✨ --validate #39

pboling · 2025-10-26T05:01:48Z

#	📍 NOTE	What
1️⃣	Please see #38 first	Modernize gem structure
2️⃣	Then see #37 next	Upgrade to v1.7 spec
3️⃣	Then continue here	Add --validate feature	<=== You are here
4️⃣	Then see #40	Add --include-metadata feature

CLI and validation

Added --validate and --validate-file flags in Cyclonedx::BomBuilder.
After writing the BOM, if --validate is set, validate JSON via JSON Schema and XML via XSD with local files under schema/.
Added logic to validate an existing file with --validate --validate-file , inferring format from extension unless --format is provided.
In validate-only mode, project path isn’t required.

Validation helpers

Added Cyclonedx::BomHelpers.validate_bom_content(content, format, spec_version) which:
- For JSON: uses json_schemer to validate against bom-.schema.json.
- For XML: uses Nokogiri::XML::Schema with bom-.xsd.
Uses local schemas at schema/ and surfaces compact error messages; returns non-zero exit on failure.

Dependencies

Added json_schemer (~> 2.2) to cyclonedx-ruby.gemspec.
Required json_schemer in lib/cyclonedx/ruby.rb.

Cucumber tests

Updated features/help.feature to show the new flags.
Added features/validate.feature:
- Validate XML BOM succeeds.
- Validate JSON BOM succeeds.
- Validate fails for invalid XML BOM (corrupts namespace and expects exit 1).

Small extras

Infer format from file extension when using --validate-file and no --format provided.

Signed-off-by: Peter H. Boling [email protected]

Copilot

Pull Request Overview

This PR introduces BOM validation capabilities with --validate and --validate-file flags, along with significant refactoring to organize the codebase under the Cyclonedx namespace for a cleaner v2.0.0 migration path.

Key Changes:

Added BOM validation via JSON Schema and XML XSD using local schema files
Restructured codebase with proper namespace organization under Cyclonedx module
Introduced deprecation framework to maintain backward compatibility until v2.0.0
Added json_schemer dependency for JSON validation

Reviewed Changes

Copilot reviewed 56 out of 76 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
spec/spec_helper.rb	Restructured to use modern RSpec configuration and conditional legacy path loading
spec/cyclonedx/ruby_spec.rb	Added version number test for new namespace
spec/cyclonedx/bom_helpers_spec.rb	Migrated tests to new Cyclonedx namespace
spec/cyclonedx/bom_component_spec.rb	Updated to use Cyclonedx::BomComponent
spec/bom_helpers_spec.rb	Removed duplicate legacy test file
lib/cyclonedx/ruby.rb	New main entry point with required dependencies including json_schemer
lib/cyclonedx/ruby/version.rb	Version constant definition
lib/cyclonedx/ruby/deprecation.rb	Deprecation framework for v2.0.0 migration
lib/cyclonedx_deprecated.rb	Legacy compatibility layer with deprecation warnings
schema/*	Added CycloneDX specification schema files for validation
features/json_format.feature	Removed trailing whitespace
sig/cyclonedx/ruby.rbs	Added RBS type signature file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Peter H. Boling <[email protected]>

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` ### Fixed - `Nokogiri::XML::Builder` context relies on `method_missing` - Globally defined `Object#purl` conflicted with `<purl>`. - Moved to `Cyclonedx::BomHelpers.purl` to avoid conflict in v2.0.0 (along with all other global methods) - Fixed existing usage via the built-in Nokogiri workaround of adding an underscore `purl_` - The XML tag is unchanged as `<purl>` Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Jan Kowalleck <[email protected]>

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

@Gems

- Add spec version selection end-to-end with a new --spec-version flag (default 1.7). - Update JSON and XML outputs to honor the selected spec version. - Update fixtures, help text, tests, and docs. Files: - lib/bom_helpers.rb: - Added SUPPORTED_SPEC_VERSIONS, cyclonedx_xml_namespace helper. build_bom now accepts spec_version and routes to: - build_json_bom(gems, spec_version) sets specVersion to the provided version. - build_bom_xml(gems, spec_version) sets xmlns to http://cyclonedx.org/schema/bom/<version>.</version> - lib/bom_builder.rb: - Added --spec-version with validation; default is 1.7. - Pass @spec_version into build_bom(@Gems, @bom_output_format, @spec_version). Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

