diff --git a/cyclonedx-lib/build.xml b/cyclonedx-lib/build.xml
index 53a2cde4f..40a95a94f 100644
--- a/cyclonedx-lib/build.xml
+++ b/cyclonedx-lib/build.xml
@@ -204,7 +204,7 @@
-
+
@@ -224,7 +224,7 @@
-
+
@@ -251,8 +251,7 @@
-
-
+
@@ -263,7 +262,7 @@
-
+
@@ -275,7 +274,7 @@
-
+
@@ -283,7 +282,7 @@
-
+
@@ -295,7 +294,7 @@
-
+
@@ -307,7 +306,7 @@
-
+
@@ -319,7 +318,7 @@
-
+
@@ -331,7 +330,7 @@
-
+
@@ -339,7 +338,7 @@
-
+
@@ -351,7 +350,7 @@
-
+
@@ -363,7 +362,7 @@
-
+
@@ -373,7 +372,7 @@
-
+
@@ -385,7 +384,7 @@
-
+
@@ -397,7 +396,7 @@
-
+
@@ -407,7 +406,7 @@
-
+
@@ -419,7 +418,7 @@
-
+
@@ -427,7 +426,7 @@
-
+
@@ -439,7 +438,7 @@
-
+
@@ -451,7 +450,7 @@
-
+
@@ -461,7 +460,7 @@
-
+
@@ -473,7 +472,7 @@
-
+
@@ -481,7 +480,7 @@
-
+
@@ -493,39 +492,35 @@
-
+
-
-
-
-
-
-
-
+
+
+
-
+
-
+
-
-
-
-
-
-
-
+
+
+
+
+
-
+
-
+
-
-
-
+
+
+
+
+
-
+
@@ -533,7 +528,7 @@
-
+
@@ -543,7 +538,7 @@
-
+
@@ -559,7 +554,7 @@
-
+
@@ -567,7 +562,7 @@
-
+
@@ -579,7 +574,7 @@
-
+
@@ -591,7 +586,7 @@
-
+
@@ -603,7 +598,7 @@
-
+
@@ -615,7 +610,7 @@
-
+
@@ -623,7 +618,7 @@
-
+
@@ -635,7 +630,7 @@
-
+
@@ -647,7 +642,7 @@
-
+
@@ -657,7 +652,7 @@
-
+
@@ -669,7 +664,7 @@
-
+
@@ -681,7 +676,7 @@
-
+
@@ -691,7 +686,7 @@
-
+
@@ -703,7 +698,7 @@
-
+
@@ -711,7 +706,7 @@
-
+
@@ -723,7 +718,7 @@
-
+
@@ -735,7 +730,7 @@
-
+
@@ -745,7 +740,7 @@
-
+
@@ -757,7 +752,7 @@
-
+
@@ -765,7 +760,7 @@
-
+
@@ -777,39 +772,41 @@
-
+
-
-
-
-
-
-
-
+
+
+
-
+
-
+
+
+
-
-
-
-
-
-
-
+
+
+
+
+
-
+
-
-
-
-
-
-
+
+
+
+
@@ -817,7 +814,7 @@
-
+
@@ -827,7 +824,7 @@
-
+
diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java
index a1f02c0f1..95a915235 100644
--- a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java
+++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java
@@ -102,7 +102,8 @@ public static void main(final String[] args) {
}
}
- switch (cmd) {
+ try {
+ switch (cmd) {
case "createCDXA": // Create a new CDXA json file
Bom bom = createCdxa(fileName, attestingOrgName, predicate, targetName, targetUrl, targetHash, affirmationStmt, affirmationWebsite, thirdParty);
if (bom != null) {
@@ -113,8 +114,20 @@ public static void main(final String[] args) {
break;
default:
- System.out.println("Please enter a command.");
+ // Echo input command:
+ for (int i = 0; i < args.length; i++) {
+ System.out.print(args[i] + " ");
+ }
+ System.out.println("\nPlease enter a valid command.");
System.exit(1);
+ }
+ } catch (Exception e) {
+ // Echo input command:
+ for (int i = 0; i < args.length; i++) {
+ System.out.print(args[i] + " ");
+ }
+ System.out.println("\nException: " + e);
+ System.exit(1);
}
}
diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java
index 4533a9c37..d22ae7ba0 100644
--- a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java
+++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java
@@ -23,10 +23,10 @@
import org.cyclonedx.model.formulation.Formula;
import org.cyclonedx.model.Hash;
import org.cyclonedx.model.Metadata;
+import org.cyclonedx.model.metadata.ToolInformation;
import org.cyclonedx.model.OrganizationalContact;
import org.cyclonedx.model.OrganizationalEntity;
import org.cyclonedx.model.Property;
-import org.cyclonedx.model.Tool;
import org.cyclonedx.parsers.JsonParser;
import org.cyclonedx.parsers.XmlParser;
import org.cyclonedx.Version;
@@ -110,10 +110,6 @@ public static void main(final String[] args) {
cmd = "addComponentHash";
} else if (args[i].equals("--addComponentProp")) { // Components --> Property: will add name-value.
cmd = "addComponentProp";
- } else if (args[i].equals("--addExternalReference")) {
- cmd = "addExternalReference";
- } else if (args[i].equals("--addComponentExtRef")) {
- cmd = "addComponentExternalReference";
} else if (args[i].equals("--addMetadataTools")) {
cmd = "addMetadataTools";
} else if (args[i].equals("--addFormulation")) { // Formulation Component. We can set "name" for Formulation.
