Skip to content

Commit abcc29d

Browse files
jkowalleckjkowalleck
committed
added additional test cases, and adjusted the XSD to detect them
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 58e5ad2 commit abcc29d

File tree

6 files changed

+142
-24
lines changed

6 files changed

+142
-24
lines changed

‎schema/bom-1.7.xsd‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8905,22 +8905,35 @@ limitations under the License.
89058905
</xs:documentation>
89068906
</xs:annotation>
89078907
</xs:element>
8908-
<xs:element name="attributedTo" type="bom:refLinkType" minOccurs="0" maxOccurs="1">
8909-
<xs:annotation>
8910-
<xs:documentation>
8911-
The `bom-ref` of an object, such as a component, service, organisational entity, or person that supplied the cited information.
8912-
At least one of "attributedTo" or "process" must be present.
8913-
</xs:documentation>
8914-
</xs:annotation>
8915-
</xs:element>
8916-
<xs:element name="process" type="bom:refLinkType" minOccurs="0" maxOccurs="1">
8908+
<xs:choice>
89178909
<xs:annotation>
89188910
<xs:documentation>
8919-
An optional `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.
8920-
At least one of "attributedTo" or "process" must be present.
8911+
At least one of the "attributedTo" or "process" elements must be present.
89218912
</xs:documentation>
89228913
</xs:annotation>
8923-
</xs:element>
8914+
<xs:element name="attributedTo" type="bom:refLinkType">
8915+
<xs:annotation>
8916+
<xs:documentation>The `bom-ref` of an object, such as a component, service, organisational entity, or person that supplied the cited information.</xs:documentation>
8917+
</xs:annotation>
8918+
</xs:element>
8919+
<xs:element name="process" type="bom:refLinkType">
8920+
<xs:annotation>
8921+
<xs:documentation>The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.</xs:documentation>
8922+
</xs:annotation>
8923+
</xs:element>
8924+
<xs:sequence>
8925+
<xs:element name="attributedTo" type="bom:refLinkType">
8926+
<xs:annotation>
8927+
<xs:documentation>The `bom-ref` of an object, such as a component, service, organisational entity, or person that supplied the cited information.</xs:documentation>
8928+
</xs:annotation>
8929+
</xs:element>
8930+
<xs:element name="process" type="bom:refLinkType">
8931+
<xs:annotation>
8932+
<xs:documentation>The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.</xs:documentation>
8933+
</xs:annotation>
8934+
</xs:element>
8935+
</xs:sequence>
8936+
</xs:choice>
89248937
<xs:element name="note" type="xs:string" minOccurs="0" maxOccurs="1">
89258938
<xs:annotation>
89268939
<xs:documentation>

‎tools/src/test/resources/1.7/invalid-citations-1.7.json‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,7 @@
2727
"bom-ref": "citation-1",
2828
"pointers": [ "/components/0/name" ],
2929
"timestamp": "2025-05-01T14:00:00Z",
30-
"note": "Manually entered by Alice Example"
31-
},
32-
{
33-
"bom-ref": "citation-2",
34-
"pointers": [ "/components/0/licenses/0/license/id" ],
35-
"timestamp": "2025-05-01T14:05:00Z",
36-
"note": "Auto-detected by license scanner tool"
30+
"note": "Should have at least one of the following property sets: property 'attributedTo' or property 'process'"
3731
}
3832
]
3933
}

