feat: Add CycloneDX 1.6 fields swhid and omniborId

- adds swhid and omniborId fields - updates unit test data to CycloneDX 1.6 - fixes schema/bom-1.6.xsd SPDX schemaLocation Co-authored-by: Daniel Ekelund <daniel.ekelund@snyk.io> Signed-off-by: Tim Pickles <tim.pickles@snyk.io> Signed-off-by: Daniel Ekelund <daniel.ekelund@snyk.io>
mcombuechen · May 15, 2024 · 729c284 · 729c284
1 parent 3a84845
commit 729c284
Show file tree

Hide file tree

Showing 156 changed files with 687 additions and 159 deletions.
diff --git a/convert.go b/convert.go
@@ -145,6 +145,11 @@ func componentConverter(specVersion SpecVersion) func(*Component) {
 			}
 		}
 
+		if specVersion < SpecVersion1_6 {
+			c.SWHID = nil
+			c.OmniborID = nil
+		}
+
 		if !specVersion.supportsComponentType(c.Type) {
 			c.Type = ComponentTypeApplication
 		}

diff --git a/cyclonedx.go b/cyclonedx.go
@@ -95,10 +95,10 @@ type BOM struct {
 
 func NewBOM() *BOM {
 	return &BOM{
-		JSONSchema:  jsonSchemas[SpecVersion1_5],
-		XMLNS:       xmlNamespaces[SpecVersion1_5],
+		JSONSchema:  jsonSchemas[SpecVersion1_6],
+		XMLNS:       xmlNamespaces[SpecVersion1_6],
 		BOMFormat:   BOMFormat,
-		SpecVersion: SpecVersion1_5,
+		SpecVersion: SpecVersion1_6,
 		Version:     1,
 	}
 }
@@ -173,6 +173,8 @@ type Component struct {
 	Copyright          string                `json:"copyright,omitempty" xml:"copyright,omitempty"`
 	CPE                string                `json:"cpe,omitempty" xml:"cpe,omitempty"`
 	PackageURL         string                `json:"purl,omitempty" xml:"purl,omitempty"`
+	OmniborID          *[]string             `json:"omniborId,omitempty" xml:"omniborId,omitempty"`
+	SWHID              *[]string             `json:"swhid,omitempty" xml:"swhid,omitempty"`
 	SWID               *SWID                 `json:"swid,omitempty" xml:"swid,omitempty"`
 	Modified           *bool                 `json:"modified,omitempty" xml:"modified,omitempty"`
 	Pedigree           *Pedigree             `json:"pedigree,omitempty" xml:"pedigree,omitempty"`
@@ -325,13 +327,15 @@ type EvidenceIdentity struct {
 type EvidenceIdentityFieldType string
 
 const (
-	EvidenceIdentityFieldTypeCPE     EvidenceIdentityFieldType = "cpe"
-	EvidenceIdentityFieldTypeGroup   EvidenceIdentityFieldType = "group"
-	EvidenceIdentityFieldTypeHash    EvidenceIdentityFieldType = "hash"
-	EvidenceIdentityFieldTypeName    EvidenceIdentityFieldType = "name"
-	EvidenceIdentityFieldTypePURL    EvidenceIdentityFieldType = "purl"
-	EvidenceIdentityFieldTypeSWID    EvidenceIdentityFieldType = "swid"
-	EvidenceIdentityFieldTypeVersion EvidenceIdentityFieldType = "version"
+	EvidenceIdentityFieldTypeCPE       EvidenceIdentityFieldType = "cpe"
+	EvidenceIdentityFieldTypeGroup     EvidenceIdentityFieldType = "group"
+	EvidenceIdentityFieldTypeHash      EvidenceIdentityFieldType = "hash"
+	EvidenceIdentityFieldTypeName      EvidenceIdentityFieldType = "name"
+	EvidenceIdentityFieldTypePURL      EvidenceIdentityFieldType = "purl"
+	EvidenceIdentityFieldTypeOmniborID EvidenceIdentityFieldType = "omniborId"
+	EvidenceIdentityFieldTypeSWHID     EvidenceIdentityFieldType = "swhid"
+	EvidenceIdentityFieldTypeSWID      EvidenceIdentityFieldType = "swid"
+	EvidenceIdentityFieldTypeVersion   EvidenceIdentityFieldType = "version"
 )
 
