Skip to content

Commit 6c0e6c8

Browse files
andreas-hiltiandreas-hilti
authored
fix: 1.6 xml validation, add: documentation for 1.6 and testcases (#401)
Signed-off-by: andreas hilti <[email protected]>
1 parent 0202e41 commit 6c0e6c8

10 files changed

+1107
-18
lines changed

‎README.md

+14-14
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ Options:
110110
--output-file <output-file> Output BOM filename, will write to stdout if no value provided.
111111
--input-format <autodetect|csv|json|protobuf|spdxjson|xml> Specify input file format.
112112
--output-format <autodetect|csv|json|protobuf|spdxjson|xml> Specify output file format.
113-
--output-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5> Specify output BOM specification version. (ignored for CSV and SPDX formats)
113+
--output-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5|v1_6> Specify output BOM specification version. (ignored for CSV and SPDX formats)
114114
```
115115

116116
### Examples
@@ -192,15 +192,15 @@ Usage:
192192
cyclonedx merge [options]
193193
194194
Options:
195-
--input-files <input-files> Input BOM filenames (separate filenames with a space).
196-
--output-file <output-file> Output BOM filename, will write to stdout if no value provided.
197-
--input-format <autodetect|json|protobuf|xml> Specify input file format.
198-
--output-format <autodetect|json|protobuf|xml> Specify output file format.
199-
--output-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5> Specify output BOM specification version.
200-
--hierarchical Perform a hierarchical merge.
201-
--group <group> Provide the group of software the merged BOM describes.
202-
--name <name> Provide the name of software the merged BOM describes (required for hierarchical merging).
203-
--version <version> Provide the version of software the merged BOM describes (required for hierarchical merging).
195+
--input-files <input-files> Input BOM filenames (separate filenames with a space).
196+
--output-file <output-file> Output BOM filename, will write to stdout if no value provided.
197+
--input-format <autodetect|json|protobuf|xml> Specify input file format.
198+
--output-format <autodetect|json|protobuf|xml> Specify output file format.
199+
--output-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5|v1_6> Specify output BOM specification version.
200+
--hierarchical Perform a hierarchical merge.
201+
--group <group> Provide the group of software the merged BOM describes.
202+
--name <name> Provide the name of software the merged BOM describes (required for hierarchical merging).
203+
--version <version> Provide the version of software the merged BOM describes (required for hierarchical merging).
204204
```
205205

