Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: v6.0.0 #492

Merged
merged 30 commits into from
Dec 10, 2023
Merged

feat!: v6.0.0 #492

merged 30 commits into from
Dec 10, 2023

Conversation

jkowalleck
Copy link
Member

@jkowalleck jkowalleck commented Nov 28, 2023

Breaking Changes

  • Removed symbols that were already marked as deprecated (via #493)
  • Removed symbols in parser.* (#489 via #495)
  • Removed output.LATEST_SUPPORTED_SCHEMA_VERSION (#491 via #494)
  • Serialization of unsupported enum values might downgrade/migrate/omit them (#490 via #496)
    Handling might raise warnings if a data loss occurred due to omitting.
    The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.
  • Serialization of any model.component.Component with unsupported type raises exception.serialization.SerializationOfUnsupportedComponentTypeException (#490 via #496)
  • Object model.bom_ref.BomRef's property value defaults to Null, was arbitrary UUID (#504 via #505)
    This change does not affect serialization. All bom-refs are guaranteed to have unique values on rendering.
  • Removed helpers from public API (#503 via #506)

Added

  • Basic support for CycloneDX 1.5 (#404 via #488)
    • No data models were enhanced nor added, yet.
      Pull requests to add functionality are welcome.
    • Existing enumerable got new cases, to reflect features of CycloneDX 1.5 (#404 via #488)
    • Outputters were enabled to render CycloneDX 1.5 (#404 via #488)

Tests

  • Created (regression/unit/integration/functional) tests for CycloneDX 1.5 (#404 via #488)
  • Created (regression/functional) tests for Enums' handling and completeness (#490 via #496)

Misc

  • Bumped dependency py-serializable@^0.16, was @^0.15 (via #496)

API Changes — the details for migration

  • Added new sub-package exception.serialization (via #496)
  • Removed class models.ComparableTuple (#503 via #506)
  • Enum model.ExternalReferenceType got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)
  • Removed function models.get_now_utc (#503 via #506)
  • Removed function models.sha1sum (#503 via #506)
  • Enum model.component.ComponentType got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)
  • Removed model.component.Component.__init__()'s deprecated optional kwarg namespace (via #493)
    Use kwarg group instead.
  • Removed model.component.Component.__init__()'s deprecated optional kwarg license_str (via #493)
    Use kwarg licenses instead.
  • Removed deprecated method model.component.Component.get_namespace() (via #493)
  • Removed class models.dependency.DependencyDependencies (#503 via #506)
  • Removed model.vulnerability.Vulnerability.__init__()'s deprecated optional kwarg source_name (via #493)
    Use kwarg source instead.
  • Removed model.vulnerability.Vulnerability.__init__()'s deprecated optional kwarg source_url (via #493)
    Use kwarg source instead.
  • Removed model.vulnerability.Vulnerability.__init__()'s deprecated optional kwarg recommendations (via #493)
    Use kwarg recommendation instead.
  • Removed model.vulnerability.VulnerabilityRating.__init__()'s deprecated optional kwarg score_base (via #493)
    Use kwarg score instead.
  • Enum model.vulnerability.VulnerabilityScoreSource got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)
  • Removed output.LATEST_SUPPORTED_SCHEMA_VERSION (#491 via #494)
  • Removed deprecated function output.get_instance() (via #493)
    Use function output.make_outputter() instead.
  • Added new class output.json.JsonV1Dot5, to reflect CycloneDX 1.5 (#404 via #488)
  • Added new item to dict output.json.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 (#404 via #488)
  • Added new class output.xml.XmlV1Dot5, to reflect CycloneDX 1.5 (#404 via #488)
  • Added new item to dict output.xml.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 (#404 via #488)
  • Removed class parser.ParserWarning (#489 via #495)
  • Removed class parser.BaseParser (#489 via #495)
  • Enum schema.SchemaVersion got new case V1_5, to reflect CycloneDX 1.5 (#404 via #488)

@jkowalleck jkowalleck added this to the 6.0.0 milestone Nov 28, 2023
@jkowalleck jkowalleck requested a review from a team as a code owner November 28, 2023 08:24
Churro and others added 2 commits November 28, 2023 09:25
This PR introduces basic support for CDX 1.5.

