Skip to content

Commit

Permalink
feat: update syft to generate cyclone-dx 1.6 by default (#2978)
Browse files Browse the repository at this point in the history 
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
  when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
  clear to me how this is used at this time (it may be redundant given
  other code), but effectively unless a specific spec version is
  configured, `syft` will emit the "most recent" spec version available
  for cyclonedx. Users who wish to pin back to a "older" specVersion
  (e.g. to preserve compatibilty with utilities that have not yet bumped
  to latest) can either set this in a syft config file or pass a
  name@spec_version pair to the output flag (e.g. `-o
  [email protected]=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
  via flags, but I couldn't quite figure out the right set to pass
  correctly, esp. since (as a relative go novice) I found it difficult
  to run just a single test file. I ended up "brute-forcing it" by
  changing the *updateSnapshot val to "true" and running it in Goland.
  A brief comment giving an example of regenerating fixtures usage would
  be helpful.

Signed-off-by: Rajan Agaskar <[email protected]>
  • Loading branch information
@ragaskar
ragaskar authored Jun 21, 2024
1 parent 9b17817 commit ae06830
Show file tree
Hide file tree
Showing 13 changed files with 6,862 additions and 1,903 deletions.
9 changes: 9 additions & 0 deletions schema/cyclonedx/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,12 @@ For this reason we've included a copy of all schemas needed to validate `syft` o
to reference local copies of dependent schemas.

You can get the latest schemas from the [CycloneDX specifications repo](https://github.com/CycloneDX/specification/tree/master/schema).

When the spec version is bumped an approach to determining prior modifications is to compare the
prior spec version (e.g. if updating to 1.7, compare the files in this directory against the 1.6
equivalents).

One can also update the schemas and observe the errors in order to make the necessary updates.
At the time of writing, the cyclonedx.xsd needed modifications to link to the local spdx.xsd,
and also to changes the minOccurs for a license tag to 0. (The json schema does not require
modification for the generated file to lint properly, but can simply be copy/pasted).
2,342 changes: 2,108 additions & 234 deletions schema/cyclonedx/cyclonedx.json
View file

Large diffs are not rendered by default.

6,148 changes: 4,487 additions & 1,661 deletions schema/cyclonedx/cyclonedx.xsd
View file

Large diffs are not rendered by default.

127 changes: 126 additions & 1 deletion schema/cyclonedx/spdx.xsd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"
targetNamespace="http://cyclonedx.org/schema/spdx"
version="1.0-3.23">
version="1.0-3.24.0">

