Skip to content

fix: place root component only in metadata.component#386

Merged
ruromero merged 2 commits into
guacsec:mainfrom
ruromero:TC-3918
Mar 30, 2026
Merged

fix: place root component only in metadata.component#386
ruromero merged 2 commits into
guacsec:mainfrom
ruromero:TC-3918

Conversation

@ruromero

@ruromero ruromero commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Remove root component from components[] array in CycloneDXSbom.addRoot() — per CycloneDX spec, root belongs only in metadata.component
  • Update addDependency() to prevent re-adding root as a library component
  • Update all 70 expected SBOM test fixtures to remove the root component entry from components[]

Fixes SBOM parity between Java and JavaScript DA clients.

Jira: TC-3918

Test plan

  • All 286 tests pass (mvn verify)
  • Integration tests with backend confirm identical transitive counts

🤖 Generated with Claude Code

@ruromero @claude
fix: place root component only in metadata.component, not in componen…
e993302 
…ts[]

Per CycloneDX spec, the root component belongs in metadata.component only.
Previously it was duplicated in the components[] array, causing SBOM
parity issues between Java and JavaScript clients.

- Remove root component addition from addRoot()
- Update addDependency() to skip adding root as a component
- Update all 70 expected SBOM test fixtures to reflect the change

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ruromero
ruromero marked this pull request as draft March 30, 2026 21:56
@ruromero ruromero mentioned this pull request Mar 30, 2026
Merged
1 task
@ruromero
chore: add missing EOF
f1635f4 
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
@ruromero
ruromero marked this pull request as ready for review March 30, 2026 22:51
@ruromero
ruromero requested a review from soul2zimate March 30, 2026 22:51
soul2zimate
soul2zimate approved these changes Mar 30, 2026 •
edited
Loading
View reviewed changes
@soul2zimate
soul2zimate self-requested a review March 30, 2026 23:25
@ruromero
ruromero merged commit 79d8d54 into guacsec:main Mar 30, 2026
43 of 226 checks passed
@ruromero
ruromero deleted the TC-3918 branch March 30, 2026 23:34
@soul2zimate

soul2zimate commented Mar 30, 2026

Copy link
Copy Markdown
Contributor 
Validating stack analysis...
  FAIL stack_analysis provider rhtpa status not ok: {'ok': False, 'name': 'rhtpa', 'code': 504, 'message': 'Request timed out', 'warnings': {}}
  FAIL stack_analysis provider rhtpa status code: 504
  PASS stack_analysis license checks passed
Error: Process completed with exit code 1.

three tests fail due to timeout

Thank you for the fix and the update in integration tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@soul2zimate soul2zimate Awaiting requested review from soul2zimate

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ruromero @soul2zimate