feat(spec1-5): add new external reference types

Signed-off-by: nscuro <nscuro@protonmail.com>
CycloneDX · Jun 27, 2023 · c45ba61 · c45ba61
1 parent d2f3bb9
commit c45ba61
Show file tree

Hide file tree

Showing 2 changed files with 66 additions and 19 deletions.
diff --git a/convert.go b/convert.go
@@ -139,9 +139,15 @@ func convertExternalReferences(extRefs *[]ExternalReference, specVersion SpecVer
 		return
 	}
 
-	if specVersion < SpecVersion1_3 {
-		for i := range *extRefs {
-			(*extRefs)[i].Hashes = nil
+	for i := range *extRefs {
+		extRef := &(*extRefs)[i]
+
+		if !specVersion.supportsExternalReferenceType(extRef.Type) {
+			extRef.Type = ERTypeOther
+		}
+
+		if specVersion < SpecVersion1_3 {
+			extRef.Hashes = nil
 		}
 	}
 }
@@ -301,6 +307,30 @@ func (sv SpecVersion) supportsComponentType(cType ComponentType) bool {
 	return false
 }
 
+func (sv SpecVersion) supportsExternalReferenceType(ert ExternalReferenceType) bool {
+	switch ert {
+	case ERTypeAdversaryModel,
+		ERTypeAttestation,
+		ERTypeCertificationReport,
+		ERTypeCodifiedInfrastructure,
+		ERTypeComponentAnalysisReport,
+		ERTypeDistributionIntake,
+		ERTypeDynamicAnalysisReport,
+		ERTypeExploitabilityStatement,
+		ERTypeMaturityReport,
+		ERTypePentestReport,
+		ERTypeQualityMetrics,
+		ERTypeRiskAssessment,
+		ERTypeRuntimeAnalysisReport,
+		ERTypeStaticAnalysisReport,
+		ERTypeThreatModel,
+		ERTypeVulnerabilityAssertion:
+		return sv >= SpecVersion1_5
+	}
+
+	return sv >= SpecVersion1_1
+}
+
 func (sv SpecVersion) supportsHashAlgorithm(algo HashAlgorithm) bool {
 	switch algo {
 	case HashAlgoMD5, HashAlgoSHA1, HashAlgoSHA256, HashAlgoSHA384, HashAlgoSHA512, HashAlgoSHA3_256, HashAlgoSHA3_512:

diff --git a/cyclonedx.go b/cyclonedx.go
@@ -233,22 +233,39 @@ type ExternalReference struct {
 type ExternalReferenceType string
 
 const (
-	ERTypeAdvisories    ExternalReferenceType = "advisories"
-	ERTypeBOM           ExternalReferenceType = "bom"
-	ERTypeBuildMeta     ExternalReferenceType = "build-meta"
-	ERTypeBuildSystem   ExternalReferenceType = "build-system"
-	ERTypeChat          ExternalReferenceType = "chat"
-	ERTypeDistribution  ExternalReferenceType = "distribution"
-	ERTypeDocumentation ExternalReferenceType = "documentation"
-	ERTypeLicense       ExternalReferenceType = "license"
-	ERTypeMailingList   ExternalReferenceType = "mailing-list"
-	ERTypeOther         ExternalReferenceType = "other"
-	ERTypeIssueTracker  ExternalReferenceType = "issue-tracker"
-	ERTypeReleaseNotes  ExternalReferenceType = "release-notes"
-	ERTypeSocial        ExternalReferenceType = "social"
-	ERTypeSupport       ExternalReferenceType = "support"
-	ERTypeVCS           ExternalReferenceType = "vcs"
-	ERTypeWebsite       ExternalReferenceType = "website"
+	ERTypeAdversaryModel          ExternalReferenceType = "adversary-model"
+	ERTypeAdvisories              ExternalReferenceType = "advisories"
+	ERTypeAttestation             ExternalReferenceType = "attestation"
+	ERTypeBOM                     ExternalReferenceType = "bom"
+	ERTypeBuildMeta               ExternalReferenceType = "build-meta"
+	ERTypeBuildSystem             ExternalReferenceType = "build-system"
+	ERTypeCertificationReport     ExternalReferenceType = "certification-report"
+	ERTypeChat                    ExternalReferenceType = "chat"
+	ERTypeCodifiedInfrastructure  ExternalReferenceType = "codified-infrastructure"
+	ERTypeComponentAnalysisReport ExternalReferenceType = "component-analysis-report"
+	ERTypeDistribution            ExternalReferenceType = "distribution"
+	ERTypeDistributionIntake      ExternalReferenceType = "distribution-intake"
+	ERTypeDocumentation           ExternalReferenceType = "documentation"
+	ERTypeDynamicAnalysisReport   ExternalReferenceType = "dynamic-analysis-report"
+	ERTypeExploitabilityStatement ExternalReferenceType = "exploitability-statement"
+	ERTypeIssueTracker            ExternalReferenceType = "issue-tracker"
+	ERTypeLicense                 ExternalReferenceType = "license"
+	ERTypeMailingList             ExternalReferenceType = "mailing-list"
+	ERTypeMaturityReport          ExternalReferenceType = "maturity-report"
+	ERTypeOther                   ExternalReferenceType = "other"
+	ERTypePentestReport           ExternalReferenceType = "pentest-report"
+	ERTypeQualityMetrics          ExternalReferenceType = "quality-metrics"
+	ERTypeReleaseNotes            ExternalReferenceType = "release-notes"
+	ERTypeRiskAssessment          ExternalReferenceType = "risk-assessment"
+	ERTypeRuntimeAnalysisReport   ExternalReferenceType = "runtime-analysis-report"
+	ERTypeSecurityContact         ExternalReferenceType = "security-contact"
+	ERTypeSocial                  ExternalReferenceType = "social"
+	ERTypeStaticAnalysisReport    ExternalReferenceType = "static-analysis-report"
+	ERTypeSupport                 ExternalReferenceType = "support"
+	ERTypeThreatModel             ExternalReferenceType = "threat-model"
+	ERTypeVCS                     ExternalReferenceType = "vcs"
+	ERTypeVulnerabilityAssertion  ExternalReferenceType = "vulnerability-assertion"
+	ERTypeWebsite                 ExternalReferenceType = "website"
 )
 
 type Hash struct {