Skip to content

Commit fde8be1

Browse files
OxPiratesOxPirates
committed
feat: add support for component's evidences according to spec
Signed-off-by: Arun <[email protected]>
1 parent cb1a359 commit fde8be1

15 files changed

+1521
-32
lines changed

‎cyclonedx/model/component.py

Lines changed: 728 additions & 32 deletions
Large diffs are not rendered by default.

‎tests/_data/models.py

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,16 +44,23 @@
4444
from cyclonedx.model.bom import Bom, BomMetaData
4545
from cyclonedx.model.bom_ref import BomRef
4646
from cyclonedx.model.component import (
47+
AnalysisTechnique,
48+
CallStack,
4749
Commit,
4850
Component,
4951
ComponentEvidence,
5052
ComponentScope,
5153
ComponentType,
5254
Diff,
55+
Identity,
56+
IdentityFieldType,
57+
Method,
58+
Occurrence,
5359
OmniborId,
5460
Patch,
5561
PatchClassification,
5662
Pedigree,
63+
StackFrame,
5764
Swhid,
5865
Swid,
5966
)
@@ -455,6 +462,10 @@ def get_bom_with_component_setuptools_complete() -> Bom:
455462
return _make_bom(components=[get_component_setuptools_complete()])
456463

457464

465+
def get_bom_with_component_evidence() -> Bom:
466+
return _make_bom(components=[get_component_with_evidence()])
467+
468+
458469
def get_bom_with_component_setuptools_with_vulnerability() -> Bom:
459470
bom = _make_bom()
460471
component = get_component_setuptools_simple()
@@ -737,6 +748,64 @@ def get_component_setuptools_complete(include_pedigree: bool = True) -> Componen
737748
return component
738749

739750

751+
def get_component_with_evidence(include_pedigree: bool = True) -> Component:
752+
component = get_component_setuptools_simple()
753+
component.evidence = get_component_evidence_basic()
754+
return component
755+
756+
757+
def get_component_evidence_basic() -> ComponentEvidence:
758+
"""
759+
Returns a basic ComponentEvidence object for testing.
760+
"""
761+
return ComponentEvidence(
762+
identity=[
763+
Identity(
764+
field=IdentityFieldType.NAME,
765+
confidence=Decimal('0.9'),
766+
concluded_value='example-component',
767+
methods=[
768+
Method(
769+
technique=AnalysisTechnique.SOURCE_CODE_ANALYSIS,
770+
confidence=Decimal('0.8'), value='analysis-tool'
771+
)
772+
],
773+
tools=[
774+
BomRef('ref0'), # BomRef reference
775+
BomRef('ref1') # BomRef reference
776+
]
777+
)
778+
],
779+
occurrences=[
780+
Occurrence(
781+
location='path/to/file',
782+
line=42,
783+
offset=16,
784+
symbol='exampleSymbol',
785+
additional_context='Found in source code',
786+
bom_ref='BomRef.2392456298152259.7035102660516194',
787+
)
788+
],
789+
callstack=CallStack(
790+
frames=[
791+
StackFrame(
792+
package='example.package',
793+
module='example.module',
794+
function='example_function',
795+
parameters=['param1', 'param2'],
796+
line=10,
797+
column=5,
798+
full_filename='path/to/file',
799+
)
800+
]
801+
),
802+
licenses=[DisjunctiveLicense(id='MIT')],
803+
copyright=[
804+
Copyright(text='Commercial'), Copyright(text='Commercial 2')
805+
]
806+
)
807+
808+
740809
def get_component_setuptools_simple(
741810
bom_ref: Optional[str] = 'pkg:pypi/[email protected]?extension=tar.gz'
742811
) -> Component:
@@ -1485,4 +1554,5 @@ def get_bom_for_issue540_duplicate_components() -> Bom:
14851554
get_bom_with_lifecycles,
14861555
get_bom_with_definitions_standards,
14871556
get_bom_with_definitions_and_detailed_standards,
1557+
get_bom_with_component_evidence,
14881558
}

‎tests/_data/snapshots/get_bom_with_component_evidence-1.0.xml.bin

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" ?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
3+
<components>
4+
<component type="library">
5+
<name>setuptools</name>
6+
<version>50.3.2</version>
7+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
8+
<modified>false</modified>
9+
</component>
10+
</components>
11+
</bom>

‎tests/_data/snapshots/get_bom_with_component_evidence-1.1.xml.bin

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" ?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.1" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
3+
<components>
4+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
5+
<name>setuptools</name>
6+
<version>50.3.2</version>
7+
<licenses>
8+
<license>
9+
<id>MIT</id>
10+
</license>
11+
</licenses>
12+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
13+
</component>
14+
</components>
15+
</bom>

‎tests/_data/snapshots/get_bom_with_component_evidence-1.2.json.bin

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"components": [
3+
{
4+
"author": "Test Author",
5+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
6+
"licenses": [
7+
{
8+
"license": {
9+
"id": "MIT"
10+
}
11+
}
12+
],
13+
"name": "setuptools",
14+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
15+
"type": "library",
16+
"version": "50.3.2"
17+
}
18+
],
19+
"dependencies": [
20+
{
21+
"ref": "pkg:pypi/[email protected]?extension=tar.gz"
22+
}
23+
],
24+
"metadata": {
25+
"timestamp": "2023-01-07T13:44:32.312678+00:00"
26+
},
27+
"serialNumber": "urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac",
28+
"version": 1,
29+
"$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
30+
"bomFormat": "CycloneDX",
31+
"specVersion": "1.2"
32+
}

