Open
Description
Hi,
looking at the CycloneDX 1.6 spec (https://cyclonedx.org/docs/1.6/json/#dependencies_items_provides), the Dependency object should be able to include a provides
Array of Strings (bom-refs).
The current implementation of org.cyclonedx.model.Dependency
is missing such mapping, therefore if I parse a SBOM file like:
{
"version": 1,
"specVersion": "1.6",
"serialNumber": "urn:uuid:fbe21a61-ba0f-3008-bc9f-fd4f0ac1aac3",
"metadata": {
"component": {
"name": "bar",
"purl": "pkg:maven/com.foo/[email protected]?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
"timestamp": "2024-12-05T09:40:16Z"
},
"bomFormat": "CycloneDX",
"components": [
{
"name": "bar",
"purl": "pkg:maven/com.foo/[email protected]?type=jar",
"bom-ref": "pkg:maven/com.foo/[email protected]?type=jar",
"type": "library",
"group": "com.foo",
"version": "1.0.0"
},
{
"name": "foo",
"purl": "pkg:maven/com.bar/[email protected]?type=jar",
"bom-ref": "pkg:maven/com.bar/[email protected]?type=jar",
"type": "library",
"group": "com.bar",
"version": "1.0.0"
}
],
"dependencies": [
{
"ref": "pkg:maven/com.foo/[email protected]?type=jar",
"provides": [
"pkg:maven/com.bar/[email protected]?type=jar"
]
}
]
}
using the org.cyclonedx.parsers.JsonParser.parse(File)
method, the org.cyclonedx.model.Bom
is returned without any issue, but it's missing the provides
array.
Would it be possible to update the org.cyclonedx.model.Dependency
mapping according to 1.6 spec?
Thanks!
Metadata
Assignees
Labels
No labels
Activity