From d27a5c3cefba706e3fd797fbff9c94ed7ceb5dd7 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Sun, 22 Oct 2023 17:22:34 +0200 Subject: [PATCH 1/5] draft: JSON - extraneous comp and version range related to https://github.com/CycloneDX/specification/issues/321 #321 Signed-off-by: Jan Kowalleck --- schema/bom-1.6.schema.json | 23 ++++++++++++++++++- .../invalid-component-version-and-range.json | 15 ++++++++++++ ...-versionRange-non-extraneous-explicit.json | 15 ++++++++++++ ...-versionRange-non-extraneous-implicit.json | 14 +++++++++++ ...ent-extraneous-no-version-information.json | 14 +++++++++++ ...lid-component-extraneous-with-version.json | 15 ++++++++++++ ...omponent-extraneous-with-versionRange.json | 15 ++++++++++++ 7 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 tools/src/test/resources/1.6/invalid-component-version-and-range.json create mode 100644 tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-explicit.json create mode 100644 tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-implicit.json create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.json create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-with-version.json create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.json diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index a25cf5d5..a62e0033 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -892,6 +892,10 @@ "title": "Component Version", "description": "The component version. The version should ideally comply with semantic versioning but is not enforced." }, + "versionRange": { + "$ref": "#/definitions/versionRange", + "title": "Component Version Range" + }, "description": { "type": "string", "title": "Component Description", @@ -913,6 +917,12 @@ "description": "Specifies the scope of the component. If scope is not specified, 'required' scope SHOULD be assumed by the consumer of the BOM.", "default": "required" }, + "isExtraneous": { + "type": "boolean", + "title": "Component Is Extraneous", + "description": "Whether this component is extraneous.\nAn extraneous component is not part of an assembly, but are (expected to be) provided by the environment, regardless of the component's `scope`.", + "default": false + }, "hashes": { "type": "array", "title": "Component Hashes", @@ -1037,7 +1047,18 @@ "title": "Signature", "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)." } - } + }, + "allOf": [ + { + "$comment": "property `version` and `versionRange` MUST NOT exist at the same time.", + "not": { "required": ["version", "versionRange"] } + }, + { + "$comment": "`version-range` MUST only be present, if `isExtraneous` is `true`", + "if": { "properties": { "isExtraneous": { "const": false } } }, + "then": { "not": { "required": ["versionRange"] } } + } + ] }, "swid": { "type": "object", diff --git a/tools/src/test/resources/1.6/invalid-component-version-and-range.json b/tools/src/test/resources/1.6/invalid-component-version-and-range.json new file mode 100644 index 00000000..3c7c3925 --- /dev/null +++ b/tools/src/test/resources/1.6/invalid-component-version-and-range.json @@ -0,0 +1,15 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "InvalidVersions", + "description": "may have `version` or `versionRange`, not both. This one does - it is invalid", + "version": "9.0.14", + "versionRange": ">=9.0.0|<10.0.0" + } + ] +} diff --git a/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-explicit.json b/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-explicit.json new file mode 100644 index 00000000..6d24299d --- /dev/null +++ b/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-explicit.json @@ -0,0 +1,15 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "InvalidVersions", + "description": "versionRange may only exist on extraneous components, set `isExtraneous` explicit", + "isExtraneous": false, + "versionRange": ">=9.0.0|<10.0.0" + } + ] +} diff --git a/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-implicit.json b/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-implicit.json new file mode 100644 index 00000000..d414cfb7 --- /dev/null +++ b/tools/src/test/resources/1.6/invalid-component-versionRange-non-extraneous-implicit.