Skip to content

Commit db0b3b8

Browse files
jkowalleckjkowalleck
committed
wip
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
1 parent 2c00374 commit db0b3b8

8 files changed

+92
-15
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,17 @@ message Component {
106106
optional string group = 7;
107107
// The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery
108108
string name = 8;
109-
// The component version. The version should ideally comply with semantic versioning but is not enforced. Version was made optional in v1.4 of the spec. For backward compatibility, it is recommended to use an empty string to represent components without version information.
110-
string version = 9;
109+
oneof versionChoice {
110+
// The component version. The version should ideally comply with semantic versioning but is not enforced.
111+
// Version was made optional in v1.4 of the spec.
112+
// For backward compatibility, it is recommended to use an empty string to represent components without version information.
113+
string version = 9;
114+
// For an extraneous component, this is the accepted version range.
115+
// Value MUST follow Package URL Version Range syntax (vers)which is defined at <https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.
116+
// MAY only occur if property `isExtraneous` is set to 'true'.
117+
// MUST NOT be used for `Bom.metadata.component`.
118+
string versionRange = 33;
119+
}
111120
// Specifies a description for the component
112121
optional string description = 10;
113122
// Specifies the scope of the component. If a scope is not specified, SCOPE_REQUIRED scope should be assumed by the consumer of the BOM
@@ -154,6 +163,10 @@ message Component {
154163
repeated string omniborId = 31;
155164
// Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, must be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html
156165
repeated string swhid = 32;
166+
// Whether this component is extraneous.
167+
// An extraneous component is not part of an assembly, but is (expected to be) provided by the environment, regardless of the component's `scope`.
168+
// MUST be of value `false` for `Bom.metadata.component`.
169+
optional bool isExtraneous = 34; // implicit defaults to `false`
157170
}
158171

159172
// Specifies the data flow.

‎schema/bom-1.7.schema.json‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -920,22 +920,22 @@
920920
"description": "The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery",
921921
"examples": ["tomcat-catalina"]
922922
},
923-
"isExtraneous": {
924-
"type": "boolean",
925-
"title": "Component Is Extraneous",
926-
"description": "Whether this component is extraneous.\nAn extraneous component is not part of an assembly, but is (expected to be) provided by the environment, regardless of the component's `.scope`.\nMUST be of value `false` for `$.metadata.component`.",
927-
"default": false
923+
"version": {
924+
"$ref": "#/definitions/version",
925+
"title": "Component Version",
926+
"description": "The component version. The version should ideally comply with semantic versioning but is not enforced."
928927
},
929928
"versionRange": {
930929
"$ref": "#/definitions/versionRange",
931930
"title": "Component Version Range",
932-
"description": "A version range to fulfill this capability, specified in Package URL Version Range syntax (vers) which is defined at <https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.\nMAY only occur if property `.isExtraneous` is set to 'true'.\nMUST NOT be used for `$.metadata.component`.",
931+
"description": "For an extraneous component, this is the accepted version range.\nValue MUST follow Package URL Version Range syntax (vers)which is defined at <https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.\nMAY only occur if property `.isExtraneous` is set to 'true'.\nMUST NOT be used for `$.metadata.component`.",
933932
"$comment": "a rule is taking care of the coherence between `version`/`versionRange` and `isExtraneous`=='true'"
934933
},
935-
"version": {
936-
"$ref": "#/definitions/version",
937-
"title": "Component Version",
938-
"description": "The component version. The version should ideally comply with semantic versioning but is not enforced."
934+
"isExtraneous": {
935+
"type": "boolean",
936+
"title": "Component Is Extraneous",
937+
"description": "Whether this component is extraneous.\nAn extraneous component is not part of an assembly, but is (expected to be) provided by the environment, regardless of the component's `.scope`.\nMUST be of value `false` for `$.metadata.component`.",
938+
"default": false
939939
},
940940
"description": {
941941
"type": "string",

‎schema/bom-1.7.xsd‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -564,10 +564,10 @@ limitations under the License.
564564
<xs:element name="versionRange" type="bom:versionRangeType">
565565
<xs:annotation>
566566
<xs:documentation><![CDATA[
567-
A version range to fulfill this capability, specified in Package URL Version Range syntax (vers) which is defined at
568-
<https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.
567+
For an extraneous component, this is the accepted version range.
568+
Value MUST follow Package URL Version Range syntax (vers)which is defined at <https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.
569569
The component version range that may be provided to fulfill this capability.
570-
MAY only occur if attribute `.@isExtraneous` is set to `true`.
570+
MAY only occur if attribute `@isExtraneous` is set to `true`.
571571
MUST NOT be used for `/metadata/component`.
572572
]]></xs:documentation>
573573
</xs:annotation>

‎tools/src/test/resources/1.7/valid-component-extraneous-with-version.textproto‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
version: 1
6+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
7+
components {
8+
type: CLASSIFICATION_LIBRARY
9+
name: "Foo"
10+
description: "extraneous with version constraint",
11+
isExtraneous: true
12+
version: "9.1.24"
13+
}

‎tools/src/test/resources/1.7/valid-component-extraneous-with-versionRange.textproto‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
version: 1
6+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
7+
components {
8+
type: CLASSIFICATION_LIBRARY
9+
name: "Foo"
10+
description: "extraneous with version range constraints"
11+
isExtraneous: true
12+
versionRange: ">=9.0.0|<10.0.0"
13+
}

‎tools/src/test/resources/1.7/valid-component-extraneous-without-version.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"components": [
8+
{
9+
"type": "library",
10+
"name": "Foo",
11+
"description": "extraneous without version constraint",
12+
"isExtraneous": true
13+
}
14+
]
15+
}

‎tools/src/test/resources/1.7/valid-component-extraneous-without-version.textproto‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
version: 1
6+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
7+
components {
8+
type: CLASSIFICATION_LIBRARY
9+
name: "Foo"
10+
description: "extraneous without version constraint",
11+
isExtraneous: true
12+
}

‎tools/src/test/resources/1.7/valid-component-extraneous-without-version.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
3+
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1"
4+
>
5+
<components>
6+
<component type="library" isExtraneous="true">
7+
<name>Foo</name>
8+
<description>extraneous without version constraint</description>
9+
</component>
10+
</components>
11+
</bom>

0 commit comments

Comments
 (0)