206206
Note: To perform a hierarchical merge all BOMs need the subject of the BOM
@@ -261,10 +261,10 @@ Usage:
261261
cyclonedx validate [options]
262262
263263
Options:
264-
--input-file <input-file> Input BOM filename, will read from stdin if no value provided.
265-
--input-format <autodetect|json|xml> Specify input file format.
266-
--input-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5> Specify input file specification version (defaults to v1.5)
267-
--fail-on-errors Fail on validation errors (return a non-zero exit code)
264+
--input-file <input-file> Input BOM filename, will read from stdin if no value provided.
265+
--input-format <autodetect|json|xml> Specify input file format.
266+
--input-version <v1_0|v1_1|v1_2|v1_3|v1_4|v1_5|v1_6> Specify input file specification version (defaults to v1.6)
267+
--fail-on-errors Fail on validation errors (return a non-zero exit code)
268268
```
269269

270270
### Examples

‎src/cyclonedx/Commands/ValidateCommand.cs

+6-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public static void Configure(RootCommand rootCommand)
3636
var subCommand = new System.CommandLine.Command("validate", "Validate a BOM");
3737
subCommand.Add(new Option<string>("--input-file", "Input BOM filename, will read from stdin if no value provided."));
3838
subCommand.Add(new Option<ValidationBomFormat>("--input-format", "Specify input file format."));
39-
subCommand.Add(new Option<SpecificationVersion?>("--input-version", "Specify input file specification version (defaults to v1.5)"));
39+
subCommand.Add(new Option<SpecificationVersion?>("--input-version", "Specify input file specification version (defaults to v1.6)"));
4040
subCommand.Add(new Option<bool>("--fail-on-errors", "Fail on validation errors (return a non-zero exit code)"));
4141
subCommand.Handler = CommandHandler.Create<ValidateCommandOptions>(Validate);
4242
rootCommand.Add(subCommand);
@@ -76,7 +76,11 @@ public static async Task<int> Validate(ValidateCommandOptions options)
7676
}
7777
else if (options.InputFormat == ValidationBomFormat.xml)
7878
{
79-
validationResult = Xml.Validator.Validate(inputBom, SpecificationVersion.v1_5);
79+
validationResult = Xml.Validator.Validate(inputBom, SpecificationVersion.v1_6);
80+
if (!validationResult.Valid)
81+
{
82+
validationResult = Xml.Validator.Validate(inputBom, SpecificationVersion.v1_5);
83+
}
8084
if (!validationResult.Valid)
8185
{
8286
validationResult = Xml.Validator.Validate(inputBom, SpecificationVersion.v1_4);

‎tests/cyclonedx.tests/ConvertTests.cs

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// This file is part of CycloneDX CLI Tool
1+
// This file is part of CycloneDX CLI Tool
22
//
33
// Licensed under the Apache License, Version 2.0 (the “License”);
44
// you may not use this file except in compliance with the License.
@@ -75,6 +75,11 @@ public class ConvertTests
7575
[InlineData("bom-1.5.json", ConvertFormat.json, "bom.json", ConvertFormat.json, null)]
7676
[InlineData("bom-1.5.json", ConvertFormat.json, "bom.json", ConvertFormat.json, SpecificationVersion.v1_5)]
7777

78+
[InlineData("bom-1.6.json", ConvertFormat.autodetect, "bom.json", ConvertFormat.autodetect, null)]
79+
[InlineData("bom-1.6.json", ConvertFormat.json, "bom.json", ConvertFormat.autodetect, null)]
80+
[InlineData("bom-1.6.json", ConvertFormat.json, "bom.json", ConvertFormat.json, null)]
81+
[InlineData("bom-1.6.json", ConvertFormat.json, "bom.json", ConvertFormat.json, SpecificationVersion.v1_6)]
82+
7883
[InlineData("bom.csv", ConvertFormat.autodetect, "bom.csv", ConvertFormat.autodetect, null)]
7984
[InlineData("bom.csv", ConvertFormat.csv, "bom.csv", ConvertFormat.autodetect, null)]
8085
[InlineData("bom.csv", ConvertFormat.csv, "bom.csv", ConvertFormat.csv, null)]

‎tests/cyclonedx.tests/Resources/bom-1.6.json

+177
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.6",
4+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
5+
"version": 1,
6+
"metadata": {
7+
"timestamp": "2020-04-13T20:20:39+00:00",
8+
"tools": [
9+
{
10+
"vendor": "Awesome Vendor",
11+
"name": "Awesome Tool",
12+
"version": "9.1.2",
13+
"hashes": [
14+
{
15+
"alg": "SHA-1",
16+
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
17+
},
18+
{
19+
"alg": "SHA-256",
20+
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
21+
}
22+
]
23+
}
24+
],
25+
"authors": [
26+
{
27+
"name": "Samantha Wright",
28+
"email": "[email protected]",
29+
"phone": "800-555-1212"
30+
}
31+
],
32+
"component": {
33+
"type": "application",
34+
"author": "Acme Super Heros",
35+
"name": "Acme Application",
36+
"version": "9.1.1",
37+
"swid": {
38+
"tagId": "swidgen-242eb18a-503e-ca37-393b-cf156ef09691_9.1.1",
39+
"name": "Acme Application",
40+
"version": "9.1.1",
41+
"text": {
42+
"contentType": "text/xml",
43+
"encoding": "base64",
44+
