Skip to content

Commit d26755d

Browse files
dgldgl
committed
Fully roundtrip the purl field
1 parent 8f5588f commit d26755d

13 files changed

+62
-11
lines changed

‎src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/Component/ExternalRefs.cs‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,12 +142,15 @@ public static void AddSpdxExternalRefs(this Component component, List<ExternalRe
142142
{
143143
refPropValue = $"{extRef.ReferenceLocator} {extRef.Comment}";
144144
}
145-
component.Properties.AddSpdxElement(refPropName, refPropValue);
146145

147-
if (refPropName == PropertyTaxonomy.EXTERNAL_REFERENCE_PACKAGE_MANAGER_PURL)
146+
if (refPropName == PropertyTaxonomy.EXTERNAL_REFERENCE_PACKAGE_MANAGER_PURL && component.Purl == null)
148147
{
148+
// For the first seen purl, assume it is the component's purl.
149149
component.Purl = refPropValue;
150+
continue;
150151
}
152+
153+
component.Properties.AddSpdxElement(refPropName, refPropValue);
151154
}
152155
}
153156
}

‎src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/SpdxDocumentHelpers.cs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,23 @@ public static void AddCycloneDXComponents(this SpdxDocument doc, Bom bom)
200200
package.Checksums = component.GetSpdxChecksums();
201201
package.ExternalRefs = component.GetSpdxExternalRefs();
202202

203+
if (component.Purl != null)
204+
{
205+
if (package.ExternalRefs == null)
206+
{
207+
package.ExternalRefs = new List<ExternalRef>();
208+
}
209+
210+
// Insert at the start, so that this correctly roundtrips, i.e. if there are
211+
// multiple PURLs, always pick the first as the component's PURL.
212+
package.ExternalRefs.Insert(0, new ExternalRef
213+
{
214+
ReferenceCategory = ExternalRefCategory.PACKAGE_MANAGER,
215+
ReferenceType = "purl",
216+
ReferenceLocator = component.Purl,
217+
});
218+
}
219+
203220
package.DownloadLocation = component.Properties?.GetSpdxElement(PropertyTaxonomy.DOWNLOAD_LOCATION) ?? "NOASSERTION";
204221
package.Homepage = component.Properties?.GetSpdxElement(PropertyTaxonomy.HOMEPAGE);
205222

‎tests/CycloneDX.Spdx.Interop.Tests/Resources/Spdx/v2.3/document.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,6 @@
186186
"licenseDeclared": "NOASSERTION",
187187
"name": "Jena",
188188
"primaryPackagePurpose": "APPLICATION",
189-
"purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",
190189
"versionInfo": "3.12.0"
191190
},
192191
{

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxTest_bom.snap‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@
3434
}
3535
],
3636
"downloadLocation": "NOASSERTION",
37+
"externalRefs": [
38+
{
39+
"referenceCategory": "PACKAGE_MANAGER",
40+
"referenceLocator": "pkg:npm/acme/component@1.0.0",
41+
"referenceType": "purl"
42+
}
43+
],
3744
"licenseDeclared": "Apache-2.0",
3845
"name": "tomcat-catalina",
3946
"primaryPackagePurpose": "LIBRARY",

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxTest_compositions.snap‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,27 @@
1212
{
1313
"SPDXID": "SPDXRef-pkg:maven/partner/shaded-library@1.0",
1414
"downloadLocation": "NOASSERTION",
15+
"externalRefs": [
16+
{
17+
"referenceCategory": "PACKAGE_MANAGER",
18+
"referenceLocator": "pkg:maven/partner/shaded-library@1.0",
19+
"referenceType": "purl"
20+
}
21+
],
1522
"name": "Partner Shaded Library",
1623
"primaryPackagePurpose": "LIBRARY",
1724
"versionInfo": "1.0"
1825
},
1926
{
2027
"SPDXID": "SPDXRef-Package-2",
2128
"downloadLocation": "NOASSERTION",
29+
"externalRefs": [
30+
{
31+
"referenceCategory": "PACKAGE_MANAGER",
32+
"referenceLocator": "pkg:maven/acme/library@3.0",
33+
"referenceType": "purl"
34+
}
35+
],
2236
"name": "Acme Library",
2337
"primaryPackagePurpose": "LIBRARY",
2438
"versionInfo": "3.0"

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxTest_evidence.snap‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@
1818
"Copyright (C) 2004,2005 University of Maryland"
1919
],
2020
"downloadLocation": "NOASSERTION",
21+
"externalRefs": [
22+
{
23+
"referenceCategory": "PACKAGE_MANAGER",
24+
"referenceLocator": "pkg:maven/com.google.code.findbugs/findbugs-project@3.0.0",
25+
"referenceType": "purl"
26+
}
27+
],
2128
"licenseDeclared": "LGPL-3.0-or-later",
2229
"licenseInfoFromFiles": [
2330
"Apache-2.0",

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxTest_service.snap‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@
1818
}
1919
],
2020
"downloadLocation": "NOASSERTION",
21+
"externalRefs": [
22+
{
23+
"referenceCategory": "PACKAGE_MANAGER",
24+
"referenceLocator": "pkg:maven/com.acme/stock-java-client@1.0.12",
25+
"referenceType": "purl"
26+
}
27+
],
2128
"licenseDeclared": "Apache-2.0",
2229
"name": "stock-java-client",
2330
"primaryPackagePurpose": "LIBRARY",

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_bom.snap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@
6666
"expression": "Apache-2.0"
6767
}
6868
],
69+
"purl": "pkg:npm/acme/component@1.0.0",
6970
"externalReferences": [
7071
{
7172
"url": "NOASSERTION",

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_compositions.snap‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"licenses": [
3535
{}
3636
],
37+
"purl": "pkg:maven/partner/shaded-library@1.0",
3738
"externalReferences": [
3839
{
3940
"url": "NOASSERTION",
@@ -58,6 +59,7 @@
5859
"licenses": [
5960
{}
6061
],
62+
"purl": "pkg:maven/acme/library@3.0",
6163
"externalReferences": [
6264
{
6365
"url": "NOASSERTION",

‎tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_evidence.snap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
"expression": "LGPL-3.0-or-later"
3737
}
3838
],
39+
"purl": "pkg:maven/com.google.code.findbugs/findbugs-project@3.0.0",
3940
"externalReferences": [
4041
{
4142
"url": "NOASSERTION",

0 commit comments

Comments
 (0)