Skip to content

Commit 2fbde0e

Browse files
nscuronscuro
committed
feat(spec1-5): add support for identity, occurrences, and callstack evidence
Signed-off-by: nscuro <[email protected]>
1 parent 61dd91e commit 2fbde0e

6 files changed

+300
-2
lines changed

‎convert.go

+6
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,12 @@ func componentConverter(specVersion SpecVersion) func(*Component) {
140140
if specVersion < SpecVersion1_5 {
141141
c.ModelCard = nil
142142
c.Data = nil
143+
144+
if c.Evidence != nil {
145+
c.Evidence.Identity = nil
146+
c.Evidence.Occurrences = nil
147+
c.Evidence.Callstack = nil
148+
}
143149
}
144150

145151
if !specVersion.supportsComponentType(c.Type) {

‎cyclonedx.go

+64-2
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,20 @@ func Bool(value bool) *bool {
116116

117117
type BOMReference string
118118

119+
type Callstack struct {
120+
Frames *[]CallstackFrame `json:"frames,omitempty" xml:"frames>frame,omitempty"`
121+
}
122+
123+
type CallstackFrame struct {
124+
Package string `json:"package,omitempty" xml:"package,omitempty"`
125+
Module string `json:"module,omitempty" xml:"module,omitempty"`
126+
Function string `json:"function,omitempty" xml:"function,omitempty"`
127+
Parameters *[]string `json:"parameters,omitempty" xml:"parameters>parameter,omitempty"`
128+
Line *int `json:"line,omitempty" xml:"line,omitempty"`
129+
Column *int `json:"column,omitempty" xml:"column,omitempty"`
130+
FullFilename string `json:"fullFilename,omitempty" xml:"fullFilename,omitempty"`
131+
}
132+
119133
type ComponentType string
120134

121135
const (
@@ -275,8 +289,56 @@ type Diff struct {
275289
}
276290

277291
type Evidence struct {
278-
Licenses *Licenses `json:"licenses,omitempty" xml:"licenses,omitempty"`
279-
Copyright *[]Copyright `json:"copyright,omitempty" xml:"copyright>text,omitempty"`
292+
Identity *EvidenceIdentity `json:"identity,omitempty" xml:"identity,omitempty"`
293+
Occurrences *[]EvidenceOccurrence `json:"occurrences,omitempty" xml:"occurrences>occurrence,omitempty"`
294+
Callstack *Callstack `json:"callstack,omitempty" xml:"callstack,omitempty"`
295+
Licenses *Licenses `json:"licenses,omitempty" xml:"licenses,omitempty"`
296+
Copyright *[]Copyright `json:"copyright,omitempty" xml:"copyright>text,omitempty"`
297+
}
298+
299+
type EvidenceIdentity struct {
300+
Field EvidenceIdentityFieldType `json:"field,omitempty" xml:"field,omitempty"`
301+
Confidence *float32 `json:"confidence,omitempty" xml:"confidence,omitempty"`
302+
Methods *[]EvidenceIdentityMethod `json:"methods,omitempty" xml:"methods>method,omitempty"`
303+
Tools *[]BOMReference `json:"tools,omitempty" xml:"tools>tool,omitempty"`
304+
}
305+
306+
type EvidenceIdentityFieldType string
307+
308+
const (
309+
EvidenceIdentityFieldTypeCPE EvidenceIdentityFieldType = "cpe"
310+
EvidenceIdentityFieldTypeGroup EvidenceIdentityFieldType = "group"
311+
EvidenceIdentityFieldTypeHash EvidenceIdentityFieldType = "hash"
312+
EvidenceIdentityFieldTypeName EvidenceIdentityFieldType = "name"
313+
EvidenceIdentityFieldTypePURL EvidenceIdentityFieldType = "purl"
314+
EvidenceIdentityFieldTypeSWID EvidenceIdentityFieldType = "swid"
315+
EvidenceIdentityFieldTypeVersion EvidenceIdentityFieldType = "version"
316+
)
317+
318+
type EvidenceIdentityMethod struct {
319+
Technique EvidenceIdentityTechnique `json:"technique,omitempty" xml:"technique,omitempty"`
320+
Confidence *float32 `json:"confidence,omitempty" xml:"confidence,omitempty"`
321+
Value string `json:"value,omitempty" xml:"value,omitempty"`
322+
}
323+
324+
type EvidenceIdentityTechnique string
325+
326+
const (
327+
EvidenceIdentityTechniqueASTFingerprint EvidenceIdentityTechnique = "ast-fingerprint"
328+
EvidenceIdentityTechniqueAttestation EvidenceIdentityTechnique = "attestation"
329+
EvidenceIdentityTechniqueBinaryAnalysis EvidenceIdentityTechnique = "binary-analysis"
330+
EvidenceIdentityTechniqueDynamicAnalysis EvidenceIdentityTechnique = "dynamic-analysis"
331+
EvidenceIdentityTechniqueFilename EvidenceIdentityTechnique = "filename"
332+
EvidenceIdentityTechniqueHashComparison EvidenceIdentityTechnique = "hash-comparison"
333+
EvidenceIdentityTechniqueInstrumentation EvidenceIdentityTechnique = "instrumentation"
334+
EvidenceIdentityTechniqueManifestAnalysis EvidenceIdentityTechnique = "manifest-analysis"
335+
EvidenceIdentityTechniqueOther EvidenceIdentityTechnique = "other"
336+
EvidenceIdentityTechniqueSourceCodeAnalysis EvidenceIdentityTechnique = "source-code-analysis"
337+
)
338+
339+
type EvidenceOccurrence struct {
340+
BOMRef string `json:"bom-ref,omitempty" xml:"bom-ref,attr,omitempty"`
341+
Location string `json:"location,omitempty" xml:"location,omitempty"`
280342
}
281343

