Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for OmniBOR and Software Heritage persistent IDs #414

Merged
merged 3 commits into from
Mar 29, 2024
Merged

Add support for OmniBOR and Software Heritage persistent IDs #414

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c71f22b
Add support for OmniBOR and Software Heritage persistent IDs
stevespringett Mar 24, 2024
6fcbd02
Changed to array. Updated examples
stevespringett Mar 29, 2024
f3e98d4
Changed omnibor to omniborId
stevespringett Mar 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions schema/bom-1.6.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,10 @@ message Component {
repeated OrganizationalContact authors = 29;
// Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Examples include "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection".
repeated string tags = 30;
// Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid
repeated string omnibor = 31;
// Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html
repeated string swhid = 32;
}

// Specifies the data flow.
Expand Down Expand Up @@ -766,6 +770,8 @@ enum EvidenceFieldType {
EVIDENCE_FIELD_CPE = 5;
EVIDENCE_FIELD_SWID = 6;
EVIDENCE_FIELD_HASH = 7;
EVIDENCE_FIELD_OMNIBOR = 8;
EVIDENCE_FIELD_SWHID = 9;
}

enum EvidenceTechnique {
Expand Down
19 changes: 18 additions & 1 deletion schema/bom-1.6.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -969,6 +969,23 @@
"description": "Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec)",
"examples": ["pkg:maven/com.acme/[email protected]?packaging=jar"]
},
"omnibor": {
"type": "array",
"title": "OmniBOR Artifact Identifier (gitoid)",
"description": "Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)",
"items": { "type": "string" },
"examples": [
"gitoid:blob:sha1:a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
"gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
]
},
"swhid": {
"type": "array",
"title": "SoftWare Heritage Identifier",
"description": "Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html)",
"items": { "type": "string" },
"examples": ["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"]
},
"swid": {
"$ref": "#/definitions/swid",
"title": "SWID Tag",
Expand Down Expand Up @@ -4429,7 +4446,7 @@
"field": {
"type": "string",
"enum": [
"group", "name", "version", "purl", "cpe", "swid", "hash"
"group", "name", "version", "purl", "cpe", "omnibor", "swhid", "swid", "hash"
],
"title": "Field",
"description": "The identity field of the component which the evidence describes."
Expand Down
19 changes: 19 additions & 0 deletions schema/bom-1.6.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,6 +590,23 @@ limitations under the License.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="omnibor" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform
to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="swhid" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST
be valid and conform to the specification defined at:
https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="swid" type="bom:swidType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>
Expand Down Expand Up @@ -2246,6 +2263,8 @@ limitations under the License.
<xs:enumeration value="version"/>
<xs:enumeration value="purl"/>
<xs:enumeration value="cpe"/>
<xs:enumeration value="omnibor"/>
<xs:enumeration value="swhid"/>
<xs:enumeration value="swid"/>
<xs:enumeration value="hash"/>
</xs:restriction>
Expand Down
21 changes: 21 additions & 0 deletions tools/src/test/resources/1.6/valid-component-identifiers-1.6.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
"version": 1,
"components": [
{
"type": "library",
"group": "com.example",
"name": "acme-library",
"version": "1.0.0",
"cpe": "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*",
"purl": "pkg:maven/com.example/[email protected]",
"omnibor": [
"gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you. I think to make the omnibor information complete the Artifact Dependency Graph must be represented in dependencies section using provides.

https://omnibor.io/glossary/artifact_dependency_graph/

"gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
],
"swhid": [ "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" ]
}
]
}
19 changes: 19 additions & 0 deletions tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# proto-file: schema/bom-1.6.proto
# proto-message: Bom

spec_version: "1.6"
version: 1
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
components {
type: CLASSIFICATION_LIBRARY
group: "com.example"
name: "acme-example"
version: "1.0.0"
cpe: "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*"
purl: "pkg:maven/com.example/[email protected]"
omnibor: [
"gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64",
"gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
]
swhid: [ "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" ]
}
15 changes: 15 additions & 0 deletions tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
<?xml version="1.0"?>
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.6">
<components>
<component type="library">
<group>com.example</group>
<name>acme-library</name>
<version>1.0.0</version>
<cpe>cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*</cpe>
<purl>pkg:maven/com.example/[email protected]</purl>
<omnibod>gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64</omnibod>
<omnibor>gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08</omnibor>
<swhid>swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2</swhid>
</component>
</components>
</bom>
Loading