<xs:simpleType name="licenseId">
<xs:restriction base="xs:string">
Expand All @@ -12,6 +12,11 @@
<xs:documentation>BSD Zero Clause License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3D-Slicer-1.0">
<xs:annotation>
<xs:documentation>3D Slicer License v1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AAL">
<xs:annotation>
<xs:documentation>Attribution Assurance License</xs:documentation>
Expand Down Expand Up @@ -117,6 +122,11 @@
<xs:documentation>Aladdin Free Public License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AMD-newlib">
<xs:annotation>
<xs:documentation>AMD newlib License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AMDPLPA">
<xs:annotation>
<xs:documentation>AMD&apos;s plpa_map.c License</xs:documentation>
Expand Down Expand Up @@ -147,6 +157,11 @@
<xs:documentation>ANTLR Software Rights Notice with license fallback</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="any-OSI">
<xs:annotation>
<xs:documentation>Any OSI License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Apache-1.0">
<xs:annotation>
<xs:documentation>Apache License 1.0</xs:documentation>
Expand Down Expand Up @@ -322,6 +337,11 @@
<xs:documentation>BSD 2-Clause - Ian Darwin variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="BSD-2-Clause-first-lines">
<xs:annotation>
<xs:documentation>BSD 2-Clause - first lines requirement</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="BSD-2-Clause-FreeBSD">
<xs:annotation>
<xs:documentation>BSD 2-Clause FreeBSD License</xs:documentation>
Expand Down Expand Up @@ -522,6 +542,11 @@
<xs:documentation>Caldera License (without preamble)</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Catharon">
<xs:annotation>
<xs:documentation>Catharon License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="CATOSL-1.1">
<xs:annotation>
<xs:documentation>Computer Associates Trusted Open Source License 1.1</xs:documentation>
Expand Down Expand Up @@ -1002,6 +1027,11 @@
<xs:documentation>curl License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="cve-tou">
<xs:annotation>
<xs:documentation>Common Vulnerability Enumeration ToU License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="D-FSL-1.0">
<xs:annotation>
<xs:documentation>Deutsche Freie Software Lizenz</xs:documentation>
Expand Down Expand Up @@ -1482,6 +1512,11 @@
<xs:documentation>gtkbook License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Gutmann">
<xs:annotation>
<xs:documentation>Gutmann License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HaskellReport">
<xs:annotation>
<xs:documentation>Haskell Language Report License</xs:documentation>
Expand Down Expand Up @@ -1532,11 +1567,21 @@
<xs:documentation>HPND with US Government export control warning</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export-US-acknowledgement">
<xs:annotation>
<xs:documentation>HPND with US Government export control warning and acknowledgment</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export-US-modify">
<xs:annotation>
<xs:documentation>HPND with US Government export control warning and modification rqmt</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export2-US">
<xs:annotation>
<xs:documentation>HPND with US Government export control and 2 disclaimers</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Fenneberg-Livingston">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant</xs:documentation>
Expand All @@ -1547,6 +1592,11 @@
<xs:documentation>Historical Permission Notice and Disclaimer - INRIA-IMAG variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Intel">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Intel variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Kevlin-Henney">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Kevlin Henney variant</xs:documentation>
Expand All @@ -1557,6 +1607,11 @@
<xs:documentation>Historical Permission Notice and Disclaimer - Markus Kuhn variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-merchantability-variant">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - merchantability variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-MIT-disclaimer">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
Expand Down Expand Up @@ -1587,11 +1642,21 @@
<xs:documentation>HPND sell variant with MIT disclaimer</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-sell-variant-MIT-disclaimer-rev">
<xs:annotation>
<xs:documentation>HPND sell variant with MIT disclaimer - reverse</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-UC">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - University of California variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-UC-export-US">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - University of California, US export warning</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HTMLTIDY">
<xs:annotation>
<xs:documentation>HTML Tidy License</xs:documentation>
Expand Down Expand Up @@ -2027,6 +2092,11 @@
<xs:documentation>MIT Festival Variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="MIT-Khronos-old">
<xs:annotation>
<xs:documentation>MIT Khronos - old variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="MIT-Modern-Variant">
<xs:annotation>