"content": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+CjxTb2Z0d2FyZUlkZW50aXR5IHhtbDpsYW5nPSJFTiIgbmFtZT0iQWNtZSBBcHBsaWNhdGlvbiIgdmVyc2lvbj0iOS4xLjEiIAogdmVyc2lvblNjaGVtZT0ibXVsdGlwYXJ0bnVtZXJpYyIgCiB0YWdJZD0ic3dpZGdlbi1iNTk1MWFjOS00MmMwLWYzODItM2YxZS1iYzdhMmE0NDk3Y2JfOS4xLjEiIAogeG1sbnM9Imh0dHA6Ly9zdGFuZGFyZHMuaXNvLm9yZy9pc28vMTk3NzAvLTIvMjAxNS9zY2hlbWEueHNkIj4gCiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiAKIHhzaTpzY2hlbWFMb2NhdGlvbj0iaHR0cDovL3N0YW5kYXJkcy5pc28ub3JnL2lzby8xOTc3MC8tMi8yMDE1LWN1cnJlbnQvc2NoZW1hLnhzZCBzY2hlbWEueHNkIiA+CiAgPE1ldGEgZ2VuZXJhdG9yPSJTV0lEIFRhZyBPbmxpbmUgR2VuZXJhdG9yIHYwLjEiIC8+IAogIDxFbnRpdHkgbmFtZT0iQWNtZSwgSW5jLiIgcmVnaWQ9ImV4YW1wbGUuY29tIiByb2xlPSJ0YWdDcmVhdG9yIiAvPiAKPC9Tb2Z0d2FyZUlkZW50aXR5Pg=="
45+
}
46+
}
47+
},
48+
"manufacture": {
49+
"name": "Acme, Inc.",
50+
"url": [
51+
"https://example.com"
52+
],
53+
"contact": [
54+
{
55+
"name": "Acme Professional Services",
56+
"email": "[email protected]"
57+
}
58+
]
59+
},
60+
"supplier": {
61+
"name": "Acme, Inc.",
62+
"url": [
63+
"https://example.com"
64+
],
65+
"contact": [
66+
{
67+
"name": "Acme Distribution",
68+
"email": "[email protected]"
69+
}
70+
]
71+
}
72+
},
73+
"components": [
74+
{
75+
"bom-ref": "pkg:npm/acme/[email protected]",
76+
"type": "library",
77+
"publisher": "Acme Inc",
78+
"group": "com.acme",
79+
"name": "tomcat-catalina",
80+
"version": "9.0.14",
81+
"hashes": [
82+
{
83+
"alg": "MD5",
84+
"content": "3942447fac867ae5cdb3229b658f4d48"
85+
},
86+
{
87+
"alg": "SHA-1",
88+
"content": "e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a"
89+
},
90+
{
91+
"alg": "SHA-256",
92+
"content": "f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b"
93+
},
94+
{
95+
"alg": "SHA-512",
96+
"content": "e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282"
97+
}
98+
],
99+
"licenses": [
100+
{
101+
"license": {
102+
"id": "Apache-2.0",
103+
"text": {
104+
"contentType": "text/plain",
105+
"encoding": "base64",
106+
"content": "License text here"
107+
},
108+
"url": "https://www.apache.org/licenses/LICENSE-2.0.txt"
109+
}
110+
}
111+
],
112+
"purl": "pkg:npm/acme/[email protected]",
113+
"pedigree": {
114+
"ancestors": [
115+
{
116+
"type": "library",
117+
"publisher": "Acme Inc",
118+
"group": "com.acme",
119+
"name": "tomcat-catalina",
120+
"version": "9.0.14"
121+
},
122+
{
123+
"type": "library",
124+
"publisher": "Acme Inc",
125+
"group": "com.acme",
126+
"name": "tomcat-catalina",
127+
"version": "9.0.14"
128+
}
129+
],
130+
"commits": [
131+
{
132+
"uid": "7638417db6d59f3c431d3e1f261cc637155684cd",
133+
"url": "https://location/to/7638417db6d59f3c431d3e1f261cc637155684cd",
134+
"author": {
135+
"timestamp": "2018-11-13T20:20:39+00:00",
136+
"name": "me",
137+
"email": "[email protected]"
138+
}
139+
}
140+
]
141+
}
142+
},
143+
{
144+
"type": "library",
145+
"supplier": {
146+
"name": "Example, Inc.",
147+
"url": [
148+
"https://example.com",
149+
"https://example.net"
150+
],
151+
"contact": [
152+
{
153+
"name": "Example Support AMER Distribution",
154+
"email": "[email protected]",
155+
"phone": "800-555-1212"
156+
},
157+
{
158+
"name": "Example Support APAC",
159+
"email": "[email protected]"
160+
}
161+
]
162+
},
163+
"author": "Example Super Heros",
164+
"group": "org.example",
165+
"name": "mylibrary",
166+
"version": "1.0.0"
167+
}
168+
],
169+
"dependencies": [
170+
{
171+
"ref": "pkg:npm/acme/[email protected]",
172+
"dependsOn": [
173+
"pkg:npm/acme/[email protected]"
174+
]
175+
}
176+
]
177+
}

‎tests/cyclonedx.tests/Resources/bom-1.6.xml

+181
Large diffs are not rendered by default.

‎tests/cyclonedx.tests/ValidateTests.cs

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// This file is part of CycloneDX CLI Tool
1+
// This file is part of CycloneDX CLI Tool
22
//
33
// Licensed under the Apache License, Version 2.0 (the “License”);
44
// you may not use this file except in compliance with the License.
@@ -47,6 +47,9 @@ public class ValidateTests
4747
[InlineData("bom-1.5.xml", ValidationBomFormat.autodetect, null, true)]
4848
[InlineData("bom-1.5.xml", ValidationBomFormat.xml, SpecificationVersion.v1_5, true)]
4949

50+
[InlineData("bom-1.6.xml", ValidationBomFormat.autodetect, null, true)]
51+
[InlineData("bom-1.6.xml", ValidationBomFormat.xml, SpecificationVersion.v1_6, true)]
52+
5053
[InlineData("bom-1.2.json", ValidationBomFormat.autodetect, null, true)]
5154
[InlineData("bom-1.2.json", ValidationBomFormat.autodetect, SpecificationVersion.v1_3, false)]
5255

@@ -64,6 +67,9 @@ public class ValidateTests
6467

6568
[InlineData("bom-1.5.json", ValidationBomFormat.autodetect, null, true)]
6669
[InlineData("bom-1.5.json", ValidationBomFormat.json, SpecificationVersion.v1_5, true)]
70+
71+
[InlineData("bom-1.6.json", ValidationBomFormat.autodetect, null, true)]
72+
[InlineData("bom-1.6.json", ValidationBomFormat.json, SpecificationVersion.v1_6, true)]
6773
public async Task Validate(string inputFilename, ValidationBomFormat inputFormat, SpecificationVersion? inputVersion, bool valid)
6874
{
6975
var exitCode = await ValidateCommand.Validate(new ValidateCommandOptions

0 commit comments

Comments
 (0)