Skip to content

Commit 56e936e

Browse files
stevespringettstevespringett
authored
rework dependency type to provides (#366)
changes as discussed here: #347 (comment)
2 parents 29fc0a6 + d8ae85e commit 56e936e

File tree

6 files changed

+57
-62
lines changed

6 files changed

+57
-62
lines changed

‎schema/bom-1.6.proto‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -171,16 +171,12 @@ enum DataFlowDirection {
171171
}
172172

173173
message Dependency {
174-
enum DependencyType {
175-
DEPENDENCY_TYPE_IMPLEMENTS = 0;
176-
DEPENDENCY_TYPE_USES = 1;
177-
}
178174
// References a component or service by the its bom-ref attribute
179175
string ref = 1;
180176
// The bom-ref identifiers of the components or services that are dependencies of this dependency object.
181177
repeated Dependency dependencies = 2;
182-
// Defines and characterizes the type of dependency
183-
optional DependencyType type = 3;
178+
// The bom-ref identifiers of the components or services that define a given specification or standard, which are provided or implemented by this dependency object.
179+
repeated string provides = 3;
184180
}
185181

186182
message Diff {

‎schema/bom-1.6.schema.json‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1766,11 +1766,14 @@
17661766
"title": "Depends On",
17671767
"description": "The bom-ref identifiers of the components or services that are dependencies of this dependency object."
17681768
},
1769-
"type": {
1770-
"type": "string",
1771-
"title": "Dependency Type",
1772-
"description": "Defines and characterizes the type of dependency",
1773-
"$ref": "#/definitions/dependencyType"
1769+
"provides": {
1770+
"type": "array",
1771+
"uniqueItems": true,
1772+
"items": {
1773+
"$ref": "#/definitions/refLinkType"
1774+
},
1775+
"title": "Provides",
1776+
"description": "The bom-ref identifiers of the components or services that define a given specification or standard, which are provided or implemented by this dependency object.\nFor example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use."
17741777
}
17751778
}
17761779
},
@@ -4601,20 +4604,6 @@
46014604
"title": "Signature",
46024605
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
46034606
},
4604-
"dependencyType": {
4605-
"type": "string",
4606-
"title": "Dependency Type",
4607-
"enum": [
4608-
"implements",
4609-
"uses"
4610-
],
4611-
"meta:enum": {
4612-
"implements": "Refers to a component or service that fulfills the requirements of a given specification or standard. For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use.",
4613-
"uses": "Refers to a component or service that relies on another component or service, either explicitly via function calls or via configuration at run time."
4614-
},
4615-
"default": "uses",
4616-
"description": "An optional field that describes the type of dependency."
4617-
},
46184607
"cryptoProperties": {
46194608
"type": "object",
46204609
"title": "Cryptographic Properties",

‎schema/bom-1.6.xsd‎

Lines changed: 20 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1851,18 +1851,32 @@ limitations under the License.
18511851

18521852
<xs:complexType name="dependencyType">
18531853
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1854-
<xs:element name="dependency" type="bom:dependencyType"/>
1854+
<xs:element name="dependency" type="bom:dependencyType" minOccurs="0">
1855+
<xs:annotation>
1856+
<xs:documentation>The component or service that is a dependency of this dependency object.</xs:documentation>
1857+
</xs:annotation>
1858+
</xs:element>
1859+
<xs:element name="provides" minOccurs="0">
1860+
<xs:annotation>
1861+
<xs:documentation>
1862+
The component or service that define a given specification or standard, which is provided or implemented by this dependency object.
1863+
For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use.
1864+
</xs:documentation>
1865+
</xs:annotation>
1866+
<xs:complexType>
1867+
<xs:attribute name="ref" type="bom:refLinkType" use="required">
1868+
<xs:annotation>
1869+
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
1870+
</xs:annotation>
1871+
</xs:attribute>
1872+
</xs:complexType>
1873+
</xs:element>
18551874
</xs:sequence>
18561875
<xs:attribute name="ref" type="bom:refLinkType" use="required">
18571876
<xs:annotation>
18581877
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
18591878
</xs:annotation>
18601879
</xs:attribute>
1861-
<xs:attribute name="type" type="bom:dependencyUsageType" default="uses" use="optional">
1862-
<xs:annotation>
1863-
<xs:documentation>An optional field that describes the type of dependency.</xs:documentation>
1864-
</xs:annotation>
1865-
</xs:attribute>
18661880
<xs:anyAttribute namespace="##other" processContents="lax">
18671881
<xs:annotation>
18681882
<xs:documentation>User-defined attributes may be used on this element as long as they
@@ -1871,28 +1885,6 @@ limitations under the License.
18711885
</xs:anyAttribute>
18721886
</xs:complexType>
18731887