@@ -126,7 +122,8 @@ public static void main(final String[] args) {
verbose = true;
}
}
- switch (cmd) {
+ try {
+ switch (cmd) {
case "createNewSBOM": // Creates new SBOM
Bom bom = createBom();
writeFile(bom, fileName);
@@ -182,7 +179,20 @@ public static void main(final String[] args) {
break;
default:
- System.out.println("Please enter a command.");
+ // Echo input command:
+ for (int i = 0; i < args.length; i++) {
+ System.out.print(args[i] + " ");
+ }
+ System.out.println("\nPlease enter a valid command.");
+ System.exit(1);
+ }
+ } catch (Exception e) {
+ // Echo input command:
+ for (int i = 0; i < args.length; i++) {
+ System.out.print(args[i] + " ");
+ }
+ System.out.println("\nException: " + e);
+ System.exit(1);
}
}
@@ -196,10 +206,19 @@ static Bom createBom() {
return bom;
}
+ // Create Metadata if it doesn't exist
+ static Metadata getBomMetadata(final Bom bom) {
+ Metadata metadata = bom.getMetadata();
+ if (metadata == null) {
+ metadata = new Metadata();
+ }
+ return metadata;
+ }
+
// Method to store Metadata --> name.
static Bom addMetadata(final String fileName) {
Bom bom = readFile(fileName);
- Metadata meta = new Metadata();
+ Metadata meta = getBomMetadata(bom);
OrganizationalEntity org = new OrganizationalEntity();
org.setName("Eclipse Foundation");
org.setUrls(Collections.singletonList("https://www.eclipse.org/"));
@@ -213,7 +232,7 @@ static Bom addMetadata(final String fileName) {
static Bom addMetadataComponent(final String fileName, final String name, final String type, final String version, final String description) {
Bom bom = readFile(fileName);
- Metadata meta = new Metadata();
+ Metadata meta = getBomMetadata(bom);
Component comp = new Component();
Component.Type compType = Component.Type.FRAMEWORK;
switch (type) {
@@ -235,9 +254,8 @@ static Bom addMetadataComponent(final String fileName, final String name, final
// Method to store Metadata --> Properties List --> name-values.
static Bom addMetadataProperty(final String fileName, final String name, final String value) {
Bom bom = readFile(fileName);
- Metadata meta = new Metadata();
+ Metadata meta = getBomMetadata(bom);
Property prop1 = new Property();
- meta = bom.getMetadata();
prop1.setName(name);
prop1.setValue(value);
meta.addProperty(prop1);
@@ -247,12 +265,30 @@ static Bom addMetadataProperty(final String fileName, final String name, final S
static Bom addMetadataTools(final String fileName, final String toolName, final String version) {
Bom bom = readFile(fileName);
- Metadata meta = new Metadata();
- Tool tool = new Tool();
- meta = bom.getMetadata();
+ Metadata meta = getBomMetadata(bom);
+
+ // Create Tool Component
+ Component tool = new Component();
+ tool.setType(Component.Type.APPLICATION);
tool.setName(toolName);
tool.setVersion(version);
- meta.addTool(tool);
+
+ // Create ToolInformation if not already
+ ToolInformation tools = meta.getToolChoice();
+ if (tools == null) {
+ tools = new ToolInformation();
+ }
+
+ // Create new components array, add existing to it
+ List components = tools.getComponents();
+ if (components == null) {
+ components = new LinkedList();
+ }
+
+ components.add(tool);
+ tools.setComponents(components);
+ meta.setToolChoice(tools);
+
bom.setMetadata(meta);
return bom;
}
diff --git a/sbin/build.sh b/sbin/build.sh
index 8224bae55..edff7f64e 100755
--- a/sbin/build.sh
+++ b/sbin/build.sh
@@ -934,14 +934,15 @@ getCyclonedxClasspath() {
local CYCLONEDB_JAR_DIR="${CYCLONEDB_DIR}/build/jar"
- local classpath="${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar:${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar:${CYCLONEDB_JAR_DIR}/jackson-core.jar:${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar:${CYCLONEDB_JAR_DIR}/jackson-databind.jar:${CYCLONEDB_JAR_DIR}/jackson-annotations.jar:${CYCLONEDB_JAR_DIR}/json-schema-validator.jar:${CYCLONEDB_JAR_DIR}/commons-codec.jar:${CYCLONEDB_JAR_DIR}/commons-io.jar:${CYCLONEDB_JAR_DIR}/github-package-url.jar:${CYCLONEDB_JAR_DIR}/commons-collections4.jar"