<xs:documentation>MIT License Modern Variant</xs:documentation>
Expand Down Expand Up @@ -2162,11 +2232,21 @@
<xs:documentation>Net Boolean Public License v1</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCBI-PD">
<xs:annotation>
<xs:documentation>NCBI Public Domain Notice</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCGL-UK-2.0">
<xs:annotation>
<xs:documentation>Non-Commercial Government Licence</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCL">
<xs:annotation>
<xs:documentation>NCL Source Code License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCSA">
<xs:annotation>
<xs:documentation>University of Illinois/NCSA Open Source License</xs:documentation>
Expand Down Expand Up @@ -2282,6 +2362,11 @@
<xs:documentation>Open Use of Data Agreement v1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="OAR">
<xs:annotation>
<xs:documentation>OAR License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="OCCT-PL">
<xs:annotation>
<xs:documentation>Open CASCADE Technology Public License</xs:documentation>
Expand Down Expand Up @@ -2562,6 +2647,11 @@
<xs:documentation>Pixar License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="pkgconf">
<xs:annotation>
<xs:documentation>pkgconf License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Plexus">
<xs:annotation>
<xs:documentation>Plexus Classworlds License</xs:documentation>
Expand All @@ -2587,6 +2677,11 @@
<xs:documentation>PostgreSQL License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PPL">
<xs:annotation>
<xs:documentation>Peer Production License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PSF-2.0">
<xs:annotation>
<xs:documentation>Python Software Foundation License 2.0</xs:documentation>
Expand Down Expand Up @@ -2862,6 +2957,11 @@
<xs:documentation>Sun PPP License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Sun-PPP-2000">
<xs:annotation>
<xs:documentation>Sun PPP License (2000)</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="SunPro">
<xs:annotation>
<xs:documentation>SunPro License</xs:documentation>
Expand Down Expand Up @@ -2907,6 +3007,11 @@
<xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="threeparttable">
<xs:annotation>
<xs:documentation>threeparttable License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="TMate">
<xs:annotation>
<xs:documentation>TMate Open Source License</xs:documentation>
Expand Down Expand Up @@ -3132,6 +3237,11 @@
<xs:documentation>XSkat License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="xzoom">
<xs:annotation>
<xs:documentation>xzoom License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="YPL-1.0">
<xs:annotation>
<xs:documentation>Yahoo! Public License v1.0</xs:documentation>
Expand Down Expand Up @@ -3203,6 +3313,11 @@
<xs:documentation>Asterisk exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Asterisk-linking-protocols-exception">
<xs:annotation>
<xs:documentation>Asterisk linking protocols exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Autoconf-exception-2.0">
<xs:annotation>
<xs:documentation>Autoconf exception 2.0</xs:documentation>
Expand Down Expand Up @@ -3438,6 +3553,11 @@
<xs:documentation>OpenVPN OpenSSL Exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PCRE2-exception">
<xs:annotation>
<xs:documentation>PCRE2 exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PS-or-PDF-font-exception-20170817">
<xs:annotation>
<xs:documentation>PS/PDF font exception (2017-08-17)</xs:documentation>
Expand All @@ -3463,6 +3583,11 @@
<xs:documentation>Qwt exception 1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="RRDtool-FLOSS-exception-2.0">
<xs:annotation>
<xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="SANE-exception">
<xs:annotation>
<xs:documentation>SANE Exception</xs:documentation>
Expand Down
59 changes: 59 additions & 0 deletions syft/format/cyclonedxjson/test-fixtures/identify/1.6.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
{
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:5208fea9-73dd-4624-b596-69fddccdb9e7",
"version": 1,
"metadata": {
"timestamp": "2023-09-29T12:02:02-04:00",
"tools": [
{
"vendor": "anchore",
"name": "syft",
"version": "[not provided]"
}
],
"component": {
"bom-ref": "a0ff99a6af10f11f",
"type": "file",
"name": "go.mod",
"version": "sha256:sha256:dc333f342905248a52e424d8dfd061251d01867d01a4f9d7397144a775ff9ebd"
}
},
"components": [
{
"bom-ref": "pkg:golang/github.com/wagoodman/[email protected]?package-id=2ff71a67fb024c86",
"type": "library",
"name": "github.com/wagoodman/go-partybus",
"version": "v0.0.0-20230516145632-8ccac152c651",
"cpe": "cpe:2.3:a:wagoodman:go-partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*",
"purl": "pkg:golang/github.com/wagoodman/[email protected]",
"properties": [
{
"name": "syft:package:foundBy",
"value": "go-module-file-cataloger"
},
{
"name": "syft:package:language",
"value": "go"
},
{
"name": "syft:package:metadataType",
"value": "GolangModMetadata"
},
{
"name": "syft:package:type",
"value": "go-module"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:wagoodman:go_partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*"
},
{
"name": "syft:location:0:path",
"value": "/go.mod"
}
]
}
]
}
Loading

0 comments on commit ae06830

Please sign in to comment.