Skip to content

Commit b8d526e

Browse files
madpahmadpah
committed
added additional tests to validate Component in Metadata is properly represented in Dependency Graph
Signed-off-by: Paul Horton <[email protected]>
1 parent c605f2b commit b8d526e

File tree

11 files changed

+453
-2
lines changed

11 files changed

+453
-2
lines changed

‎cyclonedx/output/json.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ def generate(self, force_regeneration: bool = False) -> None:
6969
if self.get_bom().metadata.component:
7070
dependencies.append({
7171
'ref': str(cast(Component, self.get_bom().metadata.component).bom_ref),
72-
'dependsOn': []
72+
'dependsOn': [*map(str, cast(Component, self.get_bom().metadata.component).dependencies)]
7373
})
7474
if self.get_bom().components:
7575
for component in self.get_bom().components:

‎cyclonedx/output/xml.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,13 @@ def generate(self, force_regeneration: bool = False) -> None:
112112
if self.bom_supports_dependencies() and (self.get_bom().metadata.component or self.get_bom().components):
113113
dependencies_element = ElementTree.SubElement(self._root_bom_element, 'dependencies')
114114
if self.get_bom().metadata.component:
115-
ElementTree.SubElement(dependencies_element, 'dependency', {
115+
dependency_element = ElementTree.SubElement(dependencies_element, 'dependency', {
116116
'ref': str(cast(Component, self.get_bom().metadata.component).bom_ref)
117117
})
118+
for dependency in cast(Component, self.get_bom().metadata.component).dependencies:
119+
ElementTree.SubElement(dependency_element, 'dependency', {
120+
'ref': str(dependency)
121+
})
118122
for component in self.get_bom().components:
119123
dependency_element = ElementTree.SubElement(dependencies_element, 'dependency', {
120124
'ref': str(component.bom_ref)

‎tests/data.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,13 @@ def get_bom_with_dependencies_invalid() -> Bom:
130130
])
131131

132132

133+
def get_bom_with_metadata_component_and_dependencies() -> Bom:
134+
bom = Bom(components=[get_component_toml_with_hashes_with_references()])
135+
bom.metadata.component = get_component_setuptools_simple()
136+
bom.metadata.component.dependencies.update([get_component_toml_with_hashes_with_references().bom_ref])
137+
return bom
138+
139+
133140
def get_bom_with_component_setuptools_complete() -> Bom:
134141
component = get_component_setuptools_simple(bom_ref=MOCK_UUID_6)
135142
component.supplier = get_org_entity_1()

‎tests/fixtures/json/1.2/bom_dependencies_component.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.2",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"timestamp": "2021-09-01T10:50:42.051979+00:00",
9+
"tools": [
10+
{
11+
"vendor": "CycloneDX",
12+
"name": "cyclonedx-python-lib",
13+
"version": "VERSION"
14+
}
15+
],
16+
"component": {
17+
"type": "library",
18+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
19+
"author": "Test Author",
20+
"name": "setuptools",
21+
"version": "50.3.2",
22+
"licenses": [
23+
{
24+
"expression": "MIT License"
25+
}
26+
],
27+
"purl": "pkg:pypi/[email protected]?extension=tar.gz"
28+
}
29+
},
30+
"components": [
31+
{
32+
"type": "library",
33+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
34+
"name": "toml",
35+
"version": "0.10.2",
36+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
37+
"hashes": [
38+
{
39+
"alg": "SHA-256",
40+
"content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
41+
}
42+
],
43+
"externalReferences": [
44+
{
45+
"type": "distribution",
46+
"url": "https://cyclonedx.org",
47+
"comment": "No comment"
48+
}
49+
]
50+
}
51+
],
52+
"dependencies": [
53+
{
54+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
55+
"dependsOn": [
56+
"pkg:pypi/[email protected]?extension=tar.gz"
57+
]
58+
},
59+
{
60+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
61+
"dependsOn": []
62+
}
63+
]
64+
}

‎tests/fixtures/json/1.3/bom_dependencies_component.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.3",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"timestamp": "2021-09-01T10:50:42.051979+00:00",
9+
"tools": [
10+
{
11+
"vendor": "CycloneDX",
12+
"name": "cyclonedx-python-lib",
13+
"version": "VERSION"
14+
}
15+
],
16+
"component": {
17+
"type": "library",
18+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
19+
"author": "Test Author",
20+
"name": "setuptools",
21+
"version": "50.3.2",
22+
"licenses": [
23+
{
24+
"expression": "MIT License"
25+
}
26+
],
27+
"purl": "pkg:pypi/[email protected]?extension=tar.gz"
28+
}
29+
},
30+
"components": [
31+
{
32+
"type": "library",
33+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
34+
"name": "toml",
35+
"version": "0.10.2",
36+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
37+
"hashes": [
38+
{
39+
"alg": "SHA-256",
40+
"content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
41+
}
42+
],
43+
"externalReferences": [
44+
{
45+
"type": "distribution",
46+
"url": "https://cyclonedx.org",
47+
"comment": "No comment",
48+
"hashes": [
49+
{
50+
"alg": "SHA-256",
51+
"content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
52+
}
53+
]
54+
}
55+
]
56+
}
57+
],
58+
"dependencies": [
59+
{
60+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
61+
"dependsOn": [
62+
"pkg:pypi/[email protected]?extension=tar.gz"
63+
]
64+
},
65+
{
66+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
67+
"dependsOn": []
68+
}
69+
]
70+
}