+ local classpath="${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar:${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar:${CYCLONEDB_JAR_DIR}/jackson-core.jar:${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar:${CYCLONEDB_JAR_DIR}/jackson-databind.jar:${CYCLONEDB_JAR_DIR}/jackson-annotations.jar:${CYCLONEDB_JAR_DIR}/json-schema-validator.jar:${CYCLONEDB_JAR_DIR}/commons-codec.jar:${CYCLONEDB_JAR_DIR}/commons-io.jar:${CYCLONEDB_JAR_DIR}/github-package-url.jar:${CYCLONEDB_JAR_DIR}/commons-collections4.jar:${CYCLONEDB_JAR_DIR}/stax2-api.jar:${CYCLONEDB_JAR_DIR}/woodstox-core.jar:${CYCLONEDB_JAR_DIR}/commons-lang3.jar"
if [[ "$OSTYPE" == "cygwin" ]] || [[ "$OSTYPE" == "msys" ]]; then
classpath=""
for jarfile in "${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar" "${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar" \
"${CYCLONEDB_JAR_DIR}/jackson-core.jar" "${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar" \
"${CYCLONEDB_JAR_DIR}/jackson-databind.jar" "${CYCLONEDB_JAR_DIR}/jackson-annotations.jar" \
"${CYCLONEDB_JAR_DIR}/json-schema-validator.jar" "${CYCLONEDB_JAR_DIR}/commons-codec.jar" "${CYCLONEDB_JAR_DIR}/commons-io.jar" \
- "${CYCLONEDB_JAR_DIR}/github-package-url.jar" "${CYCLONEDB_JAR_DIR}/commons-collections4.jar";
+ "${CYCLONEDB_JAR_DIR}/github-package-url.jar" "${CYCLONEDB_JAR_DIR}/commons-collections4.jar" \
+ "${CYCLONEDB_JAR_DIR}/stax2-api.jar" "${CYCLONEDB_JAR_DIR}/woodstox-core.jar" "${CYCLONEDB_JAR_DIR}/commons-lang3.jar";
do
classpath+=$(cygpath -w "${jarfile}")";"
done
@@ -1261,7 +1262,7 @@ addCycloneDXVersions() {
JarVersionString=$(grep "${JarName}\.version=" "${JarDepsFile}" | cut -d'=' -f2)
if [ -n "${JarVersionString}" ]; then
addSBOMFormulationComponentProperty "${javaHome}" "${classpath}" "${sbomJson}" "CycloneDX" "CycloneDX jar versions" "${JarName}.jar" "${JarVersionString}"
- elif [ "${JarName}" != "temurin-gen-sbom" ]; then
+ elif [ "${JarName}" != "temurin-gen-sbom" ] && [ "${JarName}" != "temurin-gen-cdxa" ]; then
echo "ERROR: Cannot determine jar version from ${JarDepsFile} for SBOM creation dependency ${JarName}.jar."
fi
done
diff --git a/tooling/validateSBOMcontent.sh b/tooling/validateSBOMcontent.sh
index 56e98c6f6..4aff3daa8 100755
--- a/tooling/validateSBOMcontent.sh
+++ b/tooling/validateSBOMcontent.sh
@@ -22,11 +22,11 @@ SBOMFILE="$1"
MAJORVERSION="$2"
#FULLVERSION="$3"
-GLIBC=$(jq '.metadata.tools[] | select(.name|test("GLIBC")) | .version' "$1" | tr -d \")
-GCC=$(jq '.metadata.tools[] | select(.name|test("GCC")) | .version' "$1" | tr -d \")
-BOOTJDK=$(jq '.metadata.tools[] | select(.name|test("BOOTJDK")) | .version' "$1" | tr -d \")
-ALSA=$(jq '.metadata.tools[] | select(.name|test("ALSA")) | .version' "$1" | tr -d \" | sed -e 's/^.*alsa-lib-//' -e 's/\.tar.bz2//')
-FREETYPE=$(jq '.metadata.tools[] | select(.name|test("FreeType")) | .version' "$1" | tr -d \")
+GLIBC=$(jq '.metadata.tools.components[] | select(.name|test("GLIBC")) | .version' "$1" | tr -d \")
+GCC=$(jq '.metadata.tools.components[] | select(.name|test("GCC")) | .version' "$1" | tr -d \")
+BOOTJDK=$(jq '.metadata.tools.components[] | select(.name|test("BOOTJDK")) | .version' "$1" | tr -d \")
+ALSA=$(jq '.metadata.tools.components[] | select(.name|test("ALSA")) | .version' "$1" | tr -d \" | sed -e 's/^.*alsa-lib-//' -e 's/\.tar.bz2//')
+FREETYPE=$(jq '.metadata.tools.components[] | select(.name|test("FreeType")) | .version' "$1" | tr -d \")
COMPILER=$(jq '.components[0].properties[] | select(.name|test("Build Tools Summary")).value' "$SBOMFILE" | sed -e 's/^.*Toolchain: //g' -e 's/\ *\*.*//g')
EXPECTED_COMPILER="gcc (GNU Compiler Collection)"