Skip to content

Commit 68794c4

Browse files
jkowalleckjkowalleck
committed
feat: bom-refs for known models
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 0898cf7 commit 68794c4

File tree

71 files changed

+476
-242
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

71 files changed

+476
-242
lines changed

‎cyclonedx/output/__init__.py

Lines changed: 47 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@
3333
if TYPE_CHECKING: # pragma: no cover
3434
from ..model.bom import Bom
3535
from ..model.bom_ref import BomRef
36+
from ..model.contact import OrganizationalContact, OrganizationalEntity, PostalAddress
37+
from ..model.definition import Level, Requirement, Standard
38+
from ..model.license import License
3639
from .json import Json as JsonOutputter
3740
from .xml import Xml as XmlOutputter
3841

@@ -170,8 +173,47 @@ def _make_unique(self) -> str:
170173

171174
@classmethod
172175
def from_bom(cls, bom: 'Bom', prefix: str = 'BomRef') -> 'BomRefDiscriminator':
173-
return cls(chain(
174-
map(lambda c: c.bom_ref, bom._get_all_components()),
175-
map(lambda s: s.bom_ref, bom.services),
176-
map(lambda v: v.bom_ref, bom.vulnerabilities)
177-
), prefix)
176+
"""
177+
Create an instance containing EVERY ``bom-ref`` in the bom.
178+
"""
179+
180+
components = tuple(bom._get_all_components())
181+
services = tuple(bom.services)
182+
vulnerabilities = tuple(bom.vulnerabilities)
183+
orgs: tuple['OrganizationalEntity', ...] = tuple(filter(lambda o: o is not None, chain( # type:ignore[arg-type]
184+
(bom.metadata.manufacture, bom.metadata.manufacturer, bom.metadata.supplier),
185+
chain.from_iterable((c.manufacturer, c.supplier,) for c in components),
186+
(s.provider for s in services),
187+
chain.from_iterable(v.credits.organizations for v in vulnerabilities if v.credits),
188+
)))
189+
contacts: Iterable['OrganizationalContact'] = chain(
190+
bom.metadata.authors,
191+
chain.from_iterable(c.authors for c in components),
192+
chain.from_iterable(v.credits.individuals for v in vulnerabilities if v.credits),
193+
chain.from_iterable(o.contacts for o in orgs),
194+
)
195+
addresses: Iterable['PostalAddress'] = (o.address for o in orgs if o.address is not None)
196+
licenses: Iterable['License'] = chain(
197+
bom.metadata.licenses,
198+
chain.from_iterable(c.licenses for c in components),
199+
chain.from_iterable(c.evidence.licenses for c in components if c.evidence is not None),
200+
chain.from_iterable(s.licenses for s in services),
201+
)
202+
standards: tuple['Standard', ...] = () \
203+
if bom.definitions is None \
204+
else tuple(bom.definitions.standards)
205+
requirements: Iterable['Requirement'] = chain.from_iterable(s.requirements for s in standards)
206+
levels: Iterable['Level'] = chain.from_iterable(s.levels for s in standards)
207+
relevant_bom_refs: Iterable['BomRef'] = (i.bom_ref for i in chain(
208+
components,
209+
services,
210+
vulnerabilities,
211+
orgs,
212+
contacts,
213+
addresses,
214+
licenses,
215+
standards,
216+
requirements,
217+
levels,
218+
))
219+
return cls(relevant_bom_refs, prefix)

‎tests/_data/models.py

Lines changed: 87 additions & 65 deletions
Large diffs are not rendered by default.

‎tests/_data/snapshots/enum_Encoding-1.5.json.bin

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"licenses": [
66
{
77
"license": {
8+
"bom-ref": "dummy_license",
89
"name": "att.encoding: BASE_64",
910
"text": {
1011
"content": "att.encoding: BASE_64",

‎tests/_data/snapshots/enum_Encoding-1.5.xml.bin

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<component type="library" bom-ref="dummy">
88
<name>dummy</name>
99
<licenses>
10-
<license>
10+
<license bom-ref="dummy_license">
1111
<name>att.encoding: BASE_64</name>
1212
<text content-type="text/plain" encoding="base64">att.encoding: BASE_64</text>
1313
</license>

‎tests/_data/snapshots/enum_Encoding-1.6.json.bin

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"licenses": [
66
{
77
"license": {
8+
"bom-ref": "dummy_license",
89
"name": "att.encoding: BASE_64",
910
"text": {
1011
"content": "att.encoding: BASE_64",

‎tests/_data/snapshots/enum_Encoding-1.6.xml.bin

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<component type="library" bom-ref="dummy">
88
<name>dummy</name>
99
<licenses>
10-
<license>
10+
<license bom-ref="dummy_license">
1111
<name>att.encoding: BASE_64</name>
1212
<text content-type="text/plain" encoding="base64">att.encoding: BASE_64</text>
1313
</license>