‎tools/src/test/resources/1.7/invalid-citations-1.7.xml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
3+
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
4+
version="1">
5+
<metadata>
6+
<timestamp>2025-05-01T14:23:00Z</timestamp>
7+
<authors>
8+
<author bom-ref="person-1">
9+
<name>Alice Example</name>
10+
<email>[email protected]</email>
11+
</author>
12+
</authors>
13+
</metadata>
14+
<components>
15+
<component type="library" bom-ref="component-1">
16+
<name>example-lib</name>
17+
<version>1.2.3</version>
18+
<licenses>
19+
<license>
20+
<id>Apache-2.0</id>
21+
</license>
22+
</licenses>
23+
</component>
24+
</components>
25+
<formulation>
26+
<formula bom-ref="formula-1">
27+
<components>
28+
<component type="application" bom-ref="scan-tool-1">
29+
<name>My Scan Tool</name>
30+
</component>
31+
</components>
32+
<workflows>
33+
<workflow bom-ref="workflow-1">
34+
<uid>259bae74-5ec4-4de8-9386-c91b1f7719b8</uid>
35+
<name>My workflow</name>
36+
<tasks>
37+
<task bom-ref="task-license-scan">
38+
<uid>6d75f8d6-a008-41cf-8b65-c4129fc249f9</uid>
39+
<description>License scan of the source files using OpenSourceScanner v2.1</description>
40+
<taskTypes>
41+
<taskType>scan</taskType>
42+
</taskTypes>
43+
</task>
44+
<task bom-ref="task-license-scan-2">
45+
<uid>dfc0268a-89cb-4823-bb88-84115a06b64d</uid>
46+
<description>License scan of the source files using [REDACTED]</description>
47+
<taskTypes>
48+
<taskType>scan</taskType>
49+
</taskTypes>
50+
</task>
51+
</tasks>
52+
<taskTypes>
53+
<taskType>scan</taskType>
54+
</taskTypes>
55+
</workflow>
56+
</workflows>
57+
</formula>
58+
</formulation>
59+
<citations>
60+
<citation bom-ref="citation-1">
61+
<pointers>
62+
<pointer>/components/0/name</pointer>
63+
</pointers>
64+
<timestamp>2025-05-01T14:00:00Z</timestamp>
65+
<note>Should have at least one of the following children 'attributedTo' or 'process'</note>
66+
</citation>
67+
<citation bom-ref="citation-2">
68+
<pointers>
69+
<pointer>/components/0/licenses/0/license/id</pointer>
70+
</pointers>
71+
<timestamp>2025-05-01T14:05:00Z</timestamp>
72+
<attributedTo>person-1</attributedTo>
73+
<attributedTo>scan-tool-1</attributedTo>
74+
<note>Should have at max one 'attributedTo'</note>
75+
</citation>
76+
<citation bom-ref="citation-3">
77+
<pointers>
78+
<pointer>/components/0/licenses/0/license/id</pointer>
79+
</pointers>
80+
<timestamp>2025-05-01T14:05:00Z</timestamp>
81+
<process>task-license-scan</process>
82+
<process>task-license-scan-2</process>
83+
<note>Should have at max one 'process'</note>
84+
</citation>
85+
</citations>
86+
</bom>

‎tools/src/test/resources/1.7/valid-citations-1.7.json‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,22 @@
3535
"pointers": [ "/components/0/name" ],
3636
"timestamp": "2025-05-01T14:00:00Z",
3737
"attributedTo": "person-1",
38-
"note": "Manually entered by Alice Example"
38+
"note": "Manually entered by Alice Example - with `attributedTo`"
3939
},
4040
{
4141
"bom-ref": "citation-2",
42+
"pointers": [ "/components/0/name" ],
43+
"timestamp": "2025-05-01T14:00:00Z",
44+
"process": "task-license-scan",
45+
"note": "Semi-manually entered by Alice Example - with `process`"
46+
},
47+
{
48+
"bom-ref": "citation-3",
4249
"pointers": [ "/components/0/licenses/0/license/id" ],
4350
"timestamp": "2025-05-01T14:05:00Z",
4451
"attributedTo": "scan-tool-1",
4552
"process": "task-license-scan",
46-
"note": "Auto-detected by license scanner tool"
53+
"note": "Auto-detected by license scanner tool - with both, 'attributedTo' and 'process'"
4754
}
4855
],
4956
"formulation": [

‎tools/src/test/resources/1.7/valid-citations-1.7.textproto‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,17 @@ citations [
4141
note: "Manually entered by Alice Example"
4242
},
4343
{
44-
bom_ref: "citation-2"
44+
bom_ref: "citation-1"
45+
pointer: "/components/0/name"
46+
timestamp: {
47+
seconds: 1746108000
48+
nanos: 0
49+
}
50+
process: "task-license-scan"
51+
note: "Semi-manually entered by Alice Example - with `process`"
52+
},
53+
{
54+
bom_ref: "citation-3"
4555
pointer: "/components/0/licenses/0/license/id"
4656
timestamp: {
4757
seconds: 1746108000

‎tools/src/test/resources/1.7/valid-citations-1.7.xml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,24 @@
5656
</pointers>
5757
<timestamp>2025-05-01T14:00:00Z</timestamp>
5858
<attributedTo>person-1</attributedTo>
59-
<note>Manually entered by Alice Example</note>
59+
<note>Manually entered by Alice Example - with `attributedTo`</note>
6060
</citation>
6161
<citation bom-ref="citation-2">
62+
<pointers>
63+
<pointer>/components/0/name</pointer>
64+
</pointers>
65+
<timestamp>2025-05-01T14:00:00Z</timestamp>
66+
<attributedTo>person-1</attributedTo>
67+
<note>Semi-manually entered by Alice Example - with `process`</note>
68+
</citation>
69+
<citation bom-ref="citation-3">
6270
<pointers>
6371
<pointer>/components/0/licenses/0/license/id</pointer>
6472
</pointers>
6573
<timestamp>2025-05-01T14:05:00Z</timestamp>
6674
<attributedTo>scan-tool-1</attributedTo>
6775
<process>task-license-scan</process>
68-
<note>Auto-detected by license scanner tool</note>
76+
<note>Auto-detected by license scanner tool - with both, 'attributedTo' and 'process'</note>
6977
</citation>
7078
</citations>
7179
</bom>

0 commit comments

Comments
 (0)