-
-
Notifications
You must be signed in to change notification settings - Fork 45
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat!: v6.0.0 #492
feat!: v6.0.0 #492
Conversation
This PR introduces basic support for CDX 1.5. Ref: - #404 **Schema:** - Extended schema-downloader and added specification files, - Adapted `README` and `SchemaVersion` for 1.5 **Model:** - Added `SchemaVersion1Dot5`, serializable annotations, - Extended `ComponentType` and `ExternalReferenceType` enums **Tests:** - Generated snapshots for 1.5. - In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4 **Chore:** - Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support ---- * feat: add basic support for CDX 1.5 Signed-off-by: Johannes Feichtner <[email protected]> * docs: note minversions of `HashAlgorithm` cases Signed-off-by: Jan Kowalleck <[email protected]> * docs: set ref after schema download Signed-off-by: Jan Kowalleck <[email protected]> * refactor: add the newly missing/TODO elements Signed-off-by: Jan Kowalleck <[email protected]> * docs: note minversions of `ComponentType` cases Signed-off-by: Jan Kowalleck <[email protected]> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <[email protected]> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <[email protected]> * docs: update to latest CDX meta Signed-off-by: Jan Kowalleck <[email protected]> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <[email protected]> * feat: new enum cases fr VulnerabilityScoreSource Signed-off-by: Jan Kowalleck <[email protected]> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <[email protected]> * tests: adjust to latest implementation Signed-off-by: Jan Kowalleck <[email protected]> * revert deletion by accident Signed-off-by: Jan Kowalleck <[email protected]> --------- Signed-off-by: Johannes Feichtner <[email protected]> Signed-off-by: Jan Kowalleck <[email protected]> Co-authored-by: Jan Kowalleck <[email protected]> Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
827d4ce
to
cb0d5b6
Compare
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesYou may notice some variations in coverage metrics with the latest Coverage engine update. For more details, visit the documentation |
* bc: remove deprecated functionality Signed-off-by: Jan Kowalleck <[email protected]> * tests: remove unused/outdated tests Signed-off-by: Jan Kowalleck <[email protected]> --------- Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
- fixes #490 - BC: Component serialization may throw `cyclonedx.exception.serialization.SerializationOfUnsupportedComponentTypeException` - feat: serialization have own exceptions of `cyclonedx.exception.serialization.*` - tests: lots of (functional) tests related to enums and serialization - misc: bump `py-serializable@^0.15` -> `@^0.16` details & progress: - [x] `DataFlow` - [x] `Encoding` - [x] `HashAlgorithm` - [x] `ExternalReferenceType` convert "unknown" to `other` - [x] `component.ComponentScope` - [x] `component.ComponentType`. > tests done, migrator open Unclear how to proceed. dropping the info is a bad idea here. Best would be to throw an exception and abort the rendering. - [x] `component.PatchClassification` - [x] `impact_analysis.ImpactAnalysisAffectedStatus` - [x] `impact_analysis.ImpactAnalysisJustification` - [x] `impact_analysis.ImpactAnalysisResponse` - [x] `impact_analysis.ImpactAnalysisState` - [x] `issue.IssueClassification` - [x] `vulnerability.VulnerabilityScoreSource` convert "unknown" to `other` - [x] `vulnerability.VulnerabilitySeverity` --------- Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release Signed-off-by: semantic-release <semantic-release>
@Churro a RC1 is available -- https://pypi.org/project/cyclonedx-python-lib/6.0.0rc1/ |
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
--------- Signed-off-by: Jan Kowalleck <[email protected]>
fixes #503 removes the following symbols from public API: - `models.ComparableTuple` - `model.sha1sum` - `model.get_now_utc` - `model.dependency.DependencyDependencies` --------- Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
* refactor: remove uspecific type-ignores Signed-off-by: Jan Kowalleck <[email protected]> * refactor: revisi all type ignores Signed-off-by: Jan Kowalleck <[email protected]> --------- Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release Signed-off-by: semantic-release <semantic-release>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Automatically generated by python-semantic-release Signed-off-by: semantic-release <semantic-release>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Breaking Changes
parser.*
(#489 via #495)output.LATEST_SUPPORTED_SCHEMA_VERSION
(#491 via #494)Handling might raise warnings if a data loss occurred due to omitting.
The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered.
model.component.Component
with unsupportedtype
raisesexception.serialization.SerializationOfUnsupportedComponentTypeException
(#490 via #496)model.bom_ref.BomRef
's propertyvalue
defaults toNull
, was arbitraryUUID
(#504 via #505)This change does not affect serialization. All
bom-ref
s are guaranteed to have unique values on rendering.Added
Pull requests to add functionality are welcome.
Tests
Misc
py-serializable@^0.16
, was@^0.15
(via #496)API Changes — the details for migration
exception.serialization
(via #496)models.ComparableTuple
(#503 via #506)model.ExternalReferenceType
got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)models.get_now_utc
(#503 via #506)models.sha1sum
(#503 via #506)model.component.ComponentType
got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)model.component.Component.__init__()
's deprecated optional kwargnamespace
(via #493)Use kwarg
group
instead.model.component.Component.__init__()
's deprecated optional kwarglicense_str
(via #493)Use kwarg
licenses
instead.model.component.Component.get_namespace()
(via #493)models.dependency.DependencyDependencies
(#503 via #506)model.vulnerability.Vulnerability.__init__()
's deprecated optional kwargsource_name
(via #493)Use kwarg
source
instead.model.vulnerability.Vulnerability.__init__()
's deprecated optional kwargsource_url
(via #493)Use kwarg
source
instead.model.vulnerability.Vulnerability.__init__()
's deprecated optional kwargrecommendations
(via #493)Use kwarg
recommendation
instead.model.vulnerability.VulnerabilityRating.__init__()
's deprecated optional kwargscore_base
(via #493)Use kwarg
score
instead.model.vulnerability.VulnerabilityScoreSource
got new cases, to reflect features for CycloneDX 1.5 (#404 via #488)output.LATEST_SUPPORTED_SCHEMA_VERSION
(#491 via #494)output.get_instance()
(via #493)Use function
output.make_outputter()
instead.output.json.JsonV1Dot5
, to reflect CycloneDX 1.5 (#404 via #488)output.json.BY_SCHEMA_VERSION
, to reflect CycloneDX 1.5 (#404 via #488)output.xml.XmlV1Dot5
, to reflect CycloneDX 1.5 (#404 via #488)output.xml.BY_SCHEMA_VERSION
, to reflect CycloneDX 1.5 (#404 via #488)parser.ParserWarning
(#489 via #495)parser.BaseParser
(#489 via #495)schema.SchemaVersion
got new caseV1_5
, to reflect CycloneDX 1.5 (#404 via #488)