You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by sb...@apache.org on 2025/08/27 13:19:35 UTC
(tooling-trusted-release) branch main updated: Fix a CycloneDX JSON models issue, and add a script to validate files
This is an automated email from the ASF dual-hosted git repository.
sbp pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-release.git
The following commit(s) were added to refs/heads/main by this push:
new f7bbbc7 Fix a CycloneDX JSON models issue, and add a script to validate files
f7bbbc7 is described below
commit f7bbbc771cb27aeef244d9872446c82b669a77b8
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Wed Aug 27 14:19:03 2025 +0100
Fix a CycloneDX JSON models issue, and add a script to validate files
---
atr/models/cyclonedx/__init__.py | 24 +++++++++---------
scripts/cyclonedx_parse.py | 53 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 65 insertions(+), 12 deletions(-)
diff --git a/atr/models/cyclonedx/__init__.py b/atr/models/cyclonedx/__init__.py
index 03a4aa7..4231d6b 100644
--- a/atr/models/cyclonedx/__init__.py
+++ b/atr/models/cyclonedx/__init__.py
@@ -470,7 +470,7 @@ class Dependency(BaseModel):
),
]
dependsOn: Annotated[
- set[RefLinkType] | None,
+ list[RefLinkType] | None,
Field(
description=(
"The bom-ref identifiers of the components or services that are dependencies of this dependency object."
@@ -479,7 +479,7 @@ class Dependency(BaseModel):
),
] = None
provides: Annotated[
- set[RefLinkType] | None,
+ list[RefLinkType] | None,
Field(
description=(
"The bom-ref identifiers of the components or services that define a given specification or standard,"
@@ -5311,7 +5311,7 @@ class Compositions(BaseModel):
),
]
assemblies: Annotated[
- set[RefLinkType | BomLinkElementType] | None,
+ list[RefLinkType | BomLinkElementType] | None,
Field(
description=(
"The bom-ref identifiers of the components or services being described. Assemblies refer to nested"
@@ -5322,7 +5322,7 @@ class Compositions(BaseModel):
),
] = None
dependencies: Annotated[
- set[StrictStr] | None,
+ list[StrictStr] | None,
Field(
description=(
"The bom-ref identifiers of the components or services being described. Dependencies refer to a"
@@ -5992,14 +5992,14 @@ class CyclonedxBillOfMaterialsStandard(BaseModel):
),
] = None
components: Annotated[
- set[Component] | None,
+ list[Component] | None,
Field(
description="A list of software and hardware components.",
title="Components",
),
] = None
services: Annotated[
- set[Service] | None,
+ list[Service] | None,
Field(
description=(
"A list of services. This may include microservices, function-as-a-service, and other types of network"
@@ -6020,7 +6020,7 @@ class CyclonedxBillOfMaterialsStandard(BaseModel):
),
] = None
dependencies: Annotated[
- set[Dependency] | None,
+ list[Dependency] | None,
Field(
description=(
"Provides the ability to document dependency relationships including provided & implemented components."
@@ -6029,7 +6029,7 @@ class CyclonedxBillOfMaterialsStandard(BaseModel):
),
] = None
compositions: Annotated[
- set[Compositions] | None,
+ list[Compositions] | None,
Field(
description=(
"Compositions describe constituent parts (including components, services, and dependency relationships)"
@@ -6039,14 +6039,14 @@ class CyclonedxBillOfMaterialsStandard(BaseModel):
),
] = None
vulnerabilities: Annotated[
- set[Vulnerability] | None,
+ list[Vulnerability] | None,
Field(
description="Vulnerabilities identified in components or services.",
title="Vulnerabilities",
),
] = None
annotations: Annotated[
- set[Annotations] | None,
+ list[Annotations] | None,
Field(
description=(
"Comments made by people, organizations, or tools about any object with a bom-ref, such as components,"
@@ -6116,14 +6116,14 @@ class Tools(BaseModel):
extra="forbid",
)
components: Annotated[
- set[Component] | None,
+ list[Component] | None,
Field(
description="A list of software and hardware components used as tools.",
title="Components",
),
] = None
services: Annotated[
- set[Service] | None,
+ list[Service] | None,
Field(
description=(
"A list of services used as tools. This may include microservices, function-as-a-service, and other"
diff --git a/scripts/cyclonedx_parse.py b/scripts/cyclonedx_parse.py
new file mode 100755
index 0000000..c5fce08
--- /dev/null
+++ b/scripts/cyclonedx_parse.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from __future__ import annotations
+
+import importlib.util
+import pathlib
+import sys
+
+import pydantic
+
+if not importlib.util.find_spec("atr"):
+ sys.path.append(".")
+
+import atr.models.cyclonedx as cyclonedx
+
+
+def main(argv: list[str]) -> None:
+ if len(argv) != 2:
+ sys.stderr.write(
+ "usage: uv run scripts/cyclonedx_parse.py <sbom.cdx.json>\n",
+ )
+ sys.exit(2)
+
+ path = pathlib.Path(argv[1])
+ try:
+ data = path.read_text(encoding="utf-8")
+ _ = cyclonedx.CyclonedxBillOfMaterialsStandard.model_validate_json(data)
+ except (OSError, pydantic.ValidationError, ValueError) as exc:
+ sys.stderr.write(f"error: {exc}\n")
+ sys.exit(1)
+
+ print("ok")
+
+
+if __name__ == "__main__":
+ main(sys.argv)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org