Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[FEAT] basic CDX 1.5 #404

Closed
jkowalleck opened this issue Jul 5, 2023 · 7 comments · Fixed by #492 or #488
Closed

[FEAT] basic CDX 1.5 #404

jkowalleck opened this issue Jul 5, 2023 · 7 comments · Fixed by #492 or #488
Labels
enhancement New feature or request schema 1.5

Comments

@jkowalleck
Copy link
Member

jkowalleck commented Jul 5, 2023 •
edited
Loading

@jkowalleck jkowalleck added schema 1.5 enhancement New feature or request labels Jul 5, 2023
@jkowalleck jkowalleck pinned this issue Jul 5, 2023
@jkowalleck
Copy link
Member Author

after this was done, the new data models from CDX 1.5 can be added

@jkowalleck
Copy link
Member Author

should depend on #432
so that proper data validation was done

@jkowalleck jkowalleck changed the title basic CDX 1.5 [FEAT] basic CDX 1.5 Nov 16, 2023
@maitrey
Copy link

maitrey commented Nov 23, 2023

Hi! We are interested in cdx-1.5 format( https://cyclonedx.org/docs/1.5/xml/ ).
When is it expected?

@Churro Churro mentioned this issue Nov 26, 2023
Merged
@jkowalleck
Copy link
Member Author

When is it expected?

This is community-driven open source software.
Feel free to contribute the features you need, just like #448 did

jkowalleck added a commit that referenced this issue Nov 27, 2023
@Churro @jkowalleck
feat: add basic support for CDX 1.5 (#488)
313a6fe 
This PR introduces basic support for CDX 1.5.

Ref: 
- #404

**Schema:** 

- Extended schema-downloader and added specification files, 
- Adapted `README` and `SchemaVersion` for 1.5

**Model:** 

- Added `SchemaVersion1Dot5`, serializable annotations, 
- Extended `ComponentType` and `ExternalReferenceType` enums

**Tests:** 

- Generated snapshots for 1.5. 
- In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4

**Chore:**

-  Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support

----

* feat: add basic support for CDX 1.5

Signed-off-by: Johannes Feichtner <[email protected]>

* docs: note minversions of `HashAlgorithm` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: set ref after schema download

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: add the newly missing/TODO elements

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: note minversions of `ComponentType` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: update to latest CDX meta

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* feat: new enum cases fr VulnerabilityScoreSource

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* tests: adjust to latest implementation

Signed-off-by: Jan Kowalleck <[email protected]>

* revert deletion by accident

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Co-authored-by: Jan Kowalleck <[email protected]>
jkowalleck added a commit that referenced this issue Nov 28, 2023
@Churro @jkowalleck
feat: add basic support for CDX 1.5 (#488)
0546677 
This PR introduces basic support for CDX 1.5.

Ref:
- #404

**Schema:**

- Extended schema-downloader and added specification files,
- Adapted `README` and `SchemaVersion` for 1.5

**Model:**

- Added `SchemaVersion1Dot5`, serializable annotations,
- Extended `ComponentType` and `ExternalReferenceType` enums

**Tests:**

- Generated snapshots for 1.5.
- In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4

**Chore:**

-  Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support

----

* feat: add basic support for CDX 1.5

Signed-off-by: Johannes Feichtner <[email protected]>

* docs: note minversions of `HashAlgorithm` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: set ref after schema download

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: add the newly missing/TODO elements

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: note minversions of `ComponentType` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: update to latest CDX meta

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* feat: new enum cases fr VulnerabilityScoreSource

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* tests: adjust to latest implementation

Signed-off-by: Jan Kowalleck <[email protected]>

* revert deletion by accident

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Co-authored-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck mentioned this issue Nov 28, 2023
Merged
This was linked to pull requests Nov 28, 2023
feat!: v6.0.0 #492
Merged
feat: add basic support for CDX 1.5 #488
Merged
@jkowalleck
Copy link
Member Author

closes via #492a

@jkowalleck
Copy link
Member Author

jkowalleck commented Nov 30, 2023 •
edited
Loading

💁
a RC1 is available -- https://pypi.org/project/cyclonedx-python-lib/6.0.0rc1/

jkowalleck added a commit that referenced this issue Dec 10, 2023
@jkowalleck @Churro
feat!: v6.0.0 (#492)
74865f8 
### Breaking Changes

