Skip to content

Commit ca39c89

Browse files
ruromeroruromero
committed
chore: update expectations and minor fixes
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
1 parent 636f9a5 commit ca39c89

10 files changed

Lines changed: 155 additions & 152 deletions

File tree

‎src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -466,7 +466,9 @@ private Set<String> getDirectDependencyPaths(Path manifestPath) {
466466
for (JsonNode req : requireArray) {
467467
JsonNode indirectNode = req.get("Indirect");
468468
if (indirectNode == null || !indirectNode.asBoolean()) {
469-
directDepPaths.add(req.get("Path").asText());
469+
if (req.get("Path") != null) {
470+
directDepPaths.add(req.get("Path").asText());
471+
}
470472
}
471473
}
472474
}

‎src/main/java/io/github/guacsec/trustifyda/sbom/CycloneDXSbom.java‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818

1919
import static io.github.guacsec.trustifyda.impl.ExhortApi.debugLoggingIsNeeded;
2020

21+
import com.fasterxml.jackson.core.JsonProcessingException;
22+
import com.fasterxml.jackson.databind.ObjectMapper;
23+
import com.fasterxml.jackson.databind.node.ObjectNode;
2124
import com.github.packageurl.MalformedPackageURLException;
2225
import com.github.packageurl.PackageURL;
2326
import io.github.guacsec.trustifyda.logging.LoggersFactory;
@@ -315,16 +318,26 @@ public String getAsJsonString() {
315318
}
316319
}
317320

318-
private String ensureComponentsField(String json) {
321+
private String ensureComponentsField(String json) throws GeneratorException {
319322
try {
320-
var mapper = new com.fasterxml.jackson.databind.ObjectMapper();
321-
var root = (com.fasterxml.jackson.databind.node.ObjectNode) mapper.readTree(json);
322-
if (!root.has("components")) {
323-
root.set("components", mapper.createArrayNode());
323+
var mapper = new ObjectMapper();
324+
var rootNode = (ObjectNode) mapper.readTree(json);
325+
if (!rootNode.has("components")) {
326+
var ordered = mapper.createObjectNode();
327+
rootNode
328+
.properties()
329+
.forEach(
330+
field -> {
331+
ordered.set(field.getKey(), field.getValue());
332+
if (field.getKey().equals("metadata")) {
333+
ordered.set("components", mapper.createArrayNode());
334+
}
335+
});
336+
return mapper.writerWithDefaultPrettyPrinter().writeValueAsString(ordered);
324337
}
325-
return mapper.writeValueAsString(root);
326-
} catch (Exception e) {
327338
return json;
339+
} catch (JsonProcessingException e) {
340+
throw new GeneratorException("Unable to ensure components field in JSON", e);
328341
}
329342
}
330343

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_artifact/expected_component_sbom.json‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:15:45Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:15:45Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
16+
"dependencies": [
1717
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
18+
"ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19+
"dependsOn": []
2020
}
21-
]
22-
}
21+
],
22+
"components": []
23+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_artifact/expected_stack_sbom.json‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:14:35Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:14:35Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
17-
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
20-
}
21-
]
22-
}
16+
"dependencies": [],
17+
"components": []
18+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_dependency/expected_component_sbom.json‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:15:45Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:15:45Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
16+
"dependencies": [
1717
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
18+
"ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19+
"dependsOn": []
2020
}
21-
]
22-
}
21+
],
22+
"components": []
23+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_dependency/expected_stack_sbom.json‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:14:35Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:14:35Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
17-
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
20-
}
21-
]
22-
}
16+
"dependencies": [],
17+
"components": []
18+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_group/expected_component_sbom.json‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:15:45Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:15:45Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
16+
"dependencies": [
1717
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
18+
"ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19+
"dependsOn": []
2020
}
21-
]
22-
}
21+
],
22+
"components": []
23+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_group/expected_stack_sbom.json‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:14:35Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:14:35Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
17-
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
20-
}
21-
]
22-
}
16+
"dependencies": [],
17+
"components": []
18+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_version/expected_component_sbom.json‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:15:45Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:15:45Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
16+
"dependencies": [
1717
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
18+
"ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19+
"dependsOn": []
2020
}
21-
]
22-
}
21+
],
22+
"components": []
23+
}

‎src/test/resources/tst_manifests/maven/deps_with_ignore_on_version/expected_stack_sbom.json‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:14:35Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:14:35Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
17-
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
20-
}
21-
]
22-
}
16+
"dependencies": [],
17+
"components": []
18+
}

0 commit comments

Comments
 (0)