-
-
Notifications
You must be signed in to change notification settings - Fork 52
Open
Labels
enhancementNew feature or requestNew feature or requesthelp wantedExtra attention is neededExtra attention is neededschema 1.6
Description
Example
import json
from cyclonedx.model.bom import Bom
from cyclonedx.validation.json import JsonStrictValidator
from cyclonedx.schema import OutputFormat, SchemaVersion
specification = {
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:835142d8-05ce-4729-bcb9-ff39cb67eb37",
"version": 1,
"metadata": {
"timestamp": "2025-03-10T17:25:47Z",
"tools": {
"services": [
{
"provider": {
"name": "Example",
"url": [
"https://example.com/"
],
"bom-ref": "Example"
},
"name": "Example",
}
]
},
"properties": []
}
}
validator = JsonStrictValidator(SchemaVersion.V1_6)
if validator.validate_str(json.dumps(specification)) is not None:
raise Exception("Validation failed")
Bom.from_json(specification) # raises an error
The error that Bom.from_json
throws is ValueError: Unexpected key bom-ref/bom-ref in data being serialized to cyclonedx.model.contact.OrganizationalEntity
Cause
I believe OrganizationEntity
is missing the attribute bom_ref
. It seems that the schema includes it, so the example specification above is correct: https://cyclonedx.org/docs/1.6/xml/#type_organizationalEntity
Fix
Adding bom_ref
to OrganizationalEntity
should resolve the issue. The attribute should be attached to the bom-ref
key, similar to the class cyclonedx.model.contact.PostalAddress
.
Environment
I ran into the error using python 3.10.12
and also in 3.13.2
. I used version 9.1.0 of the package cyclonedx-python-lib
. Hashes:
files = [
{file = "cyclonedx_python_lib-9.1.0-py3-none-any.whl", hash = "sha256:55693fca8edaecc3363b24af14e82cc6e659eb1e8353e58b587c42652ce0fb52"},
{file = "cyclonedx_python_lib-9.1.0.tar.gz", hash = "sha256:86935f2c88a7b47a529b93c724dbd3e903bc573f6f8bd977628a7ca1b5dadea1"},
]
jkowalleck
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or requesthelp wantedExtra attention is neededExtra attention is neededschema 1.6