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "InvalidVersions", + "description": "versionRange may only exist on extraneous components, set `isExtraneous` implicit by default value", + "versionRange": ">=9.0.0|<10.0.0" + } + ] +} diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.json b/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.json new file mode 100644 index 00000000..ab2e2c9c --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.json @@ -0,0 +1,14 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "Foo", + "description": "extraneous without any version constraints", + "isExtraneous": true + } + ] +} diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-with-version.json b/tools/src/test/resources/1.6/valid-component-extraneous-with-version.json new file mode 100644 index 00000000..59f9bd5e --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-with-version.json @@ -0,0 +1,15 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "Foo", + "description": "extraneous with version constraint", + "isExtraneous": true, + "version": "9.1.24" + } + ] +} diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.json b/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.json new file mode 100644 index 00000000..b180187e --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.json @@ -0,0 +1,15 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "name": "Foo", + "description": "extraneous with version range constraints", + "isExtraneous": true, + "versionRange": ">=9.0.0|<10.0.0" + } + ] +} From d2c9080eb21215122ffab0fcfb56da7d16083f50 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Sun, 22 Oct 2023 20:49:16 +0200 Subject: [PATCH 2/5] docs Signed-off-by: Jan Kowalleck --- schema/bom-1.6.schema.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index a62e0033..fd9f2094 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -894,7 +894,8 @@ }, "versionRange": { "$ref": "#/definitions/versionRange", - "title": "Component Version Range" + "title": "Component Version Range", + "description": "The component version range that may be provided to fulfill this capability.\nMay only occur if `isExtraneous` is `true`." }, "description": { "type": "string", From 9b1c16686ad5fe624545bcebe92321cfe3e322f6 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Mon, 23 Oct 2023 11:16:35 +0200 Subject: [PATCH 3/5] xml Signed-off-by: Jan Kowalleck --- schema/bom-1.6.schema.json | 5 +-- schema/bom-1.6.xsd | 36 +++++++++++++++---- ...t-versionRange-non-extraneous-explicit.xml | 16 +++++++++ ...t-versionRange-non-extraneous-implicit.xml | 17 +++++++++ .../invalid-component-version-and-range.xml | 13 +++++++ ...nent-extraneous-no-version-information.xml | 11 ++++++ ...alid-component-extraneous-with-version.xml | 12 +++++++ ...component-extraneous-with-versionRange.xml | 12 +++++++ 8 files changed, 114 insertions(+), 8 deletions(-) create mode 100644 tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-explicit.xml create mode 100644 tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-implicit.xml create mode 100644 tools/src/test/resources/1.6/invalid-component-version-and-range.xml create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.xml create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-with-version.xml create mode 100644 tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.xml diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index fd9f2094..330b51b7 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -895,7 +895,7 @@ "versionRange": { "$ref": "#/definitions/versionRange", "title": "Component Version Range", - "description": "The component version range that may be provided to fulfill this capability.\nMay only occur if `isExtraneous` is `true`." + "description": "The component version range that may be provided to fulfill this capability.\nMAY only occur if `isExtraneous` is `true`." }, "description": { "type": "string", @@ -1057,7 +1057,8 @@ { "$comment": "`version-range` MUST only be present, if `isExtraneous` is `true`", "if": { "properties": { "isExtraneous": { "const": false } } }, - "then": { "not": { "required": ["versionRange"] } } + "then": { "not": { "required": ["versionRange"] } }, + "else": true } ] }, diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index e500f8e8..2131622e 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -500,12 +500,20 @@ limitations under the License. of the component. Examples: commons-lang3 and jquery - - - The component version. The version should ideally comply with semantic versioning - but is not enforced. - - + + + + The component version. The version should ideally comply with semantic versioning + but is not enforced. + + + + + The component version range that may be provided to fulfill this capability. + MAY only occur if `isExtraneous` is `true`. + + + Specifies a description for the component @@ -667,12 +675,28 @@ limitations under the License. + + + + Whether this component is extraneous. + An extraneous component is not part of an assembly, but are (expected to be) provided by the environment, regardless of the component's `scope`. + + + User-defined attributes may be used on this element as long as they do not have the same name as an existing attribute used by the schema. + diff --git a/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-explicit.xml