Ref:
- #404

**Schema:**

- Extended schema-downloader and added specification files,
- Adapted `README` and `SchemaVersion` for 1.5

**Model:**

- Added `SchemaVersion1Dot5`, serializable annotations,
- Extended `ComponentType` and `ExternalReferenceType` enums

**Tests:**

- Generated snapshots for 1.5.
- In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4

**Chore:**

-  Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support

----

* feat: add basic support for CDX 1.5

Signed-off-by: Johannes Feichtner <[email protected]>

* docs: note minversions of `HashAlgorithm` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: set ref after schema download

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: add the newly missing/TODO elements

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: note minversions of `ComponentType` cases

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* docs: update to latest CDX meta

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* feat: new enum cases fr VulnerabilityScoreSource

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: adjust xml child order for CDX1.5

Signed-off-by: Jan Kowalleck <[email protected]>

* tests: adjust to latest implementation

Signed-off-by: Jan Kowalleck <[email protected]>

* revert deletion by accident

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Johannes Feichtner <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Co-authored-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Copy link

codacy-production bot commented Nov 28, 2023

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation Diff coverage
+1.14% 95.36% (target: 80.00%)
Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (9ed9ab1) 3255 3039 93.36%
Head commit (3f84b44) 3418 (+163) 3230 (+191) 94.50% (+1.14%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#492) 517 493 95.36%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

You may notice some variations in coverage metrics with the latest Coverage engine update. For more details, visit the documentation

@jkowalleck jkowalleck added enhancement New feature or request QA Quality Assurance labels Nov 28, 2023
@jkowalleck jkowalleck self-assigned this Nov 28, 2023
* bc: remove deprecated functionality

Signed-off-by: Jan Kowalleck <[email protected]>

* tests: remove unused/outdated tests

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck linked an issue Nov 28, 2023 that may be closed by this pull request
@jkowalleck jkowalleck marked this pull request as draft November 28, 2023 09:33
@jkowalleck jkowalleck linked an issue Nov 28, 2023 that may be closed by this pull request
Signed-off-by: Jan Kowalleck <[email protected]>
- fixes #490
- BC: Component serialization may throw `cyclonedx.exception.serialization.SerializationOfUnsupportedComponentTypeException`
- feat: serialization have own exceptions of `cyclonedx.exception.serialization.*`
- tests: lots of (functional) tests related to enums and serialization
- misc: bump `py-serializable@^0.15` -> `@^0.16`


details & progress: 

- [x] `DataFlow`
- [x] `Encoding`
- [x] `HashAlgorithm` 
- [x] `ExternalReferenceType`
       convert "unknown" to `other`
- [x] `component.ComponentScope`
- [x] `component.ComponentType`.   > tests done, migrator open  
       Unclear how to proceed. dropping the info is a bad idea here.   
       Best would be to throw an exception and abort the rendering.
- [x] `component.PatchClassification`
- [x] `impact_analysis.ImpactAnalysisAffectedStatus`
- [x] `impact_analysis.ImpactAnalysisJustification`
- [x] `impact_analysis.ImpactAnalysisResponse`
- [x] `impact_analysis.ImpactAnalysisState`
- [x] `issue.IssueClassification`
- [x] `vulnerability.VulnerabilityScoreSource` 
         convert "unknown" to `other`
- [x] `vulnerability.VulnerabilitySeverity`

---------

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck changed the title [WIP] feat!: v6.0.0 feat!: v6.0.0 Nov 30, 2023
@jkowalleck jkowalleck marked this pull request as ready for review November 30, 2023 11:42
jkowalleck and others added 2 commits November 30, 2023 12:56
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release

Signed-off-by: semantic-release <semantic-release>
@jkowalleck
Copy link
Member Author

@Churro a RC1 is available -- https://pypi.org/project/cyclonedx-python-lib/6.0.0rc1/

Signed-off-by: Jan Kowalleck <[email protected]>
---------

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck linked an issue Dec 4, 2023 that may be closed by this pull request
fixes #503

removes the following symbols from public API:
- `models.ComparableTuple`
- `model.sha1sum`
- `model.get_now_utc`
- `model.dependency.DependencyDependencies`

---------

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck linked an issue Dec 5, 2023 that may be closed by this pull request
jkowalleck and others added 15 commits December 5, 2023 10:11
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
* refactor: remove uspecific type-ignores

Signed-off-by: Jan Kowalleck <[email protected]>

* refactor: revisi all type ignores

Signed-off-by: Jan Kowalleck <[email protected]>

---------

Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release

Signed-off-by: semantic-release <semantic-release>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release

Signed-off-by: semantic-release <semantic-release>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck merged commit 74865f8 into main Dec 10, 2023
44 checks passed
@jkowalleck jkowalleck deleted the 6.0.0-dev branch December 10, 2023 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking change enhancement New feature or request QA Quality Assurance
Projects
None yet
2 participants