‎tests/_data/snapshots/get_bom_just_complete_metadata-1.5.json.bin

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,13 @@
77
"metadata": {
88
"authors": [
99
{
10+
"bom-ref": "OrganizationalContact_ano_bom_authors",
1011
"email": "[email protected]",
1112
"name": "A N Other",
1213
"phone": "+44 (0)1234 567890"
1314
},
1415
{
16+
"bom-ref": "OrganizationalContact_ph_bom_authors",
1517
"email": "[email protected]",
1618
"name": "Paul Horton"
1719
}
@@ -26,6 +28,7 @@
2628
"licenses": [
2729
{
2830
"license": {
31+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz_license",
2932
"id": "MIT"
3033
}
3134
}
@@ -91,6 +94,7 @@
9194
"licenses": [
9295
{
9396
"license": {
97+
"bom-ref": "my-specific-bom-ref-for-dings_license",
9498
"id": "MIT"
9599
}
96100
}
@@ -104,6 +108,7 @@
104108
"licenses": [
105109
{
106110
"license": {
111+
"bom-ref": "ccc8d7ee-4b9c-4750-aee0-a72585152291_license",
107112
"id": "MIT"
108113
}
109114
}
@@ -119,6 +124,7 @@
119124
"licenses": [
120125
{
121126
"license": {
127+
"bom-ref": "8a3893b3-9923-4adb-a1d3-47456636ba0a_license",
122128
"id": "MIT"
123129
}
124130
}
@@ -141,6 +147,7 @@
141147
"licenses": [
142148
{
143149
"license": {
150+
"bom-ref": "28b2d8ce-def0-446f-a221-58dee0b44acc_license",
144151
"id": "MIT"
145152
}
146153
}
@@ -197,6 +204,7 @@
197204
"licenses": [
198205
{
199206
"license": {
207+
"bom-ref": "ded1d73e-1fca-4302-b520-f1bc53979958_license",
200208
"id": "MIT"
201209
}
202210
}
@@ -307,13 +315,16 @@
307315
},
308316
"scope": "required",
309317
"supplier": {
318+
"bom-ref": "OrganizationalEntity_cdx_my-specific-bom-ref-for-dings",
310319
"contact": [
311320
{
321+
"bom-ref": "OrganizationalContact_ano_my-specific-bom-ref-for-dings",
312322
"email": "[email protected]",
313323
"name": "A N Other",
314324
"phone": "+44 (0)1234 567890"
315325
},
316326
{
327+
"bom-ref": "OrganizationalContact_ph_my-specific-bom-ref-for-dings",
317328
"email": "[email protected]",
318329
"name": "Paul Horton"
319330
}
@@ -340,6 +351,7 @@
340351
"licenses": [
341352
{
342353
"license": {
354+
"bom-ref": "bom_license",
343355
"id": "Apache-2.0",
344356
"text": {
345357
"content": "VGVzdCBjb250ZW50IC0gdGhpcyBpcyBub3QgdGhlIEFwYWNoZSAyLjAgbGljZW5zZSE=",
@@ -356,13 +368,16 @@
356368
}
357369
],
358370
"manufacture": {
371+
"bom-ref": "OrganizationalEntity_cdx_bom_manufacture",
359372
"contact": [
360373
{
374+
"bom-ref": "OrganizationalContact_ano_bom_manufacture",
361375
"email": "[email protected]",
362376
"name": "A N Other",
363377
"phone": "+44 (0)1234 567890"
364378
},
365379
{
380+
"bom-ref": "OrganizationalContact_ph_bom_manufacture",
366381
"email": "[email protected]",
367382
"name": "Paul Horton"
368383
}
@@ -384,8 +399,10 @@
384399
}
385400
],
386401
"supplier": {
402+
"bom-ref": "OrganizationalEntity_cd_x_bom_supplier",
387403
"contact": [
388404
{
405+
"bom-ref": "OrganizationalContact_ano_bom_supplier",
389406
"email": "[email protected]",
390407
"name": "A N Other",
391408
"phone": "+44 (0)1234 567890"