282344
type ExternalReference struct {

‎testdata/snapshots/cyclonedx-go-TestRoundTripJSON-func1-valid-evidence.json

+59
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,65 @@
1919
],
2020
"purl": "pkg:maven/com.google.code.findbugs/[email protected]",
2121
"evidence": {
22+
"identity": {
23+
"field": "purl",
24+
"confidence": 1,
25+
"methods": [
26+
{
27+
"technique": "filename",
28+
"confidence": 0.1,
29+
"value": "findbugs-project-3.0.0.jar"
30+
},
31+
{
32+
"technique": "ast-fingerprint",
33+
"confidence": 0.9,
34+
"value": "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab"
35+
},
36+
{
37+
"technique": "hash-comparison",
38+
"confidence": 0.7,
39+
"value": "7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf"
40+
}
41+
],
42+
"tools": [
43+
"bom-ref-of-tool-that-performed-analysis"
44+
]
45+
},
46+
"occurrences": [
47+
{
48+
"bom-ref": "d6bf237e-4e11-4713-9f62-56d18d5e2079",
49+
"location": "/path/to/component"
50+
},
51+
{
52+
"bom-ref": "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
53+
"location": "/another/path/to/component"
54+
}
55+
],
56+
"callstack": {
57+
"frames": [
58+
{
59+
"package": "com.apache.logging.log4j.core",
60+
"module": "Logger.class",
61+
"function": "logMessage",
62+
"parameters": [
63+
"com.acme.HelloWorld",
64+
"Level.INFO",
65+
"null",
66+
"Hello World"
67+
],
68+
"line": 150,
69+
"column": 17,
70+
"fullFilename": "/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class"
71+
},
72+
{
73+
"module": "HelloWorld.class",
74+
"function": "main",
75+
"line": 20,
76+
"column": 12,
77+
"fullFilename": "/path/to/HelloWorld.class"
78+
}
79+
]
80+
},
2281
"licenses": [
2382
{
2483
"license": {

‎testdata/snapshots/cyclonedx-go-TestRoundTripXML-func1-valid-evidence.xml

+57
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,63 @@
1313
</licenses>
1414
<purl>pkg:maven/com.google.code.findbugs/[email protected]</purl>
1515
<evidence>
16+
<identity>
17+
<field>purl</field>
18+
<confidence>1</confidence>
19+
<methods>
20+
<method>
21+
<technique>filename</technique>
22+
<confidence>0.1</confidence>
23+
<value>findbugs-project-3.0.0.jar</value>
24+
</method>
25+
<method>
26+
<technique>ast-fingerprint</technique>
27+
<confidence>0.9</confidence>
28+
<value>61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab</value>
29+
</method>
30+
<method>
31+
<technique>hash-comparison</technique>
32+
<confidence>0.7</confidence>
33+
<value>7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf</value>
34+
</method>
35+
</methods>
36+
<tools>
37+
<tool ref="bom-ref-of-tool-that-performed-analysis"></tool>
38+
</tools>
39+
</identity>
40+
<occurrences>
41+
<occurrence bom-ref="d6bf237e-4e11-4713-9f62-56d18d5e2079">
42+
<location>/path/to/component</location>
43+
</occurrence>
44+
<occurrence bom-ref="b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175">
45+
<location>/another/path/to/component</location>
46+
</occurrence>
47+
</occurrences>
48+
<callstack>
49+
<frames>
50+
<frame>
51+
<package>com.apache.logging.log4j.core</package>
52+
<module>Logger.class</module>
53+
<function>logMessage</function>
54+
<parameters>
55+
<parameter>com.acme.HelloWorld</parameter>
56+
<parameter>Level.INFO</parameter>
57+
<parameter>null</parameter>
58+
<parameter>Hello World</parameter>
59+
</parameters>
60+
<line>150</line>
61+
<column>17</column>
62+
<fullFilename>/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class</fullFilename>
63+
</frame>
64+
<frame>
65+
<module>HelloWorld.class</module>
66+
<function>main</function>
67+
<line>20</line>
68+
<column>12</column>
69+
<fullFilename>/path/to/HelloWorld.class</fullFilename>
70+
</frame>
71+
</frames>
72+
</callstack>
1673
<licenses>
1774
<license>
1875
<id>Apache-2.0</id>

