Ensure that all cyclonedx components have bom-refs

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
anchore · Mar 23, 2022 · 8ec2e3f · 8ec2e3f
1 parent c0b547b
commit 8ec2e3f
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 12 deletions.
diff --git a/internal/formats/common/cyclonedxhelpers/component.go b/internal/formats/common/cyclonedxhelpers/component.go
@@ -25,6 +25,11 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		properties = &props
 	}
 
+	bomRef := p.PURL
+	if bomRef == "" {
+		p.SetID()
+		bomRef = string(p.ID())
+	}
 	return cyclonedx.Component{
 		Type:               cyclonedx.ComponentTypeLibrary,
 		Name:               p.Name,
@@ -38,6 +43,7 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		Description:        encodeDescription(p),
 		ExternalReferences: encodeExternalReferences(p),
 		Properties:         properties,
+		BOMRef:             bomRef,
 	}
 }
 

diff --git a/internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden b/internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden
@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:498e659b-0758-4a7f-816e-91bee18df634",
+  "serialNumber": "urn:uuid:10cb848d-d2c2-481a-85b1-02e6cd2be1e4",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-03-08T12:30:39Z",
+    "timestamp": "2022-03-24T00:34:22+05:30",
     "tools": [
       {
         "vendor": "anchore",
@@ -20,6 +20,7 @@
   },
   "components": [
     {
+      "bom-ref": "a-purl-2",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -56,6 +57,7 @@
       ]
     },
     {
+      "bom-ref": "a-purl-2",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

diff --git a/internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden b/internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden
@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:342c3d2c-d26e-47b6-94d6-92fbf41da945",
+  "serialNumber": "urn:uuid:0690a9b7-a942-4448-a54c-f9dbab774488",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-03-08T12:30:39Z",
+    "timestamp": "2022-03-24T00:34:22+05:30",
     "tools": [
       {
         "vendor": "anchore",
@@ -21,6 +21,7 @@
   },
   "components": [
     {
+      "bom-ref": "a-purl-1",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -61,6 +62,7 @@
       ]
     },
     {
+      "bom-ref": "a-purl-2",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

diff --git a/internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden b/internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:892f8304-0142-45b1-b411-cade3c53057f" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:07938998-6a6a-4183-be92-282c39928722" version="1">
   <metadata>
-    <timestamp>2022-03-08T12:30:33Z</timestamp>
+    <timestamp>2022-03-24T00:34:41+05:30</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -14,7 +14,7 @@
     </component>
   </metadata>
   <components>
-    <component type="library">
+    <component bom-ref="a-purl-2" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -32,7 +32,7 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component type="library">
+    <component bom-ref="a-purl-2" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>

diff --git a/internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden b/internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:5fa94827-eb85-4f32-a62d-76fb6e89a2dd" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:86339a8e-5f3b-480b-94c7-346e1c7fcf62" version="1">
   <metadata>
-    <timestamp>2022-03-08T12:30:33Z</timestamp>
+    <timestamp>2022-03-24T00:34:41+05:30</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -15,7 +15,7 @@
     </component>
   </metadata>
   <components>
-    <component type="library">
+    <component bom-ref="a-purl-1" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -34,7 +34,7 @@
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component type="library">
+    <component bom-ref="a-purl-2" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>