update conversion logic

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

Author: viveksahu26

go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20250211213226-cce56d595160 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spdx/tools-golang v0.5.5 // indirect
 	golang.org/x/mod v0.23.0 // indirect

go.sum

@@ -43,8 +43,9 @@ github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=

pkg/converter/converter.go

@@ -25,6 +25,7 @@ import (
 	"github.com/interlynk-io/sbommv/pkg/tcontext"
 	"github.com/protobom/protobom/pkg/formats"
 	"github.com/protobom/protobom/pkg/reader"
+	"github.com/protobom/protobom/pkg/sbom"
 	"github.com/protobom/protobom/pkg/writer"
 )
 
@@ -51,39 +52,27 @@ func newBufferWriteCloser() *bufferWriteCloser {
 // ConvertSBOM converts SBOM data to the target format using protobom
 func ConvertSBOM(ctx tcontext.TransferMetadata, sbomData []byte, targetFormat FormatSpec) ([]byte, error) {
 	// Detect source format
+	logger.LogDebug(ctx.Context, "Iniatializing for SBOM conversion from spdx to cdx")
 
 	sourceFormat, err := detectFormat(sbomData)
 	if err != nil {
 		return nil, fmt.Errorf("detecting source format: %w", err)
 	}
+
 	if sourceFormat == targetFormat {
 		logger.LogDebug(ctx.Context, "No conversion needed", "format", sourceFormat)
 		return sbomData, nil
 	}
 
-	// Parse the input SBOM
-	r := reader.New()
-
-	doc, err := r.ParseStream(bytes.NewReader(sbomData))
+	doc, err := parseSBOM(sbomData)
 	if err != nil {
-		return nil, fmt.Errorf("parsing SBOM: %w", err)
+		return nil, err
 	}
 
-	// Serialize to target format (CycloneDX for DTrack)
+	// Serialize to CycloneDX format from SPDX format
 	if targetFormat == FormatCycloneDX {
-		// Set serialNumber if missing or invalid
-		if doc.Metadata.Id == "" || !isValidCycloneDXSerialNumber(doc.Metadata.Id) {
-			doc.Metadata.Id = "urn:uuid:" + uuid.New().String()
-		}
-		doc.Metadata.Version = "1" // Default version
-
-		w := writer.New()
-		buf := newBufferWriteCloser()
-		if err := w.WriteStreamWithOptions(doc, buf, &writer.Options{Format: formats.CDX16JSON}); err != nil {
-			return nil, fmt.Errorf("writing CycloneDX: %w", err)
-		}
-		logger.LogDebug(ctx.Context, "Converted SBOM", "from", sourceFormat, "to", targetFormat)
-		return buf.Bytes(), nil
+		enrichedDoc := enrichCycloneDXSBOM(doc)
+		return serializeToCycloneDX(ctx, enrichedDoc)
 	}
 
 	return nil, fmt.Errorf("unsupported conversion to %s", targetFormat)
@@ -111,3 +100,39 @@ func isValidCycloneDXSerialNumber(serial string) bool {
 	matched, _ := regexp.MatchString(pattern, serial)
 	return matched
 }
+
+// protobom on converting from spdx to cdx, puts wp invalid serial number and version.
+// enrichCycloneDXSBOM() function will update the correct serial number and version
+func enrichCycloneDXSBOM(doc *sbom.Document) *sbom.Document {
+	if doc.Metadata.Id == "" || !isValidCycloneDXSerialNumber(doc.Metadata.Id) {
+		doc.Metadata.Id = "urn:uuid:" + uuid.New().String()
+	}
+
+	doc.Metadata.Version = "1" // Default version
+
+	return doc
+}
+
+func parseSBOM(sbomData []byte) (*sbom.Document, error) {
+	// Parse the input SBOM
+	r := reader.New()
+
+	// parse a sbom document from a sbom data using protobom
+	doc, err := r.ParseStream(bytes.NewReader(sbomData))
+	if err != nil {
+		return nil, fmt.Errorf("parsing SBOM: %w", err)
+	}
+	return doc, nil
+}
+
+func serializeToCycloneDX(ctx tcontext.TransferMetadata, doc *sbom.Document) ([]byte, error) {
+	w := writer.New()
+	buf := newBufferWriteCloser()
+
+	if err := w.WriteStreamWithOptions(doc, buf, &writer.Options{Format: formats.CDX15JSON}); err != nil {
+		return nil, fmt.Errorf("writing CycloneDX: %w", err)
+	}
+	logger.LogDebug(ctx.Context, "Converted SPDX SBOM to CycloneDX")
+
+	return buf.Bytes(), nil
+}

