Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add basic support for CDX 1.5 #488

Merged
merged 13 commits into from
Nov 27, 2023
Merged

feat: add basic support for CDX 1.5 #488

merged 13 commits into from
Nov 27, 2023

Conversation

Churro
Copy link
Contributor

@Churro Churro commented Nov 26, 2023 •
edited
Loading

This PR introduces basic support for CDX 1.5.

Ref:

Schema:

  • Extended schema-downloader and added specification files,
  • Adapted README and SchemaVersion for 1.5

Model:

  • Added SchemaVersion1Dot5, serializable annotations,
  • Extended ComponentType and ExternalReferenceType enums

Tests:

  • Generated snapshots for 1.5.
  • In some existing tests bom-ref changed, since 1.5 is now listed before 1.4

Chore:

  • Added newline = '\n' to schema-downloader and writeSnapshot for cross-platform support

@Churro Churro requested a review from a team as a code owner November 26, 2023 13:19
@Churro
feat: add basic support for CDX 1.5
da14f74 
Signed-off-by: Johannes Feichtner <[email protected]>
@jkowalleck
Copy link
Member

Thank you for your contribution, @Churro . 👍

I will review it soon

@jkowalleck jkowalleck added schema 1.5 enhancement New feature or request labels Nov 27, 2023
@jkowalleck
docs: note minversions of HashAlgorithm cases
3563dcc 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
docs: set ref after schema download
b8abb3b 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
refactor: add the newly missing/TODO elements
21f4d8a 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
docs: note minversions of ComponentType cases
ca2c2b8 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
refactor: adjust xml child order for CDX1.5
cd9dec1 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
refactor: adjust xml child order for CDX1.5
99cf89b 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
docs: update to latest CDX meta
dff5479 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
refactor: adjust xml child order for CDX1.5
3e485df 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
feat: new enum cases fr VulnerabilityScoreSource
e60dbee 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
refactor: adjust xml child order for CDX1.5
c6a7b2c 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck
tests: adjust to latest implementation
f42d3ee 
Signed-off-by: Jan Kowalleck <[email protected]>
jkowalleck
jkowalleck reviewed Nov 27, 2023
View reviewed changes
Copy link
Member

@jkowalleck jkowalleck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did a partial review.
also added(pushed) missing cases, upcoming TODOS, documentation, and such.

tools/schema-downloader.py Show resolved Hide resolved
cyclonedx/output/__init__.py Show resolved Hide resolved
jkowalleck
jkowalleck reviewed Nov 27, 2023
View reviewed changes
tests/__init__.py Show resolved Hide resolved
tests/test_deserialize_json.py Show resolved Hide resolved
tests/test_deserialize_xml.py Show resolved Hide resolved
cyclonedx/output/__init__.py Show resolved Hide resolved
@jkowalleck jkowalleck changed the base branch from main to 6.0.0-dev November 27, 2023 18:58
@jkowalleck
revert deletion by accident
454d136 
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck merged commit 313a6fe into CycloneDX:6.0.0-dev Nov 27, 2023
39 checks passed
@jkowalleck jkowalleck added this to the 6.0.0 milestone Nov 27, 2023
@Churro
Copy link
Contributor Author

Churro commented Nov 27, 2023

Thank you for refining and bringing this over the finish line 😊

jkowalleck added a commit that referenced this pull request Nov 28, 2023
@Churro @jkowalleck
feat: add basic support for CDX 1.5 (#488)
0546677 
This PR introduces basic support for CDX 1.5.

Ref:
- #404

**Schema:**

- Extended schema-downloader and added specification files,
- Adapted `README` and `SchemaVersion` for 1.5

**Model:**

- Added `SchemaVersion1Dot5`, serializable annotations,
- Extended `ComponentType` and `ExternalReferenceType` enums

**Tests:**

- Generated snapshots for 1.5.
- In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4

**Chore:**

-  Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support

----

* feat: add basic support for CDX 1.5

Signed-off-by: Johannes Feichtner <[email protected]>

* docs: note minversions of `HashAlgorithm` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: set ref after schema download

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: add the newly missing/TODO elements

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: note minversions of `ComponentType` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: update to latest CDX meta

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* feat: new enum cases fr VulnerabilityScoreSource

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* tests: adjust to latest implementation