* Removed symbols that were already marked as deprecated (via [#493])
* Removed symbols in `parser.*` ([#489] via [#495])
* Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
* Serialization of unsupported enum values might downgrade/migrate/omit them  ([#490] via [#496])  
  Handling might raise warnings if a data loss occurred due to omitting.  
  The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.
* Serialization of any `model.component.Component` with unsupported `type` raises `exception.serialization.SerializationOfUnsupportedComponentTypeException` ([#490] via [#496])
* Object `model.bom_ref.BomRef`'s property `value` defaults to `Null`, was arbitrary `UUID` ([#504] via [#505])  
  This change does not affect serialization. All `bom-ref`s are guaranteed to have unique values on rendering.
* Removed helpers from public API ([#503] via [#506])

### Added

* Basic support for CycloneDX 1.5 ([#404] via [#488])
  * No data models were enhanced nor added, yet.  
    Pull requests to add functionality are welcome.
  * Existing enumerable got new cases, to reflect features of CycloneDX 1.5 ([#404] via [#488])
  * Outputters were enabled to render CycloneDX 1.5 ([#404] via [#488])

### Tests

* Created (regression/unit/integration/functional) tests for CycloneDX 1.5 ([#404] via [#488])
* Created (regression/functional) tests for Enums' handling and completeness ([#490] via [#496])

### Misc

* Bumped dependency `py-serializable@^0.16`, was `@^0.15` (via [#496])


----

### API Changes — the details for migration

* Added new sub-package `exception.serialization` (via [#496])
* Removed class `models.ComparableTuple` ([#503] via [#506])
* Enum `model.ExternalReferenceType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed function `models.get_now_utc` ([#503] via [#506])
* Removed function `models.sha1sum` ([#503] via [#506])
* Enum `model.component.ComponentType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed `model.component.Component.__init__()`'s deprecated optional kwarg `namespace` (via [#493])  
  Use kwarg `group` instead.
* Removed `model.component.Component.__init__()`'s deprecated optional kwarg `license_str` (via [#493])  
  Use kwarg `licenses` instead.
* Removed deprecated method `model.component.Component.get_namespace()` (via [#493])
* Removed class `models.dependency.DependencyDependencies` ([#503] via [#506])
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_name` (via [#493])  
  Use kwarg `source` instead.
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_url` (via [#493])  
  Use kwarg `source` instead.
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `recommendations` (via [#493])  
  Use kwarg `recommendation` instead.
* Removed `model.vulnerability.VulnerabilityRating.__init__()`'s deprecated optional kwarg `score_base` (via [#493])  
  Use kwarg `score` instead.
* Enum `model.vulnerability.VulnerabilityScoreSource` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
* Removed deprecated function `output.get_instance()` (via [#493])  
  Use function `output.make_outputter()` instead.
* Added new class `output.json.JsonV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new item to dict `output.json.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new class `output.xml.XmlV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new item to dict `output.xml.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Removed class `parser.ParserWarning` ([#489] via [#495])
* Removed class `parser.BaseParser` ([#489] via [#495])
* Enum `schema.SchemaVersion` got new case `V1_5`, to reflect CycloneDX 1.5 ([#404] via [#488])


[#404]: #404
[#488]: #488
[#489]: #489
[#490]: #490
[#491]: #491
[#493]: #493
[#494]: #494
[#495]: #495
[#496]: #496
[#503]: #503
[#504]: #504
[#505]: #505
[#506]: #506

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: semantic-release <semantic-release>
Co-authored-by: Johannes Feichtner <[email protected]>
Co-authored-by: semantic-release <semantic-release>
@jkowalleck
Copy link
Member Author

feature is available since v6

@jkowalleck jkowalleck unpinned this issue Dec 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request schema 1.5
Projects
None yet
Milestone
No milestone
2 participants
@maitrey @jkowalleck