 type EvidenceIdentityMethod struct {

diff --git a/cyclonedx_json.go b/cyclonedx_json.go
@@ -124,6 +124,8 @@ func (sv *SpecVersion) UnmarshalJSON(bytes []byte) error {
 		*sv = SpecVersion1_4
 	case SpecVersion1_5.String():
 		*sv = SpecVersion1_5
+	case SpecVersion1_6.String():
+		*sv = SpecVersion1_6
 	default:
 		return ErrInvalidSpecVersion
 	}
@@ -192,4 +194,5 @@ var jsonSchemas = map[SpecVersion]string{
 	SpecVersion1_3: "http://cyclonedx.org/schema/bom-1.3.schema.json",
 	SpecVersion1_4: "http://cyclonedx.org/schema/bom-1.4.schema.json",
 	SpecVersion1_5: "http://cyclonedx.org/schema/bom-1.5.schema.json",
+	SpecVersion1_6: "http://cyclonedx.org/schema/bom-1.6.schema.json",
 }
diff --git a/cyclonedx_xml.go b/cyclonedx_xml.go
@@ -292,6 +292,8 @@ func (sv *SpecVersion) UnmarshalXML(d *xml.Decoder, start xml.StartElement) erro
 		*sv = SpecVersion1_4
 	case SpecVersion1_5.String():
 		*sv = SpecVersion1_5
+	case SpecVersion1_6.String():
+		*sv = SpecVersion1_6
 	default:
 		return ErrInvalidSpecVersion
 	}
@@ -411,4 +413,5 @@ var xmlNamespaces = map[SpecVersion]string{
 	SpecVersion1_3: "http://cyclonedx.org/schema/bom/1.3",
 	SpecVersion1_4: "http://cyclonedx.org/schema/bom/1.4",
 	SpecVersion1_5: "http://cyclonedx.org/schema/bom/1.5",
+	SpecVersion1_6: "http://cyclonedx.org/schema/bom/1.6",
 }
diff --git a/encode_test.go b/encode_test.go
@@ -50,9 +50,9 @@ func TestJsonBOMEncoder_SetPretty(t *testing.T) {
 	require.NoError(t, encoder.Encode(bom))
 
 	assert.Equal(t, `{
-  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "version": 1,
   "metadata": {
     "authors": [
@@ -83,9 +83,9 @@ func TestJsonBOMEncoder_SetEscapeHTML_true(t *testing.T) {
 	require.NoError(t, encoder.Encode(bom))
 
 	assert.Equal(t, `{
-  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "version": 1,
   "metadata": {
     "authors": [
@@ -116,9 +116,9 @@ func TestJsonBOMEncoder_SetEscapeHTML_false(t *testing.T) {
 	require.NoError(t, encoder.Encode(bom))
 
 	assert.Equal(t, `{
-  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "version": 1,
   "metadata": {
     "authors": [
@@ -158,7 +158,7 @@ func TestXmlBOMEncoder_SetPretty(t *testing.T) {
 	require.NoError(t, encoder.Encode(bom))
 
 	assert.Equal(t, `<?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.6" version="1">
   <metadata>
     <authors>
       <author>
@@ -186,7 +186,7 @@ func TestJsonBOMEncoder_EncodeVersion(t *testing.T) {
 		require.ErrorContains(t, err, "not supported")
 	})
 
-	for _, version := range []SpecVersion{SpecVersion1_2, SpecVersion1_3, SpecVersion1_4, SpecVersion1_5} {
+	for _, version := range []SpecVersion{SpecVersion1_2, SpecVersion1_3, SpecVersion1_4, SpecVersion1_5, SpecVersion1_6} {
 		t.Run(version.String(), func(t *testing.T) {
 			// Read original BOM JSON
 			inputFile, err := os.Open("./testdata/valid-bom.json")
@@ -216,7 +216,7 @@ func TestJsonBOMEncoder_EncodeVersion(t *testing.T) {
 }
 
 func TestXmlBOMEncoder_EncodeVersion(t *testing.T) {
-	for _, version := range []SpecVersion{SpecVersion1_0, SpecVersion1_1, SpecVersion1_2, SpecVersion1_3, SpecVersion1_4, SpecVersion1_5} {
+	for _, version := range []SpecVersion{SpecVersion1_0, SpecVersion1_1, SpecVersion1_2, SpecVersion1_3, SpecVersion1_4, SpecVersion1_5, SpecVersion1_6} {
 		t.Run(version.String(), func(t *testing.T) {
 			// Read original BOM JSON
 			inputFile, err := os.Open("./testdata/valid-bom.xml")

diff --git a/example_test.go b/example_test.go
@@ -89,7 +89,7 @@ func Example_encode() {
 
