Skip to content

Commit c3120e2

Browse files
ctronctron
committed
feat: implement ingestion of SPDX and CDX external references
1 parent ba0af8f commit c3120e2

File tree

13 files changed

+813
-19
lines changed

13 files changed

+813
-19
lines changed

‎entity/src/sbom_external_node.rs

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,11 @@ pub struct Model {
1212
pub external_node_ref: String,
1313
pub external_type: ExternalType,
1414
pub target_sbom_id: Option<Uuid>,
15+
pub discriminator_type: Option<DiscriminatorType>,
16+
pub discriminator_value: Option<String>,
1517
}
1618

19+
/// Type of the SBOM document discriminator, when using external references.
1720
#[derive(
1821
Debug,
1922
Clone,
@@ -28,7 +31,35 @@ pub struct Model {
2831
)]
2932
#[sea_orm(rs_type = "i32", db_type = "Integer")]
3033
#[serde(rename_all = "snake_case")]
34+
pub enum DiscriminatorType {
35+
/// By using an SHA-256 digest
36+
#[sea_orm(num_value = 0)]
37+
Sha256,
38+
/// By using an SHA-384 digest
39+
#[sea_orm(num_value = 1)]
40+
Sha384,
41+
/// By using an SHA-512 digest
42+
#[sea_orm(num_value = 2)]
43+
Sha512,
44+
/// By using an CycloneDX version
45+
#[sea_orm(num_value = 3)]
46+
CycloneDxVersion,
47+
}
3148

49+
#[derive(
50+
Debug,
51+
Clone,
52+
Copy,
53+
PartialEq,
54+
Eq,
55+
EnumIter,
56+
DeriveActiveEnum,
57+
serde::Serialize,
58+
serde::Deserialize,
59+
DeepSizeOf,
60+
)]
61+
#[sea_orm(rs_type = "i32", db_type = "Integer")]
62+
#[serde(rename_all = "snake_case")]
3263
pub enum ExternalType {
3364
#[sea_orm(num_value = 0)]
3465
SPDX,