‎tests/_data/snapshots/get_bom_just_complete_metadata-1.5.xml.bin

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,27 @@
88
</lifecycle>
99
</lifecycles>
1010
<authors>
11-
<author>
11+
<author bom-ref="OrganizationalContact_ano_bom_authors">
1212
<name>A N Other</name>
1313
<email>[email protected]</email>
1414
<phone>+44 (0)1234 567890</phone>
1515
</author>
16-
<author>
16+
<author bom-ref="OrganizationalContact_ph_bom_authors">
1717
<name>Paul Horton</name>
1818
<email>[email protected]</email>
1919
</author>
2020
</authors>
2121
<component type="library" bom-ref="my-specific-bom-ref-for-dings">
22-
<supplier>
22+
<supplier bom-ref="OrganizationalEntity_cdx_my-specific-bom-ref-for-dings">
2323
<name>CycloneDX</name>
2424
<url>https://cyclonedx.org</url>
2525
<url>https://cyclonedx.org/docs</url>
26-
<contact>
26+
<contact bom-ref="OrganizationalContact_ano_my-specific-bom-ref-for-dings">
2727
<name>A N Other</name>
2828
<email>[email protected]</email>
2929
<phone>+44 (0)1234 567890</phone>
3030
</contact>
31-
<contact>
31+
<contact bom-ref="OrganizationalContact_ph_my-specific-bom-ref-for-dings">
3232
<name>Paul Horton</name>
3333
<email>[email protected]</email>
3434
</contact>
@@ -40,7 +40,7 @@
4040
<description>This component is awesome</description>
4141
<scope>required</scope>
4242
<licenses>
43-
<license>
43+
<license bom-ref="my-specific-bom-ref-for-dings_license">
4444
<id>MIT</id>
4545
</license>
4646
</licenses>
@@ -57,7 +57,7 @@
5757
<name>setuptools</name>
5858
<version>50.3.2</version>
5959
<licenses>
60-
<license>
60+
<license bom-ref="ccc8d7ee-4b9c-4750-aee0-a72585152291_license">
6161
<id>MIT</id>
6262
</license>
6363
</licenses>
@@ -67,7 +67,7 @@
6767
<author>Test Author</author>
6868
<name>setuptools</name>
6969
<licenses>
70-
<license>
70+
<license bom-ref="8a3893b3-9923-4adb-a1d3-47456636ba0a_license">
7171
<id>MIT</id>
7272
</license>
7373
</licenses>
@@ -79,7 +79,7 @@
7979
<author>Test Author</author>
8080
<name>setuptools</name>
8181
<licenses>
82-
<license>
82+
<license bom-ref="28b2d8ce-def0-446f-a221-58dee0b44acc_license">
8383
<id>MIT</id>
8484
</license>
8585
</licenses>
@@ -109,7 +109,7 @@
109109
<name>setuptools</name>
110110
<version>50.3.2</version>
111111
<licenses>
112-
<license>
112+
<license bom-ref="ded1d73e-1fca-4302-b520-f1bc53979958_license">
113113
<id>MIT</id>
114114
</license>
115115
</licenses>
@@ -168,7 +168,7 @@
168168
<name>setuptools</name>
169169
<version>50.3.2</version>
170170
<licenses>
171-
<license>
171+
<license bom-ref="pkg:pypi/[email protected]?extension=tar.gz_license">
172172
<id>MIT</id>
173173
</license>
174174
</licenses>
@@ -243,31 +243,31 @@
243243
</properties>
244244
</releaseNotes>
245245
</component>
246-
<manufacture>
246+
<manufacture bom-ref="OrganizationalEntity_cdx_bom_manufacture">
247247
<name>CycloneDX</name>
248248
<url>https://cyclonedx.org</url>
249249
<url>https://cyclonedx.org/docs</url>
250-
<contact>
250+
<contact bom-ref="OrganizationalContact_ano_bom_manufacture">
251251
<name>A N Other</name>
252252
<email>[email protected]</email>
253253
<phone>+44 (0)1234 567890</phone>
254254
</contact>
255-
<contact>
255+
<contact bom-ref="OrganizationalContact_ph_bom_manufacture">
256256
<name>Paul Horton</name>
257257
<email>[email protected]</email>
258258
</contact>
259259
</manufacture>
260-
<supplier>
260+
<supplier bom-ref="OrganizationalEntity_cd_x_bom_supplier">
261261
<name>Cyclone DX</name>
262262
<url>https://cyclonedx.org/</url>
263-
<contact>
263+
<contact bom-ref="OrganizationalContact_ano_bom_supplier">
264264
<name>A N Other</name>
265265
<email>[email protected]</email>
266266
<phone>+44 (0)1234 567890</phone>
267267
</contact>
268268
</supplier>
269269
<licenses>
270-
<license>
270+
<license bom-ref="bom_license">
271271
<id>Apache-2.0</id>
272272
<text content-type="text/plain" encoding="base64">VGVzdCBjb250ZW50IC0gdGhpcyBpcyBub3QgdGhlIEFwYWNoZSAyLjAgbGljZW5zZSE=</text>
273273
<url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>

0 commit comments

Comments
 (0)