Skip to content

Make add-package and copy-package relationships optional. #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Malcolmnixon merged 1 commit into from
Jun 6, 2024
Merged

Make add-package and copy-package relationships optional. #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ steps:
license: <license> # Optional package license
purl: <package-url> # Optional package purl
cpe23: <cpe-identifier> # Optional package cpe23
relationships: # Relationships
relationships: # Optional relationships
- type: <relationship> # Relationship type
element: <element> # Related element
comment: <comment> # Optional comment
Expand Down Expand Up @@ -189,7 +189,7 @@ steps:
to: <to.spdx.json> # Destination SPDX file name
package: <package> # Package ID
recursive: true # Optional recursive flag
relationships: # Relationships
relationships: # Optional relationships
- type: <relationship> # Relationship type
element: <element> # Related element
comment: <comment> # Optional comment
Expand Down
5 changes: 2 additions & 3 deletions src/DemaConsulting.SpdxTool/Commands/AddPackage.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ public class AddPackage : Command
" license: <license> # Optional package license",
" purl: <package-url> # Optional package purl",
" cpe23: <cpe-identifier> # Optional package cpe23",
" relationships: # Relationships",
" relationships: # Optional relationships",
" - type: <relationship> # Relationship type",
" element: <element> # Related element",
" comment: <comment> # Optional comment",
Expand Down Expand Up @@ -89,8 +89,7 @@ public override void Run(YamlMappingNode step, Dictionary<string, string> variab
var package = ParsePackage("add-package", packageMap, variables);

// Parse the relationships
var relationshipsSequence = GetMapSequence(inputs, "relationships") ??
throw new YamlException(step.Start, step.End, "'add-package' missing 'relationships' input");
var relationshipsSequence = GetMapSequence(inputs, "relationships");
var relationships = AddRelationship.Parse("add-package", package.Id, relationshipsSequence, variables);

// Add the package
Expand Down
6 changes: 5 additions & 1 deletion src/DemaConsulting.SpdxTool/Commands/AddRelationship.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,9 +161,13 @@ public static void Add(SpdxDocument doc, SpdxRelationship relationship)
public static SpdxRelationship[] Parse(
string command,
string packageId,
YamlSequenceNode relationships,
YamlSequenceNode? relationships,
Dictionary<string, string> variables)
{
// Handle no relationships
if (relationships == null)
return Array.Empty<SpdxRelationship>();

// Parse each relationship
return relationships.Children.Select(node =>
{
Expand Down
5 changes: 2 additions & 3 deletions src/DemaConsulting.SpdxTool/Commands/CopyPackage.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ public class CopyPackage : Command
" to: <to.spdx.json> # Destination SPDX file name",
" package: <package> # Package ID",
" recursive: true # Optional recursive flag",
" relationships: # Relationships",
" relationships: # Optional relationships",
" - type: <relationship> # Relationship type",
" element: <element> # Related element",
" comment: <comment> # Optional comment",
Expand Down Expand Up @@ -109,8 +109,7 @@ public override void Run(YamlMappingNode step, Dictionary<string, string> variab
throw new YamlException(step.Start, step.End, "'copy-package' invalid 'recursive' input");

// Parse the relationships
var relationshipsSequence = GetMapSequence(inputs, "relationships") ??
throw new YamlException(step.Start, step.End, "'copy-package' missing 'relationships' input");
var relationshipsSequence = GetMapSequence(inputs, "relationships");
var relationships = AddRelationship.Parse("add-package", packageId, relationshipsSequence, variables);

// Copy the package
Expand Down
67 changes: 67 additions & 0 deletions test/DemaConsulting.SpdxTool.Tests/TestAddPackage.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,73 @@ public void AddPackageSimple()
}
}

[TestMethod]
public void AddPackageNoRelationship()
{
// SPDX contents
const string spdxContents = "{\r\n" +
" \"files\": [],\r\n" +
" \"packages\": [],\r\n" +
" \"relationships\": [],\r\n" +
" \"spdxVersion\": \"SPDX-2.2\",\r\n" +
" \"dataLicense\": \"CC0-1.0\",\r\n" +
" \"SPDXID\": \"SPDXRef-DOCUMENT\",\r\n" +
" \"name\": \"Test Document\",\r\n" +
" \"documentNamespace\": \"https://sbom.spdx.org\",\r\n" +
" \"creationInfo\": {\r\n" +
" \"created\": \"2021-10-01T00:00:00Z\",\r\n" +
" \"creators\": [ \"Person: Malcolm Nixon\" ]\r\n" +
" },\r\n" +
" \"documentDescribes\": []\r\n" +
"}";

// Workflow contents
const string workflowContents = "steps:\n" +
"- command: add-package\n" +
" inputs:\n" +
" spdx: spdx.json\n" +
" package:\n" +
" id: SPDXRef-Package-1\n" +
" name: Test Package 1\n" +
" version: 1.0.0\n" +
" download: https://dotnet.microsoft.com/download\n" +
" purl: pkg:nuget/BogusPackage@1.0.0\n";

try
{
// Write the SPDX files
File.WriteAllText("spdx.json", spdxContents);
File.WriteAllText("workflow.yaml", workflowContents);

// Run the command
var exitCode = Runner.Run(
out _,
"dotnet",
"DemaConsulting.SpdxTool.dll",
"run-workflow",
"workflow.yaml");

// Verify success
Assert.AreEqual(0, exitCode);

// Read the SPDX document
Assert.IsTrue(File.Exists("spdx.json"));
var doc = Spdx2JsonDeserializer.Deserialize(File.ReadAllText("spdx.json"));

// Verify package present
Assert.AreEqual(1, doc.Packages.Length);
Assert.AreEqual("SPDXRef-Package-1", doc.Packages[0].Id);

// Verify no relationships
Assert.AreEqual(0, doc.Relationships.Length);
}
finally
{
File.Delete("spdx.json");
File.Delete("workflow.yaml");
}
}

[TestMethod]
public void AddPackageFromQuery()
{
Expand Down