1874-
<xs:simpleType name="dependencyUsageType">
1875-
<xs:restriction base="xs:string">
1876-
<xs:enumeration value="implements">
1877-
<xs:annotation>
1878-
<xs:documentation>
1879-
Refers to a component or service that fulfills the requirements of a given specification or
1880-
standard. For example, a cryptographic library which implements a cryptographic algorithm.
1881-
A component which implements another component does not imply that the implementation is in use.
1882-
</xs:documentation>
1883-
</xs:annotation>
1884-
</xs:enumeration>
1885-
<xs:enumeration value="uses">
1886-
<xs:annotation>
1887-
<xs:documentation>
1888-
Refers to a component or service that relies on another component or service, either explicitly
1889-
via function calls or via configuration at run time.
1890-
</xs:documentation>
1891-
</xs:annotation>
1892-
</xs:enumeration>
1893-
</xs:restriction>
1894-
</xs:simpleType>
1895-
18961888
<xs:complexType name="dependenciesType">
18971889
<xs:sequence minOccurs="0" maxOccurs="unbounded">
18981890
<xs:element name="dependency" type="bom:dependencyType">

‎tools/src/test/resources/1.6/valid-cryptography-1.6.json‎ renamed to ‎tools/src/test/resources/1.6/valid-cryptography-implementation-1.6.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,18 +37,23 @@
3737
"bom-ref": "crypto-library",
3838
"name": "Crypto library",
3939
"version": "1.0.0"
40+
},
41+
{
42+
"type": "library",
43+
"bom-ref": "some-library",
44+
"name": "Some library",
45+
"version": "1.0.0"
4046
}
4147
],
4248
"dependencies": [
4349
{
4450
"ref": "acme-application",
45-
"type": "uses",
4651
"dependsOn": ["crypto-library"]
4752
},
4853
{
4954
"ref": "crypto-library",
50-
"type": "implements",
51-
"dependsOn": ["aes128gcm"]
55+
"provides": ["aes128gcm"],
56+
"dependsOn": ["some-library"]
5257
}
5358
]
5459
}

‎tools/src/test/resources/1.6/valid-cryptography-1.6.textproto‎ renamed to ‎tools/src/test/resources/1.6/valid-cryptography-implementation-1.6.textproto‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# proto-file: schema/bom-1.6.proto
2+
# proto-message:
3+
14
spec_version: "1.6"
25
version: 1
36
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
@@ -40,21 +43,26 @@ components: [
4043
bom_ref: "crypto-library"
4144
name: "Crypto library"
4245
version: "1.0.0"
46+
},
47+
{
48+
type: CLASSIFICATION_LIBRARY
49+
bom_ref: "some-library"
50+
name: "Some library"
51+
version: "1.0.0"
4352
}
4453
],
4554
dependencies: [
4655
{
4756
ref: "acme-application"
48-
type: DEPENDENCY_TYPE_USES
4957
dependencies {
5058
ref: "crypto-library"
5159
}
5260
},
5361
{
5462
ref: "crypto-library"
55-
type: DEPENDENCY_TYPE_IMPLEMENTS
63+
provides: [ "aes128gcm" ]
5664
dependencies {
57-
ref: "aes128gcm"
65+
ref: "some-library"
5866
}
5967
}
6068
]

‎tools/src/test/resources/1.6/valid-cryptography-1.6.xml‎ renamed to ‎tools/src/test/resources/1.6/valid-cryptography-implementation-1.6.xml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,18 @@
3434
<name>Crypto Library</name>
3535
<version>1.0.0</version>
3636
</component>
37+
<component type="library" bom-ref="some-library">
38+
<name>Some Library</name>
39+
<version>1.0.0</version>
40+
</component>
3741
</components>
3842
<dependencies>
39-
<dependency ref="acme-application" type="uses">
43+
<dependency ref="acme-application">
4044
<dependency ref="crypto-library"/>
4145
</dependency>
42-
<dependency ref="crypto-library" type="implements">
43-
<dependency ref="aes128gcm"/>
46+
<dependency ref="crypto-library">
47+
<provides ref="aes128gcm"/>
48+
<dependency ref="some-library"/>
4449
</dependency>
4550
</dependencies>
4651
</bom>

0 commit comments

Comments
 (0)