From c71f22b19e2d8f8f26c10096572c17f57747a097 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 24 Mar 2024 16:04:53 -0500 Subject: [PATCH 1/3] Add support for OmniBOR and Software Heritage persistent IDs Signed-off-by: Steve Springett --- schema/bom-1.6.proto | 6 ++++++ schema/bom-1.6.schema.json | 14 +++++++++++++- schema/bom-1.6.xsd | 19 +++++++++++++++++++ .../1.6/valid-component-identifiers-1.6.json | 18 ++++++++++++++++++ .../valid-component-identifiers-1.6.textproto | 16 ++++++++++++++++ .../1.6/valid-component-identifiers-1.6.xml | 14 ++++++++++++++ 6 files changed, 86 insertions(+), 1 deletion(-) create mode 100644 tools/src/test/resources/1.6/valid-component-identifiers-1.6.json create mode 100644 tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto create mode 100644 tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index 3e6ee48c7..5f71962db 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -148,6 +148,10 @@ message Component { repeated OrganizationalContact authors = 29; // Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Examples include "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection". repeated string tags = 30; + // Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid + optional string omnibor = 31; + // Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html + optional string swhid = 32; } // Specifies the data flow. @@ -766,6 +770,8 @@ enum EvidenceFieldType { EVIDENCE_FIELD_CPE = 5; EVIDENCE_FIELD_SWID = 6; EVIDENCE_FIELD_HASH = 7; + EVIDENCE_FIELD_OMNIBOR = 8; + EVIDENCE_FIELD_SWHID = 9; } enum EvidenceTechnique { diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index 6e959ac96..7a4c8b4b6 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -969,6 +969,18 @@ "description": "Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec)", "examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"] }, + "omnibor": { + "type": "string", + "title": "OmniBOR Artifact Identifier (gitoid)", + "description": "Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)", + "examples": ["gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64"] + }, + "swhid": { + "type": "string", + "title": "SoftWare Heritage Identifier", + "description": "Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html)", + "examples": ["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"] + }, "swid": { "$ref": "#/definitions/swid", "title": "SWID Tag", @@ -4429,7 +4441,7 @@ "field": { "type": "string", "enum": [ - "group", "name", "version", "purl", "cpe", "swid", "hash" + "group", "name", "version", "purl", "cpe", "omnibor", "swhid", "swid", "hash" ], "title": "Field", "description": "The identity field of the component which the evidence describes." diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index b904975ed..b5b4fa1f2 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -590,6 +590,23 @@ limitations under the License. + + + + Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform + to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid + + + + + + + Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST + be valid and conform to the specification defined at: + https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html + + + @@ -2246,6 +2263,8 @@ limitations under the License. + + diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json new file mode 100644 index 000000000..c084ba08c --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json @@ -0,0 +1,18 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "library", + "group": "com.example", + "name": "acme-library", + "version": "1.0.0", + "cpe": "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*", + "purl": "pkg:maven/com.example/acme-library@1.0.0", + "omnibor": "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", + "swhid": "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" + } + ] +} diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto new file mode 100644 index 000000000..33499ddf6 --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto @@ -0,0 +1,16 @@ +# proto-file: schema/bom-1.6.proto +# proto-message: Bom + +spec_version: "1.6" +version: 1 +serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" +components { + type: CLASSIFICATION_LIBRARY + group: "com.example" + name: "acme-example" + version: "1.0.0" + cpe: "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*" + purl: "pkg:maven/com.example/acme-library@1.0.0" + omnibor: "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64" + swhid: "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" +} diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml new file mode 100644 index 000000000..c3e99b7d5 --- /dev/null +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml @@ -0,0 +1,14 @@ + + + + + com.example + acme-library + 1.0.0 + cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:* + pkg:maven/com.example/acme-library@1.0.0 + gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64 + swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2 + + + From 6fcbd0275aef86ef5b6ddac4c581aadbe864756f Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Thu, 28 Mar 2024 22:24:39 -0500 Subject: [PATCH 2/3] Changed to array. Updated examples Signed-off-by: Steve Springett --- schema/bom-1.6.proto | 4 ++-- schema/bom-1.6.schema.json | 11 ++++++++--- schema/bom-1.6.xsd | 4 ++-- .../1.6/valid-component-identifiers-1.6.json | 7 +++++-- .../1.6/valid-component-identifiers-1.6.textproto | 7 +++++-- .../resources/1.6/valid-component-identifiers-1.6.xml | 3 ++- 6 files changed, 24 insertions(+), 12 deletions(-) diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index 5f71962db..46e108a37 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -149,9 +149,9 @@ message Component { // Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Examples include "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection". repeated string tags = 30; // Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid - optional string omnibor = 31; + repeated string omnibor = 31; // Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html - optional string swhid = 32; + repeated string swhid = 32; } // Specifies the data flow. diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index 7a4c8b4b6..02c427ec9 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -970,15 +970,20 @@ "examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"] }, "omnibor": { - "type": "string", + "type": "array", "title": "OmniBOR Artifact Identifier (gitoid)", "description": "Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)", - "examples": ["gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64"] + "items": { "type": "string" }, + "examples": [ + "gitoid:blob:sha1:a94a8fe5ccb19ba61c4c0873d391e987982fbbd3", + "gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" + ] }, "swhid": { - "type": "string", + "type": "array", "title": "SoftWare Heritage Identifier", "description": "Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html)", + "items": { "type": "string" }, "examples": ["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"] }, "swid": { diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index b5b4fa1f2..b97594ecf 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -590,7 +590,7 @@ limitations under the License. - + Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform @@ -598,7 +598,7 @@ limitations under the License. - + Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json index c084ba08c..3bb2f44a2 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json @@ -11,8 +11,11 @@ "version": "1.0.0", "cpe": "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*", "purl": "pkg:maven/com.example/acme-library@1.0.0", - "omnibor": "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", - "swhid": "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" + "omnibor": [ + "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", + "gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" + ], + "swhid": [ "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" ] } ] } diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto index 33499ddf6..4f048f7d5 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto @@ -11,6 +11,9 @@ components { version: "1.0.0" cpe: "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*" purl: "pkg:maven/com.example/acme-library@1.0.0" - omnibor: "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64" - swhid: "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" + omnibor: [ + "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", + "gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" + ] + swhid: [ "swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2" ] } diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml index c3e99b7d5..d97aed21f 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml @@ -7,7 +7,8 @@ 1.0.0 cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:* pkg:maven/com.example/acme-library@1.0.0 - gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64 + gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64 + gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2 From f3e98d41e504adacb178c5d187cc9cce14fd5361 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Thu, 28 Mar 2024 22:29:15 -0500 Subject: [PATCH 3/3] Changed omnibor to omniborId Signed-off-by: Steve Springett --- schema/bom-1.6.proto | 4 ++-- schema/bom-1.6.schema.json | 4 ++-- schema/bom-1.6.xsd | 4 ++-- .../test/resources/1.6/valid-component-identifiers-1.6.json | 2 +- .../resources/1.6/valid-component-identifiers-1.6.textproto | 2 +- .../test/resources/1.6/valid-component-identifiers-1.6.xml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto index 46e108a37..4f69a9e35 100644 --- a/schema/bom-1.6.proto +++ b/schema/bom-1.6.proto @@ -149,7 +149,7 @@ message Component { // Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Examples include "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection". repeated string tags = 30; // Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid - repeated string omnibor = 31; + repeated string omniborId = 31; // Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html repeated string swhid = 32; } @@ -770,7 +770,7 @@ enum EvidenceFieldType { EVIDENCE_FIELD_CPE = 5; EVIDENCE_FIELD_SWID = 6; EVIDENCE_FIELD_HASH = 7; - EVIDENCE_FIELD_OMNIBOR = 8; + EVIDENCE_FIELD_OMNIBOR_ID = 8; EVIDENCE_FIELD_SWHID = 9; } diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json index 02c427ec9..ef78f8639 100644 --- a/schema/bom-1.6.schema.json +++ b/schema/bom-1.6.schema.json @@ -969,7 +969,7 @@ "description": "Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec)", "examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"] }, - "omnibor": { + "omniborId": { "type": "array", "title": "OmniBOR Artifact Identifier (gitoid)", "description": "Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid)", @@ -4446,7 +4446,7 @@ "field": { "type": "string", "enum": [ - "group", "name", "version", "purl", "cpe", "omnibor", "swhid", "swid", "hash" + "group", "name", "version", "purl", "cpe", "omniborId", "swhid", "swid", "hash" ], "title": "Field", "description": "The identity field of the component which the evidence describes." diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd index b97594ecf..daa73b204 100644 --- a/schema/bom-1.6.xsd +++ b/schema/bom-1.6.xsd @@ -590,7 +590,7 @@ limitations under the License. - + Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform @@ -2263,7 +2263,7 @@ limitations under the License. - + diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json index 3bb2f44a2..ca44eebc7 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.json @@ -11,7 +11,7 @@ "version": "1.0.0", "cpe": "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*", "purl": "pkg:maven/com.example/acme-library@1.0.0", - "omnibor": [ + "omniborId": [ "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", "gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" ], diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto index 4f048f7d5..52a05dae8 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.textproto @@ -11,7 +11,7 @@ components { version: "1.0.0" cpe: "cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:*" purl: "pkg:maven/com.example/acme-library@1.0.0" - omnibor: [ + omniborId: [ "gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64", "gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" ] diff --git a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml index d97aed21f..9fc7b85cf 100644 --- a/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml +++ b/tools/src/test/resources/1.6/valid-component-identifiers-1.6.xml @@ -7,8 +7,8 @@ 1.0.0 cpe:2.3:a:example:acme-library:1.0.0:*:*:*:*:*:*:* pkg:maven/com.example/acme-library@1.0.0 - gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64 - gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 + gitoid:blob:sha1:261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64 + gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2