pkg/engine/transfer.go

@@ -19,6 +19,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"strings"
 
 	adapter "github.com/interlynk-io/sbommv/pkg/adapter"
 	"github.com/interlynk-io/sbommv/pkg/converter"
@@ -73,16 +74,7 @@ func TransferRun(ctx context.Context, cmd *cobra.Command, config types.Config) e
 	}
 
 	var convertedIterator iterator.SBOMIterator
-
-	if types.AdapterType(config.DestinationType) == types.DtrackAdapterType {
-		logger.LogDebug(transferCtx.Context, "SBOM conversion will take place")
-		convertedSBOMs := sbomConversion(sbomIterator, *transferCtx)
-		// Create a new iterator with converted SBOMs
-		convertedIterator = iterator.NewMemoryIterator(convertedSBOMs)
-	} else {
-		logger.LogDebug(transferCtx.Context, "SBOM conversion will not take place")
-		convertedIterator = sbomIterator
-	}
+	convertedIterator = checkAdapterForConversion(transferCtx, config, sbomIterator)
 
 	if config.DryRun {
 		logger.LogDebug(transferCtx.Context, "Dry-run mode enabled: Displaying retrieved SBOMs", "values", config.DryRun)
@@ -154,9 +146,32 @@ func sbomConversion(sbomIterator iterator.SBOMIterator, transferCtx tcontext.Tra
 
 		// Update SBOM data with converted content
 		sbom.Data = convertedData
+
+		if strings.HasSuffix(sbom.Path, ".spdx.json") {
+			sbom.Path = strings.Replace(sbom.Path, ".spdx.json", ".conversion.cdx.json", 1)
+			// transferCtx.FilePath = sbom.Path // Sync FilePath for logging
+		}
 		convertedSBOMs = append(convertedSBOMs, sbom)
 	}
 	logger.LogDebug(transferCtx.Context, "Successfully SBOM conversion")
 
 	return convertedSBOMs
 }
+
+func checkAdapterForConversion(transferCtx *tcontext.TransferMetadata, config types.Config, sbomIterator iterator.SBOMIterator) iterator.SBOMIterator {
+	logger.LogDebug(transferCtx.Context, "Checking adapter eligibility for undergoing conversion layer", "adapter type", config.DestinationType)
+
+	if types.AdapterType(config.DestinationType) == types.DtrackAdapterType {
+		logger.LogDebug(transferCtx.Context, "Adapter eligible for conversion layer", "adapter type", config.DestinationType)
+
+		logger.LogDebug(transferCtx.Context, "SBOM conversion will take place")
+		convertedSBOMs := sbomConversion(sbomIterator, *transferCtx)
+		// Create a new iterator with converted SBOMs
+		return iterator.NewMemoryIterator(convertedSBOMs)
+	} else {
+
+		logger.LogDebug(transferCtx.Context, "Adapter not eligible for conversion layer", "adapter type", config.DestinationType)
+		logger.LogDebug(transferCtx.Context, "SBOM conversion will not take place")
+		return sbomIterator
+	}
+}

pkg/target/dependencytrack/client.go

@@ -51,6 +51,7 @@ type Project struct {
 func (c *DependencyTrackClient) FindProject(ctx *tcontext.TransferMetadata, projectName, projectVersion string) (string, error) {
 	logger.LogDebug(ctx.Context, "Finding Project", "project", projectName, "version", projectVersion)
 
+	// dtrack client, retrives all projects
 	projects, err := c.Client.Project.GetAll(ctx.Context, dtrack.PageOptions{})
 	if err != nil {
 		return "", err
@@ -59,6 +60,7 @@ func (c *DependencyTrackClient) FindProject(ctx *tcontext.TransferMetadata, proj
 	logger.LogDebug(ctx.Context, "Total Project Found", "count", projects.TotalCount)
 
 	for _, project := range projects.Items {
+		// lookup for the our project name with version
 		if project.Name == projectName && project.Version == projectVersion {
 			logger.LogDebug(ctx.Context, "Project found", "project", projectName, "version", project.Version, "id", project.UUID)
 			return project.UUID.String(), nil
@@ -71,14 +73,15 @@ func (c *DependencyTrackClient) FindProject(ctx *tcontext.TransferMetadata, proj
 