 	// Output:
 	// <?xml version="1.0" encoding="UTF-8"?>
-	// <bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+	// <bom xmlns="http://cyclonedx.org/schema/bom/1.6" version="1">
 	//   <metadata>
 	//     <component bom-ref="pkg:golang/acme-inc/acme-app@v1.0.0" type="application">
 	//       <name>ACME Application</name>

diff --git a/roundtrip_test.go b/roundtrip_test.go
@@ -52,7 +52,7 @@ func TestRoundTripJSON(t *testing.T) {
 			require.NoError(t, err)
 
 			// Sanity checks: BOM has to be valid
-			assertValidBOM(t, buf.Bytes(), BOMFileFormatJSON, SpecVersion1_5)
+			assertValidBOM(t, buf.Bytes(), BOMFileFormatJSON, SpecVersion1_6)
 
 			// Compare with snapshot
 			assert.NoError(t, snapShooter.SnapshotMulti(filepath.Base(bomFilePath), buf.String()))
@@ -85,7 +85,7 @@ func TestRoundTripXML(t *testing.T) {
 			require.NoError(t, err)
 
 			// Sanity check: BOM has to be valid
-			assertValidBOM(t, buf.Bytes(), BOMFileFormatXML, SpecVersion1_5)
+			assertValidBOM(t, buf.Bytes(), BOMFileFormatXML, SpecVersion1_6)
 
 			// Compare with snapshot
 			assert.NoError(t, snapShooter.SnapshotMulti(filepath.Base(bomFilePath), buf.String()))

diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd
@@ -24,7 +24,7 @@ limitations under the License.
            vc:maxVersion="1.1"
            version="1.6.0">
 
-    <xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="http://cyclonedx.org/schema/spdx"/>
+    <xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="spdx.xsd"/>
 
     <xs:annotation>
         <xs:documentation>

diff --git a/testdata/snapshots/cyclonedx-go-TestJsonBOMEncoder_EncodeVersion-func3-1.6.bom.json b/testdata/snapshots/cyclonedx-go-TestJsonBOMEncoder_EncodeVersion-func3-1.6.bom.json
diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-annotation.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-annotation.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-assembly.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-assembly.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-bom.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-bom.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "metadata": {

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-hashes.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-hashes.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-omniborId.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-omniborId.json
@@ -0,0 +1,18 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+  "version": 1,
+  "components": [
+    {
+      "type": "application",
+      "author": "Acme Super Heros",
+      "name": "Acme Application",
+      "version": "9.1.1",
+      "omniborId": [
+        "gitoid:blob:sha1:a94a8fe5ccb19ba61c4c0873d391e987982fbbd3"
+      ]
+    }
+  ]
+}
+
diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-ref.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-ref.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swhid.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swhid.json
@@ -0,0 +1,18 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+  "version": 1,
+  "components": [
+    {
+      "type": "application",
+      "author": "Acme Super Heros",
+      "name": "Acme Application",
+      "version": "9.1.1",
+      "swhid": [
+        "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"
+      ]
+    }
+  ]
+}
+
diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swid-full.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swid-full.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swid.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-swid.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-types.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-component-types.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-compositions.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-compositions.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "metadata": {

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-dependency.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-dependency.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-empty-components.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-empty-components.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": []

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-evidence.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-evidence.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-external-reference.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-external-reference.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-formulation.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-formulation.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-expression.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-expression.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-id.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-id.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-licensing.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-licensing.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-name.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-license-name.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-lifecycle.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-lifecycle.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "metadata": {

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-machine-learning.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-machine-learning.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [

diff --git a/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-metadata-author.json b/testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-metadata-author.json
@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "metadata": {