Signed-off-by: Jan Kowalleck <[email protected]>

* revert deletion by accident

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Co-authored-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck mentioned this pull request Nov 28, 2023
Merged
@jkowalleck jkowalleck linked an issue Nov 28, 2023 that may be closed by this pull request
[FEAT] basic CDX 1.5 #404
Closed
jkowalleck added a commit that referenced this pull request Dec 10, 2023
@jkowalleck @Churro
feat!: v6.0.0 (#492)
74865f8 
### Breaking Changes

* Removed symbols that were already marked as deprecated (via [#493])
* Removed symbols in `parser.*` ([#489] via [#495])
* Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
* Serialization of unsupported enum values might downgrade/migrate/omit them  ([#490] via [#496])  
  Handling might raise warnings if a data loss occurred due to omitting.  
  The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.
* Serialization of any `model.component.Component` with unsupported `type` raises `exception.serialization.SerializationOfUnsupportedComponentTypeException` ([#490] via [#496])
* Object `model.bom_ref.BomRef`'s property `value` defaults to `Null`, was arbitrary `UUID` ([#504] via [#505])  
  This change does not affect serialization. All `bom-ref`s are guaranteed to have unique values on rendering.
* Removed helpers from public API ([#503] via [#506])

### Added

* Basic support for CycloneDX 1.5 ([#404] via [#488])
  * No data models were enhanced nor added, yet.  
    Pull requests to add functionality are welcome.
  * Existing enumerable got new cases, to reflect features of CycloneDX 1.5 ([#404] via [#488])
  * Outputters were enabled to render CycloneDX 1.5 ([#404] via [#488])

### Tests

* Created (regression/unit/integration/functional) tests for CycloneDX 1.5 ([#404] via [#488])
* Created (regression/functional) tests for Enums' handling and completeness ([#490] via [#496])

### Misc

* Bumped dependency `py-serializable@^0.16`, was `@^0.15` (via [#496])


----

### API Changes — the details for migration

* Added new sub-package `exception.serialization` (via [#496])
* Removed class `models.ComparableTuple` ([#503] via [#506])
* Enum `model.ExternalReferenceType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed function `models.get_now_utc` ([#503] via [#506])
* Removed function `models.sha1sum` ([#503] via [#506])
* Enum `model.component.ComponentType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed `model.component.Component.__init__()`'s deprecated optional kwarg `namespace` (via [#493])  
  Use kwarg `group` instead.
* Removed `model.component.Component.__init__()`'s deprecated optional kwarg `license_str` (via [#493])  
  Use kwarg `licenses` instead.
* Removed deprecated method `model.component.Component.get_namespace()` (via [#493])
* Removed class `models.dependency.DependencyDependencies` ([#503] via [#506])
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_name` (via [#493])  
  Use kwarg `source` instead.
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_url` (via [#493])  
  Use kwarg `source` instead.
* Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `recommendations` (via [#493])  
  Use kwarg `recommendation` instead.
* Removed `model.vulnerability.VulnerabilityRating.__init__()`'s deprecated optional kwarg `score_base` (via [#493])  
  Use kwarg `score` instead.
* Enum `model.vulnerability.VulnerabilityScoreSource` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488])
* Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494])
* Removed deprecated function `output.get_instance()` (via [#493])  
  Use function `output.make_outputter()` instead.
* Added new class `output.json.JsonV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new item to dict `output.json.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new class `output.xml.XmlV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Added new item to dict `output.xml.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488])
* Removed class `parser.ParserWarning` ([#489] via [#495])
* Removed class `parser.BaseParser` ([#489] via [#495])
* Enum `schema.SchemaVersion` got new case `V1_5`, to reflect CycloneDX 1.5 ([#404] via [#488])


[#404]: #404
[#488]: #488
[#489]: #489
[#490]: #490
[#491]: #491
[#493]: #493
[#494]: #494
[#495]: #495
[#496]: #496
[#503]: #503
[#504]: #504
[#505]: #505
[#506]: #506

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: semantic-release <semantic-release>
Co-authored-by: Johannes Feichtner <[email protected]>
Co-authored-by: semantic-release <semantic-release>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jkowalleck jkowalleck jkowalleck left review comments

Assignees
No one assigned
Labels
breaking change enhancement New feature or request schema 1.5
Projects
None yet
Milestone
6.0.0
Development

Successfully merging this pull request may close these issues.

[FEAT] basic CDX 1.5
2 participants
@Churro @jkowalleck