‎tests/_data/snapshots/get_bom_with_component_evidence-1.2.xml.bin

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" ?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
3+
<metadata>
4+
<timestamp>2023-01-07T13:44:32.312678+00:00</timestamp>
5+
</metadata>
6+
<components>
7+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
8+
<author>Test Author</author>
9+
<name>setuptools</name>
10+
<version>50.3.2</version>
11+
<licenses>
12+
<license>
13+
<id>MIT</id>
14+
</license>
15+
</licenses>
16+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
17+
</component>
18+
</components>
19+
<dependencies>
20+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"/>
21+
</dependencies>
22+
</bom>

‎tests/_data/snapshots/get_bom_with_component_evidence-1.3.json.bin

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"components": [
3+
{
4+
"author": "Test Author",
5+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
6+
"evidence": {
7+
"copyright": [
8+
{
9+
"text": "Commercial"
10+
},
11+
{
12+
"text": "Commercial 2"
13+
}
14+
],
15+
"licenses": [
16+
{
17+
"license": {
18+
"id": "MIT"
19+
}
20+
}
21+
]
22+
},
23+
"licenses": [
24+
{
25+
"license": {
26+
"id": "MIT"
27+
}
28+
}
29+
],
30+
"name": "setuptools",
31+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
32+
"type": "library",
33+
"version": "50.3.2"
34+
}
35+
],
36+
"dependencies": [
37+
{
38+
"ref": "pkg:pypi/[email protected]?extension=tar.gz"
39+
}
40+
],
41+
"metadata": {
42+
"timestamp": "2023-01-07T13:44:32.312678+00:00"
43+
},
44+
"serialNumber": "urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac",
45+
"version": 1,
46+
"$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
47+
"bomFormat": "CycloneDX",
48+
"specVersion": "1.3"
49+
}

‎tests/_data/snapshots/get_bom_with_component_evidence-1.3.xml.bin

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?xml version="1.0" ?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.3" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
3+
<metadata>
4+
<timestamp>2023-01-07T13:44:32.312678+00:00</timestamp>
5+
</metadata>
6+
<components>
7+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
8+
<author>Test Author</author>
9+
<name>setuptools</name>
10+
<version>50.3.2</version>
11+
<licenses>
12+
<license>
13+
<id>MIT</id>
14+
</license>
15+
</licenses>
16+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
17+
<evidence>
18+
<licenses>
19+
<license>
20+
<id>MIT</id>
21+
</license>
22+
</licenses>
23+
<copyright>
24+
<text>Commercial</text>
25+
<text>Commercial 2</text>
26+
</copyright>
27+
</evidence>
28+
</component>
29+
</components>
30+
<dependencies>
31+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"/>
32+
</dependencies>
33+
</bom>

‎tests/_data/snapshots/get_bom_with_component_evidence-1.4.json.bin

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"components": [
3+
{
4+
"author": "Test Author",
5+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
6+
"evidence": {
7+
"copyright": [
8+
{
9+
"text": "Commercial"
10+
},
11+
{
12+
"text": "Commercial 2"
13+
}
14+
],
15+
"licenses": [
16+
{
17+
"license": {
18+
"id": "MIT"
19+
}
20+
}
21+
]
22+
},
23+
"licenses": [
24+
{
25+
"license": {
26+
"id": "MIT"
27+
}
28+
}
29+
],
30+
"name": "setuptools",
31+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
32+
"type": "library",
33+
"version": "50.3.2"
34+
}
35+
],
36+
"dependencies": [
37+
{
38+
"ref": "pkg:pypi/[email protected]?extension=tar.gz"
39+
}
40+
],
41+
"metadata": {
42+
"timestamp": "2023-01-07T13:44:32.312678+00:00"
43+
},
44+
"serialNumber": "urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac",
45+
"version": 1,
46+
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
47+
"bomFormat": "CycloneDX",
48+
"specVersion": "1.4"
49+
}

‎tests/_data/snapshots/get_bom_with_component_evidence-1.4.xml.bin

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?xml version="1.0" ?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:1441d33a-e0fc-45b5-af3b-61ee52a88bac" version="1">
3+
<metadata>
4+
<timestamp>2023-01-07T13:44:32.312678+00:00</timestamp>
5+
</metadata>
6+
<components>
7+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
8+
<author>Test Author</author>
9+
<name>setuptools</name>
10+
<version>50.3.2</version>
11+
<licenses>
12+
<license>
13+
<id>MIT</id>
14+
</license>
15+
</licenses>
16+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
17+
<evidence>
18+
<licenses>
19+
<license>
20+
<id>MIT</id>
21+
</license>
22+
</licenses>
23+
<copyright>
24+
<text>Commercial</text>
25+
<text>Commercial 2</text>
26+
</copyright>
27+
</evidence>
28+
</component>
29+
</components>
30+
<dependencies>
31+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"/>
32+
</dependencies>
33+
</bom>

0 commit comments

Comments
 (0)