option that looks feature-complete enough for consideration yet, but [`lumeohq/xsd-parser-rs`](https://github.com/lumeohq/xsd-parser-rs) is the most complete option found during initial research
- [`schemafy`](https://crates.io/crates/schemafy) for JSON Schema
- [`protobuf`](https://crates.io/crates/protobuf) for Protobuf

### Acceptance Criteria

- [ ] Deserialization validates the schema version, but is otherwise accepting of non-conformant data (following the [Robustness Principle](https://en.wikipedia.org/wiki/Robustness_principle) of gracefully handling invalid data, but only outputting valid data.)
- [ ] The process for generating new schema implementation versions of the code should be automated and documented

Contributor guide

Open the contributing guide

Research direction

Start by reading the internal data-model split described in #77 and the schema definitions in the CycloneDX/specification repository. Compare the listed Rust generation options for XML and JSON Schema, then define an automated, documented version-generation process that validates schema versions while accepting otherwise non-conformant input.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.