 // UploadSBOM uploads an SBOM to a Dependency-Track project
 func (c *DependencyTrackClient) UploadSBOM(ctx *tcontext.TransferMetadata, projectName, projectVersion string, sbomData []byte) error {
-	logger.LogDebug(ctx.Context, "Processing Uploading SBOMs to Dependency-Track sequentially", "project", projectName, "version", projectVersion)
+	logger.LogDebug(ctx.Context, "Processing Uploading SBOMs", "project", projectName, "version", projectVersion)
 
 	bomReq := dtrack.BOMUploadRequest{
 		ProjectName:    projectName,
 		ProjectVersion: projectVersion,
 		BOM:            base64.StdEncoding.EncodeToString(sbomData),
 	}
 
+	// dtrack client will upload SBOM
 	token, err := c.Client.BOM.Upload(ctx.Context, bomReq)
 	if err != nil {
 		return err
@@ -88,20 +91,22 @@ func (c *DependencyTrackClient) UploadSBOM(ctx *tcontext.TransferMetadata, proje
 	return nil
 }
 
-// FindOrCreateProject ensures a project exists, returning its UUID
+// FindOrCreateProject ensures a project exists, returning its UUID after finding or creating project
 func (c *DependencyTrackClient) FindOrCreateProject(ctx *tcontext.TransferMetadata, projectName, projectVersion string) (string, error) {
 	logger.LogDebug(ctx.Context, "Finding Project", "project", projectName, "version", projectVersion)
 
+	// find project using project name and project version
 	uuid, err := c.FindProject(ctx, projectName, projectVersion)
 	if err != nil {
 		return "", fmt.Errorf("finding project: %w", err)
 	}
 	if uuid != "" {
-		logger.LogDebug(ctx.Context, "Project already exists", "project", projectName, "uuid", uuid)
+		logger.LogDebug(ctx.Context, "Project already exists, therefor it wouldn't create a new", "project", projectName, "uuid", uuid)
 		return uuid, nil
 	}
-	logger.LogDebug(ctx.Context, "Project doesn't exist", "project", projectName, "version", projectVersion)
+	logger.LogDebug(ctx.Context, "New project will be created", "project", projectName, "version", projectVersion)
 
+	// create project using project name and project version
 	return c.CreateProject(ctx, projectName, projectVersion)
 }
 
@@ -114,6 +119,7 @@ func (c *DependencyTrackClient) CreateProject(ctx *tcontext.TransferMetadata, pr
 		Version: projectVersion,
 	}
 
+	// dtrack client will create a new project
 	created, err := c.Client.Project.Create(ctx.Context, project)
 	if err != nil {
 		return "", err

pkg/target/dependencytrack/uploader.go

@@ -59,9 +59,16 @@ func (u *SequentialUploader) Upload(ctx *tcontext.TransferMetadata, config *Depe
 			projectName = sbom.Namespace
 		}
 
+		projectVersion := config.ProjectVersion
+		if projectVersion == "" {
+			projectVersion = "latest"
+		}
+
 		u.mu.Lock()
 		if !u.createdProjects[projectName] {
-			_, err = client.FindOrCreateProject(ctx, projectName, config.ProjectVersion)
+
+			// find or create project using project name and project version
+			_, err = client.FindOrCreateProject(ctx, projectName, projectVersion)
 			if err != nil {
 				logger.LogInfo(ctx.Context, "Failed to find or create project", "project", projectName, "error", err)
 				u.mu.Unlock()
@@ -73,14 +80,14 @@ func (u *SequentialUploader) Upload(ctx *tcontext.TransferMetadata, config *Depe
 		u.mu.Unlock()
 
 		// Log SBOM filename before upload
-		logger.LogDebug(ctx.Context, "Attempting to upload SBOM", "project", projectName, "file", sbom.Path)
+		logger.LogDebug(ctx.Context, "Iniatializing uploading SBOM file", "file", sbom.Path)
 
 		err = client.UploadSBOM(ctx, projectName, config.ProjectVersion, sbom.Data)
 		if err != nil {
 			logger.LogInfo(ctx.Context, "Failed to upload SBOM", "project", projectName, "file", sbom.Path, "error", err)
 			continue
 		}
-		logger.LogDebug(ctx.Context, "Successfully uploaded SBOM", "project", projectName, "file", sbom.Path)
+		logger.LogDebug(ctx.Context, "Successfully uploaded SBOM file", "file", sbom.Path)
 	}
 	return nil
 }