b/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-explicit.xml new file mode 100644 index 00000000..6a0c73fc --- /dev/null +++ b/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-explicit.xml @@ -0,0 +1,16 @@ + + + + + + InvalidVersions + =9.0.0|<10.0.0]]> + versionRange may only exist on extraneous components, set `isExtraneous` explicit + + + \ No newline at end of file diff --git a/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-implicit.xml b/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-implicit.xml new file mode 100644 index 00000000..7572e7f8 --- /dev/null +++ b/tools/src/test/resources/1.6/informal-invalid-component-versionRange-non-extraneous-implicit.xml @@ -0,0 +1,17 @@ + + + + + + + InvalidVersions + =9.0.0|<10.0.0]]> + versionRange may only exist on extraneous components, set `isExtraneous` implicit by default value + + + \ No newline at end of file diff --git a/tools/src/test/resources/1.6/invalid-component-version-and-range.xml b/tools/src/test/resources/1.6/invalid-component-version-and-range.xml new file mode 100644 index 00000000..354842a8 --- /dev/null +++ b/tools/src/test/resources/1.6/invalid-component-version-and-range.xml @@ -0,0 +1,13 @@ + + + + + InvalidVersions + 9.0.14 + =9.0.0|<10.0.0]]> + may have `version` or `versionRange`, not both. This one does - it is invalid + + + \ No newline at end of file diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.xml b/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.xml new file mode 100644 index 00000000..29c237e4 --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-no-version-information.xml @@ -0,0 +1,11 @@ + + + + + Foo + extraneous without any version constraints + + + \ No newline at end of file diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-with-version.xml b/tools/src/test/resources/1.6/valid-component-extraneous-with-version.xml new file mode 100644 index 00000000..9b9a4a92 --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-with-version.xml @@ -0,0 +1,12 @@ + + + + + Foo + 9.1.24 + extraneous with version constraint + + + \ No newline at end of file diff --git a/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.xml b/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.xml new file mode 100644 index 00000000..886785f7 --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-extraneous-with-versionRange.xml @@ -0,0 +1,12 @@ + + + + + Foo + =9.0.0|<10.0.0]]> + extraneous with version range constraints + + + \ No newline at end of file From 310dff078ad56f3fd93b9c620bdd447dfa354016 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 16 Jan 2024 13:55:53 +0100 Subject: [PATCH 4/5] docs Signed-off-by: Jan Kowalleck --- schema/bom-1.6.schema.json | 3 ++- schema/bom-1.6.xsd | 13 ++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index 330b51b7..5e46f6c5 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -895,7 +895,8 @@ "versionRange": { "$ref": "#/definitions/versionRange", "title": "Component Version Range", - "description": "The component version range that may be provided to fulfill this capability.\nMAY only occur if `isExtraneous` is `true`." + "description": "The component version range that may be provided to fulfill this capability.\nMAY only occur if property `isExtraneous` is set to 'true'.", + "$comment": "a rule is taking cate of the plausibility between `version`/`versionRange` and `isExtraneous`=='true'" }, "description": { "type": "string", diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 2131622e..19f6a6f8 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -510,7 +510,11 @@ limitations under the License. The component version range that may be provided to fulfill this capability. - MAY only occur if `isExtraneous` is `true`. + MAY only occur if attribute `isExtraneous` is set to `true`. + @@ -689,12 +693,11 @@ limitations under the License. do not have the same name as an existing attribute used by the schema. - From 3bcd8750da8085bafb837ab64b0aa7b79ba1369e Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 16 Jan 2024 14:22:04 +0100 Subject: [PATCH 5/5] docs Signed-off-by: Jan Kowalleck --- schema/bom-1.6.xsd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index 19f6a6f8..4f510f51 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -512,7 +512,7 @@ limitations under the License. The component version range that may be provided to fulfill this capability. MAY only occur if attribute `isExtraneous` is set to `true`. @@ -697,7 +697,7 @@ limitations under the License. This would be formal, if the support for XSD1.1's `assert` was properly implemented in validators and tools digesting XML. - Child `versionRange` MAY only be present, if attribute `isExtraneous` is 'true'. + Child `versionRange` MAY only be present, if attribute `isExtraneous`=='true'. -->