- Added --validate and --validate-file flags in Cyclonedx::BomBuilder. - After writing the BOM, if --validate is set, validate JSON via JSON Schema and XML via XSD with local files under schema/. - Added logic to validate an existing file with --validate --validate-file <path>, inferring format from extension unless --format is provided.</path> - In validate-only mode, project path isn’t required. - Added Cyclonedx::BomHelpers.validate_bom_content(content, format, spec_version) which: - For JSON: uses json_schemer to validate against bom-<ver>.schema.json.</ver> - For XML: uses Nokogiri::XML::Schema with bom-<ver>.xsd.</ver> - Uses local schemas at schema/ and surfaces compact error messages; returns non-zero exit on failure. - Added json_schemer (~> 2.2) to cyclonedx-ruby.gemspec. - Required json_schemer in lib/cyclonedx/ruby.rb. - Updated features/help.feature to show the new flags. - Added features/validate.feature: - Validate XML BOM succeeds. - Validate JSON BOM succeeds. - Validate fails for invalid XML BOM (corrupts namespace and expects exit 1). - Infer format from file extension when using --validate-file and no --format provided. Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

Copilot AI review requested due to automatic review settings October 26, 2025 05:01

Copilot AI reviewed Oct 26, 2025

View reviewed changes

pboling force-pushed the feat/schema-validate branch from 86a8d79 to 14714af Compare October 26, 2025 05:21

This was referenced Oct 26, 2025

🎨 modernize for 2025 #38

Open

✨ Core v1.7 Enablement #37

Open

✨ --include-metadata (metadata.tools) & --enrich-components #40

Open

pboling added 12 commits October 30, 2025 00:59

🔨 binstubs: console, setup, rake, rspec, cucumber

6a174b8

Signed-off-by: Peter H. Boling <[email protected]>

🚚 rename LICENSE => LICENSE.txt

76c388f

Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize dotfiles

6d29520

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize Rakefile

ea1339d

Signed-off-by: Peter H. Boling <[email protected]>

⚡️ Frozen Strings (performance benefit)

c91de22

Signed-off-by: Peter H. Boling <[email protected]>

⏪️ Revert accidental changes

cbd8f71

Signed-off-by: Peter H. Boling <[email protected]>

🚨 Linting

dded808

Signed-off-by: Peter H. Boling <[email protected]>

🔒️ Signed releases, checksums & CONTRIBUTING.md

14413f0

Signed-off-by: Peter H. Boling <[email protected]>

👷 Update build matrix (light)

9980c19

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

🔨 binstub: gem_checksums

e0de431

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/schema-validate branch from 9c107ae to cbca549 Compare October 30, 2025 07:40

pboling requested a review from a team as a code owner October 30, 2025 07:40

jkowalleck and others added 4 commits October 30, 2025 20:53

Merge branch 'master' into fix/nokogiri-incompatible-with-global-purl

9f75e11

add NOTICE to extra_rdoc_files

9422296

Signed-off-by: Jan Kowalleck <[email protected]>

📝 Use hardcoded homepage roots

a492361

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove unnecessary test artifacts

d243fe2

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/schema-validate branch from cbca549 to e0197c0 Compare October 30, 2025 21:26

pboling added 5 commits October 31, 2025 10:36

🔥 Remove gem release signing logic

a5df2d4

Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove documentation uri

b2182d3

Signed-off-by: Peter H. Boling <[email protected]>

🙈 Ignore .idea

86a28e6

Signed-off-by: Peter H. Boling <[email protected]>

✏️ Fix typo

2144134

Signed-off-by: Peter H. Boling <[email protected]>

pboling added 4 commits October 31, 2025 10:44

📌 specification v1.7 (as fixture)

c0bda69

Signed-off-by: Peter H. Boling <[email protected]>

🦺 schemas for validation

21398eb

Signed-off-by: Peter H. Boling <[email protected]>

📝 Document --validate and --validate-file

45eef49

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/schema-validate branch from e0197c0 to 45eef49 Compare October 31, 2025 16:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

✨ --validate #39

✨ --validate #39

Uh oh!

pboling commented Oct 26, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

✨ --validate #39

Are you sure you want to change the base?

✨ --validate #39

Uh oh!

Conversation

pboling commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI and validation

Validation helpers

Dependencies

Cucumber tests

Small extras

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pboling commented Oct 26, 2025 •

edited

Loading