‎tests/fixtures/json/1.4/bom_dependencies_component.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.4",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"timestamp": "2021-09-01T10:50:42.051979+00:00",
9+
"tools": [
10+
{
11+
"vendor": "CycloneDX",
12+
"name": "cyclonedx-python-lib",
13+
"version": "VERSION",
14+
"externalReferences": [
15+
{
16+
"type": "build-system",
17+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
18+
},
19+
{
20+
"type": "distribution",
21+
"url": "https://pypi.org/project/cyclonedx-python-lib/"
22+
},
23+
{
24+
"type": "documentation",
25+
"url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
26+
},
27+
{
28+
"type": "issue-tracker",
29+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
30+
},
31+
{
32+
"type": "license",
33+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
34+
},
35+
{
36+
"type": "release-notes",
37+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
38+
},
39+
{
40+
"type": "vcs",
41+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib"
42+
},
43+
{
44+
"type": "website",
45+
"url": "https://cyclonedx.org"
46+
}
47+
]
48+
}
49+
],
50+
"component": {
51+
"type": "library",
52+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
53+
"author": "Test Author",
54+
"name": "setuptools",
55+
"version": "50.3.2",
56+
"licenses": [
57+
{
58+
"expression": "MIT License"
59+
}
60+
],
61+
"purl": "pkg:pypi/[email protected]?extension=tar.gz"
62+
}
63+
},
64+
"components": [
65+
{
66+
"type": "library",
67+
"bom-ref": "pkg:pypi/[email protected]?extension=tar.gz",
68+
"name": "toml",
69+
"version": "0.10.2",
70+
"purl": "pkg:pypi/[email protected]?extension=tar.gz",
71+
"hashes": [
72+
{
73+
"alg": "SHA-256",
74+
"content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
75+
}
76+
],
77+
"externalReferences": [
78+
{
79+
"type": "distribution",
80+
"url": "https://cyclonedx.org",
81+
"comment": "No comment",
82+
"hashes": [
83+
{
84+
"alg": "SHA-256",
85+
"content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
86+
}
87+
]
88+
}
89+
]
90+
}
91+
],
92+
"dependencies": [
93+
{
94+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
95+
"dependsOn": [
96+
"pkg:pypi/[email protected]?extension=tar.gz"
97+
]
98+
},
99+
{
100+
"ref": "pkg:pypi/[email protected]?extension=tar.gz",
101+
"dependsOn": []
102+
}
103+
]
104+
}

‎tests/fixtures/xml/1.2/bom_dependencies_component.xml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
3+
<metadata>
4+
<timestamp>2021-09-01T10:50:42.051979+00:00</timestamp>
5+
<tools>
6+
<tool>
7+
<vendor>CycloneDX</vendor>
8+
<name>cyclonedx-python-lib</name>
9+
<version>VERSION</version>
10+
</tool>
11+
</tools>
12+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
13+
<author>Test Author</author>
14+
<name>setuptools</name>
15+
<version>50.3.2</version>
16+
<licenses>
17+
<expression>MIT License</expression>
18+
</licenses>
19+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
20+
</component>
21+
</metadata>
22+
<components>
23+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
24+
<name>toml</name>
25+
<version>0.10.2</version>
26+
<hashes>
27+
<hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
28+
</hashes>
29+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
30+
<externalReferences>
31+
<reference type="distribution">
32+
<url>https://cyclonedx.org</url>
33+
<comment>No comment</comment>
34+
</reference>
35+
</externalReferences>
36+
</component>
37+
</components>
38+
<dependencies>
39+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz">
40+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"></dependency>
41+
</dependency>
42+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"></dependency>
43+
</dependencies>
44+
</bom>

‎tests/fixtures/xml/1.3/bom_dependencies_component.xml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
3+
<metadata>
4+
<timestamp>2021-09-01T10:50:42.051979+00:00</timestamp>
5+
<tools>
6+
<tool>
7+
<vendor>CycloneDX</vendor>
8+
<name>cyclonedx-python-lib</name>
9+
<version>VERSION</version>
10+
</tool>
11+
</tools>
12+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
13+
<author>Test Author</author>
14+
<name>setuptools</name>
15+
<version>50.3.2</version>
16+
<licenses>
17+
<expression>MIT License</expression>
18+
</licenses>
19+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
20+
</component>
21+
</metadata>
22+
<components>
23+
<component type="library" bom-ref="pkg:pypi/[email protected]?extension=tar.gz">
24+
<name>toml</name>
25+
<version>0.10.2</version>
26+
<hashes>
27+
<hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
28+
</hashes>
29+
<purl>pkg:pypi/[email protected]?extension=tar.gz</purl>
30+
<externalReferences>
31+
<reference type="distribution">
32+
<url>https://cyclonedx.org</url>
33+
<comment>No comment</comment>
34+
<hashes>
35+
<hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
36+
</hashes>
37+
</reference>
38+
</externalReferences>
39+
</component>
40+
</components>
41+
<dependencies>
42+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz">
43+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"></dependency>
44+
</dependency>
45+
<dependency ref="pkg:pypi/[email protected]?extension=tar.gz"></dependency>
46+
</dependencies>
47+
</bom>

0 commit comments

Comments
 (0)