Skip to content

Commit 63e48c4

Browse files
stevespringettstevespringett
authored
Fixed evidence identity. Updated test cases (#359)
Fixed issue with evidence identity that restricted identity to only a single object. The defect was found in JSON and XML schemas but was correct in protobuf. Updated JSON and XML schemas in a way where they are backward compatible. Updated test cases in v1.6 that support BOTH methods (single object and array of objects) of specifying identity evidence. Closes #272
2 parents b2ae699 + 1e6ea08 commit 63e48c4

7 files changed

Lines changed: 319 additions & 176 deletions

File tree

‎docgen/json/templates/cyclonedx/tabbed_section.html‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,11 @@ <h2 class="handle">
1111
<a class="nav-link {% if loop.index == 1 -%}active {% endif -%} {{ operator }}-option"
1212
id="{{ node.html_id }}" data-toggle="tab" href="#tab-pane_{{ node.html_id }}" role="tab"
1313
onclick="setAnchor('#{{ node.html_id }}')"
14-
>{{ node.definition_name or tab_label ~ " " ~ loop.index }}</a>
14+
>{{ node.definition_name or tab_label ~ " " ~ loop.index }}
15+
{%- if node is deprecated -%}
16+
{{ " " }}<span class="badge deprecated-property">Deprecated</span>
17+
{%- endif -%}
18+
</a>
1519
</li>
1620
{%- endfor -%}
1721
</ul>

‎schema/bom-1.6.schema.json‎

Lines changed: 96 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -1982,101 +1982,20 @@
19821982
"additionalProperties": false,
19831983
"properties": {
19841984
"identity": {
1985-
"type": "object",
1986-
"description": "Evidence that substantiates the identity of a component.",
1987-
"required": [ "field" ],
1988-
"additionalProperties": false,
1989-
"properties": {
1990-
"field": {
1991-
"type": "string",
1992-
"enum": [
1993-
"group", "name", "version", "purl", "cpe", "swid", "hash"
1994-
],
1995-
"title": "Field",
1996-
"description": "The identity field of the component which the evidence describes."
1997-
},
1998-
"confidence": {
1999-
"type": "number",
2000-
"minimum": 0,
2001-
"maximum": 1,
2002-
"title": "Confidence",
2003-
"description": "The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence."
2004-
},
2005-
"methods": {
1985+
"description": "Evidence that substantiates the identity of a component. The identify may be an object or an array of identity objects. Support for specifying identify as a single object was introduced in CycloneDX v1.5. Arrays were introduced in v1.6. It is RECOMMENDED that all implementations use arrays, even if only one identity object is specified.",
1986+
"oneOf" : [
1987+
{
20061988
"type": "array",
2007-
"title": "Methods",
2008-
"description": "The methods used to extract and/or analyze the evidence.",
2009-
"items": {
2010-
"type": "object",
2011-
"required": [
2012-
"technique" ,
2013-
"confidence"
2014-
],
2015-
"additionalProperties": false,
2016-
"properties": {
2017-
"technique": {
2018-
"title": "Technique",
2019-
"description": "The technique used in this method of analysis.",
2020-
"type": "string",
2021-
"enum": [
2022-
"source-code-analysis",
2023-
"binary-analysis",
2024-
"manifest-analysis",
2025-
"ast-fingerprint",
2026-
"hash-comparison",
2027-
"instrumentation",
2028-
"dynamic-analysis",
2029-
"filename",
2030-
"attestation",
2031-
"other"
2032-
],
2033-
"meta:enum": {
2034-
"source-code-analysis": "Examines the source code without executing it.",
2035-
"binary-analysis": "Examines a compiled binary through reverse engineering, typically via disassembly or bytecode reversal.",
2036-
"manifest-analysis": "Examines a package management system such as those used for building software or installing software.",
2037-
"ast-fingerprint": "Examines the Abstract Syntax Tree (AST) of source code or a compiled binary.",
2038-
"hash-comparison": "Evaluates the cryptographic hash of a component against a set of pre-computed hashes of identified software.",
2039-
"instrumentation": "Examines the call stack of running applications by intercepting and monitoring application logic without the need to modify the application.",
2040-
"dynamic-analysis": "Evaluates a running application.",
2041-
"filename": "Evaluates file name of a component against a set of known file names of identified software.",
2042-
"attestation": "A testimony to the accuracy of the identify of a component made by an individual or entity.",
2043-
"other": "Any other technique."
2044-
}
2045-
},
2046-
"confidence": {
2047-
"type": "number",
2048-
"minimum": 0,
2049-
"maximum": 1,
2050-
"title": "Confidence",
2051-
"description": "The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence."
2052-
},
2053-
"value": {
2054-
"type": "string",
2055-
"title": "Value",
2056-
"description": "The value or contents of the evidence."
2057-
}
2058-
}
2059-
}
1989+
"title": "Array of Identity Objects",
1990+
"items": { "$ref": "#/definitions/componentIdentityEvidence" }
20601991
},
2061-
"tools": {
2062-
"type": "array",
2063-
"uniqueItems": true,
2064-
"items": {
2065-
"anyOf": [
2066-
{
2067-
"title": "Ref",
2068-
"$ref": "#/definitions/refLinkType"
2069-
},
2070-
{
2071-
"title": "BOM-Link Element",
2072-
"$ref": "#/definitions/bomLinkElementType"
2073-
}
2074-
]
2075-
},
2076-
"title": "BOM References",
2077-
"description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation."
1992+
{
1993+
"title": "A Single Identity Object",
1994+
"description": "[Deprecated]",
1995+
"$ref": "#/definitions/componentIdentityEvidence",
1996+
"deprecated": true
20781997
}
2079-
}
1998+
]
20801999
},
20812000
"occurrences": {
20822001
"type": "array",
@@ -4409,6 +4328,91 @@
44094328
}
44104329
}
44114330
},
4331+
"componentIdentityEvidence": {
4332+
"type": "object",
4333+
"description": "Evidence that substantiates the identity of a component.",
4334+
"required": [ "field" ],
4335+
"additionalProperties": false,
4336+
"properties": {
4337+
"field": {
4338+
"type": "string",
4339+
"enum": [
4340+
"group", "name", "version", "purl", "cpe", "swid", "hash"
4341+
],
4342+
"title": "Field",
4343+
"description": "The identity field of the component which the evidence describes."
4344+
},
4345+
"confidence": {
4346+
"type": "number",
4347+
"minimum": 0,
4348+
"maximum": 1,
4349+
"title": "Confidence",
4350+
"description": "The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence."
4351+
},
4352+
"methods": {
4353+
"type": "array",
4354+
"title": "Methods",
4355+
"description": "The methods used to extract and/or analyze the evidence.",
4356+
"items": {
4357+
"type": "object",
4358+
"required": [
4359+
"technique" ,
4360+
"confidence"
4361+
],
4362+
"additionalProperties": false,
4363+
"properties": {
4364+
"technique": {
4365+
"title": "Technique",
4366+
"description": "The technique used in this method of analysis.",
4367+
"type": "string",
4368+
"enum": [
4369+
"source-code-analysis",
4370+
"binary-analysis",
4371+
"manifest-analysis",
4372+
"ast-fingerprint",
4373+
"hash-comparison",
4374+
"instrumentation",
4375+
"dynamic-analysis",
4376+
"filename",
4377+
"attestation",
4378+
"other"
4379+
]
4380+
},
4381+
"confidence": {
4382+
"type": "number",
4383+
"minimum": 0,
4384+
"maximum": 1,
4385+
"title": "Confidence",
4386+
"description": "The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence."
4387+
},
4388+
"value": {
4389+
"type": "string",
4390+
"title": "Value",
4391+
"description": "The value or contents of the evidence."
4392+
}
4393+
}
4394+
}
4395+
},
4396+
"tools": {
4397+
"type": "array",
4398+
"uniqueItems": true,
4399+
"items": {
4400+
"anyOf": [
4401+
{
4402+
"title": "Ref",
4403+
"$ref": "#/definitions/refLinkType"
4404+
},
4405+
{
4406+
"title": "BOM-Link Element",
4407+
"$ref": "#/definitions/bomLinkElementType"
4408+
}
4409+
]
4410+
},
4411+
"title": "BOM References",
4412+
"description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation."
4413+
}
4414+
}
4415+
},
44124416
"standard": {
44134417
"type": "object",
44144418
"title": "Standard",