‎testdata/valid-evidence.json

+57
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,63 @@
1919
],
2020
"purl": "pkg:maven/com.google.code.findbugs/[email protected]",
2121
"evidence": {
22+
"identity": {
23+
"field": "purl",
24+
"confidence": 1,
25+
"methods": [
26+
{
27+
"technique": "filename",
28+
"confidence": 0.1,
29+
"value": "findbugs-project-3.0.0.jar"
30+
},
31+
{
32+
"technique": "ast-fingerprint",
33+
"confidence": 0.9,
34+
"value": "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab"
35+
},
36+
{
37+
"technique": "hash-comparison",
38+
"confidence": 0.7,
39+
"value": "7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf"
40+
}
41+
],
42+
"tools": [
43+
"bom-ref-of-tool-that-performed-analysis"
44+
]
45+
},
46+
"occurrences": [
47+
{
48+
"bom-ref": "d6bf237e-4e11-4713-9f62-56d18d5e2079",
49+
"location": "/path/to/component"
50+
},
51+
{
52+
"bom-ref": "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
53+
"location": "/another/path/to/component"
54+
}
55+
],
56+
"callstack": {
57+
"frames": [
58+
{
59+
60+
"package": "com.apache.logging.log4j.core",
61+
"module": "Logger.class",
62+
"function": "logMessage",
63+
"parameters": [
64+
"com.acme.HelloWorld", "Level.INFO", "null", "Hello World"
65+
],
66+
"line": 150,
67+
"column": 17,
68+
"fullFilename": "/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class"
69+
},
70+
{
71+
"module": "HelloWorld.class",
72+
"function": "main",
73+
"line": 20,
74+
"column": 12,
75+
"fullFilename": "/path/to/HelloWorld.class"
76+
}
77+
]
78+
},
2279
"licenses": [
2380
{
2481
"license": {

‎testdata/valid-evidence.xml

+57
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,63 @@
1313
</licenses>
1414
<purl>pkg:maven/com.google.code.findbugs/[email protected]</purl>
1515
<evidence>
16+
<identity>
17+
<field>purl</field>
18+
<confidence>1</confidence>
19+
<methods>
20+
<method>
21+
<technique>filename</technique>
22+
<confidence>0.1</confidence>
23+
<value>findbugs-project-3.0.0.jar</value>
24+
</method>
25+
<method>
26+
<technique>ast-fingerprint</technique>
27+
<confidence>0.9</confidence>
28+
<value>61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab</value>
29+
</method>
30+
<method>
31+
<technique>hash-comparison</technique>
32+
<confidence>0.7</confidence>
33+
<value>7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf</value>
34+
</method>
35+
</methods>
36+
<tools>
37+
<tool ref="bom-ref-of-tool-that-performed-analysis"/>
38+
</tools>
39+
</identity>
40+
<occurrences>
41+
<occurrence bom-ref="d6bf237e-4e11-4713-9f62-56d18d5e2079">
42+
<location>/path/to/component</location>
43+
</occurrence>
44+
<occurrence bom-ref="b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175">
45+
<location>/another/path/to/component</location>
46+
</occurrence>
47+
</occurrences>
48+
<callstack>
49+
<frames>
50+
<frame>
51+
<package>com.apache.logging.log4j.core</package>
52+
<module>Logger.class</module>
53+
<function>logMessage</function>
54+
<parameters>
55+
<parameter>com.acme.HelloWorld</parameter>
56+
<parameter>Level.INFO</parameter>
57+
<parameter>null</parameter>
58+
<parameter>Hello World</parameter>
59+
</parameters>
60+
<line>150</line>
61+
<column>17</column>
62+
<fullFilename>/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class</fullFilename>
63+
</frame>
64+
<frame>
65+
<module>HelloWorld.class</module>
66+
<function>main</function>
67+
<line>20</line>
68+
<column>12</column>
69+
<fullFilename>/path/to/HelloWorld.class</fullFilename>
70+
</frame>
71+
</frames>
72+
</callstack>
1673
<licenses>
1774
<license>
1875
<id>Apache-2.0</id>

0 commit comments

Comments
 (0)