‎etc/test-data/spdx/simple-ext-a.json

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
{
2+
"SPDXID": "SPDXRef-DOCUMENT",
3+
"creationInfo": {
4+
"created": "1970-01-01T13:30:00Z",
5+
"creators": [
6+
"Trustify"
7+
],
8+
"comment": "This is a simple example for an spdx SBOM with an external reference.",
9+
"licenseListVersion": "3.8"
10+
},
11+
"externalDocumentRefs": [
12+
{
13+
"externalDocumentId": "DocumentRef-ext-b",
14+
"spdxDocument": "uri:simple-ext-b",
15+
"checksum": {
16+
"algorithm": "SHA256",
17+
"checksumValue": "60bf029859f5927eafba8dd02c73b9075e40a2089c92da9c1062b01dcd2b300c"
18+
}
19+
}
20+
],
21+
"dataLicense": "CC0-1.0",
22+
"documentNamespace": "uri:simple-ext-a",
23+
"name": "simple-a",
24+
"packages": [
25+
{
26+
"SPDXID": "SPDXRef-A",
27+
"copyrightText": "NOASSERTION",
28+
"downloadLocation": "foo",
29+
"externalRefs": [
30+
{
31+
"referenceCategory": "PACKAGE-MANAGER",
32+
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src",
33+
"referenceType": "purl"
34+
},
35+
{
36+
"referenceCategory": "SECURITY",
37+
"referenceLocator": "cpe:/a:redhat:simple:1::el9",
38+
"referenceType": "cpe22Type"
39+
}
40+
],
41+
"filesAnalyzed": false,
42+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
43+
"licenseConcluded": "NOASSERTION",
44+
"licenseDeclared": "NOASSERTION",
45+
"name": "A",
46+
"originator": "NOASSERTION",
47+
"packageFileName": "NOASSERTION",
48+
"supplier": "Organization: Red Hat",
49+
"versionInfo": "1"
50+
},
51+
{
52+
"SPDXID": "SPDXRef-B",
53+
"copyrightText": "NOASSERTION",
54+
"downloadLocation": "foo",
55+
"externalRefs": [
56+
{
57+
"referenceCategory": "PACKAGE-MANAGER",
58+
"referenceLocator": "pkg:rpm/redhat/[email protected]",
59+
"referenceType": "purl"
60+
}
61+
],
62+
"filesAnalyzed": false,
63+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
64+
"licenseConcluded": "NOASSERTION",
65+
"licenseDeclared": "NOASSERTION",
66+
"name": "B",
67+
"originator": "NOASSERTION",
68+
"packageFileName": "NOASSERTION",
69+
"supplier": "Organization: Red Hat",
70+
"versionInfo": "1"
71+
},
72+
{
73+
"SPDXID": "SPDXRef-AA",
74+
"copyrightText": "NOASSERTION",
75+
"downloadLocation": "foo",
76+
"externalRefs": [
77+
{
78+
"referenceCategory": "PACKAGE-MANAGER",
79+
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src",
80+
"referenceType": "purl"
81+
},
82+
{
83+
"referenceCategory": "SECURITY",
84+
"referenceLocator": "cpe:/a:redhat:simple:1::el9",
85+
"referenceType": "cpe22Type"
86+
}
87+
],
88+
"filesAnalyzed": false,
89+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
90+
"licenseConcluded": "NOASSERTION",
91+
"licenseDeclared": "NOASSERTION",
92+
"name": "AA",
93+
"originator": "NOASSERTION",
94+
"packageFileName": "NOASSERTION",
95+
"supplier": "Organization: Red Hat",
96+
"versionInfo": "1"
97+
},
98+
{
99+
"SPDXID": "SPDXRef-BB",
100+
"copyrightText": "NOASSERTION",
101+
"downloadLocation": "foo",
102+
"externalRefs": [
103+
{
104+
"referenceCategory": "PACKAGE-MANAGER",
105+
"referenceLocator": "pkg:rpm/redhat/[email protected]",
106+
"referenceType": "purl"
107+
}
108+
],
109+
"filesAnalyzed": false,
110+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
111+
"licenseConcluded": "NOASSERTION",
112+
"licenseDeclared": "NOASSERTION",
113+
"name": "BB",
114+
"originator": "NOASSERTION",
115+
"packageFileName": "NOASSERTION",
116+
"supplier": "Organization: Red Hat",
117+
"versionInfo": "1"
118+
},
119+
{
120+
"SPDXID": "SPDXRef-CC",
121+
"copyrightText": "NOASSERTION",
122+
"downloadLocation": "foo",
123+
"externalRefs": [
124+
{
125+
"referenceCategory": "PACKAGE-MANAGER",
126+
"referenceLocator": "pkg:rpm/redhat/[email protected]",
127+
"referenceType": "purl"
128+
}
129+
],
130+
"filesAnalyzed": false,
131+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
132+
"licenseConcluded": "NOASSERTION",
133+
"licenseDeclared": "NOASSERTION",
134+
"name": "CC",
135+
"originator": "NOASSERTION",
136+
"packageFileName": "NOASSERTION",
137+
"supplier": "Organization: Red Hat",
138+
"versionInfo": "1"
139+
},
140+
{
141+
"SPDXID": "SPDXRef-DD",
142+
"copyrightText": "NOASSERTION",
143+
"downloadLocation": "foo",
144+
"externalRefs": [
145+
{
146+
"referenceCategory": "PACKAGE-MANAGER",
147+
"referenceLocator": "pkg:rpm/redhat/[email protected]",
148+
"referenceType": "purl"
149+
}
150+
],
151+
"filesAnalyzed": false,
152+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
153+
"licenseConcluded": "NOASSERTION",
154+
"licenseDeclared": "NOASSERTION",
155+
"name": "DD",
156+
"originator": "NOASSERTION",
157+
"packageFileName": "NOASSERTION",
158+
"supplier": "Organization: Red Hat",
159+
"versionInfo": "1"
160+
},
161+
{
162+
"SPDXID": "SPDXRef-EE",
163+
"copyrightText": "NOASSERTION",
164+
"downloadLocation": "foo",
165+
"externalRefs": [
166+
{
167+
"referenceCategory": "PACKAGE-MANAGER",
168+
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src",
169+
"referenceType": "purl"
170+
}
171+
],
172+
"filesAnalyzed": false,
173+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
174+
"licenseConcluded": "NOASSERTION",
175+
"licenseDeclared": "NOASSERTION",
176+
"name": "EE",
177+
"originator": "NOASSERTION",
178+
"packageFileName": "NOASSERTION",
179+
"supplier": "Organization: Red Hat",
180+
"versionInfo": "1"
181+
},
182+
{
183+
"SPDXID": "SPDXRef-FF",
184+
"copyrightText": "NOASSERTION",
185+
"downloadLocation": "foo",
186+
"externalRefs": [
187+
{
188+
"referenceCategory": "SECURITY",
189+
"referenceLocator": "cpe:/a:redhat:a-FF:1:*:*:*:*:*",
190+
"referenceType": "cpe22Type"
191+
}
192+
],
193+
"filesAnalyzed": false,
194+
"licenseComments": "Licensing information is automatically generated and may be incomplete or incorrect.",
195+
"licenseConcluded": "NOASSERTION",
196+
"licenseDeclared": "NOASSERTION",
197+
"name": "FF",
198+
"originator": "NOASSERTION",
199+
"packageFileName": "NOASSERTION",
200+
"supplier": "Organization: Red Hat",
201+
"versionInfo": "1"
202+
}
203+
204+
],
205+
"relationships" : [
206+
{
207+
"spdxElementId" : "SPDXRef-B",
208+
"relatedSpdxElement" : "SPDXRef-A",
209+
"relationshipType" : "CONTAINED_BY"
210+
},
211+
{
212+
"spdxElementId" : "SPDXRef-BB",
213+
"relatedSpdxElement" : "SPDXRef-AA",
214+
"relationshipType" : "CONTAINED_BY"
215+
},
216+
{
217+
"spdxElementId" : "SPDXRef-CC",
218+
"relatedSpdxElement" : "SPDXRef-BB",
219+
"relationshipType" : "CONTAINED_BY"
220+
},
221+
{
222+
"spdxElementId" : "SPDXRef-DD",
223+
"relatedSpdxElement" : "SPDXRef-BB",
224+
"relationshipType" : "CONTAINED_BY"
225+
},
226+
{
227+
"spdxElementId" : "SPDXRef-FF",
228+
"relatedSpdxElement" : "SPDXRef-DD",
229+
"relationshipType" : "CONTAINED_BY"
230+
},
231+
{
232+
"spdxElementId": "SPDXRef-DOCUMENT",
233+
"relatedSpdxElement": "SPDXRef-A",
234+
"relationshipType": "DESCRIBES"
235+
},
236+
{
237+
"spdxElementId": "SPDXRef-A",
238+
"relatedSpdxElement": "DocumentRef-ext-b:SPDXRef-A",
239+
"relationshipType": "PACKAGE_OF"
240+
}
241+
],
242+
"spdxVersion": "SPDX-2.2"
243+
}

0 commit comments

Comments
 (0)