‎schema/bom-1.6.xsd‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2248,9 +2248,12 @@ limitations under the License.
22482248

22492249
<xs:complexType name="componentEvidenceType">
22502250
<xs:sequence>
2251-
<xs:element name="identity" minOccurs="0" maxOccurs="1">
2251+
<xs:element name="identity" minOccurs="0" maxOccurs="unbounded">
22522252
<xs:annotation>
2253-
<xs:documentation>Evidence that substantiates the identity of a component.</xs:documentation>
2253+
<xs:documentation>Evidence that substantiates the identity of a component. The identify may be an
2254+
object or an array of identity objects. Support for specifying identify as a single object was
2255+
introduced in CycloneDX v1.5. "unbounded" was introduced in v1.6. It is RECOMMENDED that all
2256+
implementations are aware of "unbounded".</xs:documentation>
22542257
</xs:annotation>
22552258
<xs:complexType>
22562259
<xs:sequence>

‎tools/src/test/js/json-schema-lint-tests.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ function getAjv(strict) {
4949
validateFormats: true,
5050
allowMatchingProperties: true,
5151
addUsedSchema: false,
52+
allowUnionTypes: false,
5253
keywords: ["meta:enum"],
5354
schemas: {
5455
'http://cyclonedx.org/schema/spdx.schema.json': spdxSchema,

‎tools/src/test/resources/1.6/valid-evidence-1.6.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,50 @@
105105
}
106106
]
107107
}
108+
},
109+
{
110+
"type": "application",
111+
"group": "com.example",
112+
"name": "example-project",
113+
"version": "1.0.0",
114+
"purl": "pkg:maven/com.example/example-project@1.0.0",
115+
"evidence": {
116+
"identity": [
117+
{
118+
"field": "group",
119+
"confidence": 0.1,
120+
"methods": [
121+
{
122+
"technique": "filename",
123+
"confidence": 0.1,
124+
"value": "example-project-1.0.0.jar"
125+
}
126+
]
127+
},
128+
{
129+
"field": "name",
130+
"confidence": 0.1,
131+
"methods": [
132+
{
133+
"technique": "filename",
134+
"confidence": 0.1,
135+
"value": "example-project-1.0.0.jar"
136+
}
137+
]
138+
},
139+
{
140+
"field": "version",
141+
"confidence": 0.1,
142+
"methods": [
143+
{
144+
"technique": "filename",
145+
"confidence": 0.1,
146+
"value": "example-project-1.0.0.jar"
147+
}
148+
]
149+
}
150+
]
151+
}
108152
}
109153
]
110154
}

0 commit comments

Comments
 (0)