Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rework dependency type to provides #366

Merged
merged 1 commit into from
Jan 26, 2024
Merged

rework dependency type to provides #366

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions schema/bom-1.6.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,16 +171,12 @@ enum DataFlowDirection {
}

message Dependency {
enum DependencyType {
DEPENDENCY_TYPE_IMPLEMENTS = 0;
DEPENDENCY_TYPE_USES = 1;
}
// References a component or service by the its bom-ref attribute
string ref = 1;
// The bom-ref identifiers of the components or services that are dependencies of this dependency object.
repeated Dependency dependencies = 2;
// Defines and characterizes the type of dependency
optional DependencyType type = 3;
// The bom-ref identifiers of the components or services that define a given specification or standard, which are provided or implemented by this dependency object.
repeated string provides = 3;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

provides is a verb. Can we use a bit generic like capabilities to indicate a state and not an action?

Copy link
Member Author

@jkowalleck jkowalleck Jan 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

provides is a verb. Can we use a bit generic like capabilities to indicate a state and not an action?

for protobuff, I'd agree. a noun would go with the current naming conventions.

for JSON/XML, ... not certain.

PS: i am open to suggestions for alternative names.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like your suggestion for capabilities @prabhu would be a good fit for what we're doing with CDX 1.7 - specifically architecture and blueprints.

}

message Diff {
Expand Down
27 changes: 8 additions & 19 deletions schema/bom-1.6.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1766,11 +1766,14 @@
"title": "Depends On",
"description": "The bom-ref identifiers of the components or services that are dependencies of this dependency object."
},
"type": {
"type": "string",
"title": "Dependency Type",
"description": "Defines and characterizes the type of dependency",
"$ref": "#/definitions/dependencyType"
"provides": {
"type": "array",
"uniqueItems": true,
"items": {
"$ref": "#/definitions/refLinkType"
},
"title": "Provides",
"description": "The bom-ref identifiers of the components or services that define a given specification or standard, which are provided or implemented by this dependency object.\nFor example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use."
}
}
},
Expand Down Expand Up @@ -4601,20 +4604,6 @@
"title": "Signature",
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
},
"dependencyType": {
"type": "string",
"title": "Dependency Type",
"enum": [
"implements",
"uses"
],
"meta:enum": {
"implements": "Refers to a component or service that fulfills the requirements of a given specification or standard. For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use.",
"uses": "Refers to a component or service that relies on another component or service, either explicitly via function calls or via configuration at run time."
},
"default": "uses",
"description": "An optional field that describes the type of dependency."
},
"cryptoProperties": {
"type": "object",
"title": "Cryptographic Properties",
Expand Down
48 changes: 20 additions & 28 deletions schema/bom-1.6.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1851,18 +1851,32 @@ limitations under the License.

<xs:complexType name="dependencyType">
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="dependency" type="bom:dependencyType"/>
<xs:element name="dependency" type="bom:dependencyType" minOccurs="0">
<xs:annotation>
<xs:documentation>The component or service that is a dependency of this dependency object.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="provides" minOccurs="0">
<xs:annotation>
<xs:documentation>
The component or service that define a given specification or standard, which is provided or implemented by this dependency object.
For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="ref" type="bom:refLinkType" use="required">
<xs:annotation>
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attribute name="ref" type="bom:refLinkType" use="required">
<xs:annotation>
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="type" type="bom:dependencyUsageType" default="uses" use="optional">
<xs:annotation>
<xs:documentation>An optional field that describes the type of dependency.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:anyAttribute namespace="##other" processContents="lax">
<xs:annotation>
<xs:documentation>User-defined attributes may be used on this element as long as they
Expand All @@ -1871,28 +1885,6 @@ limitations under the License.
</xs:anyAttribute>
</xs:complexType>

<xs:simpleType name="dependencyUsageType">
<xs:restriction base="xs:string">
<xs:enumeration value="implements">
<xs:annotation>
<xs:documentation>
Refers to a component or service that fulfills the requirements of a given specification or
standard. For example, a cryptographic library which implements a cryptographic algorithm.
A component which implements another component does not imply that the implementation is in use.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="uses">
<xs:annotation>
<xs:documentation>
Refers to a component or service that relies on another component or service, either explicitly
via function calls or via configuration at run time.
</xs:documentation>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>

<xs:complexType name="dependenciesType">
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="dependency" type="bom:dependencyType">
Expand Down
11 changes: 8 additions & 3 deletions ...resources/1.6/valid-cryptography-1.6.json → ...alid-cryptography-implementation-1.6.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,18 +37,23 @@
"bom-ref": "crypto-library",
"name": "Crypto library",
"version": "1.0.0"
},
{
"type": "library",
"bom-ref": "some-library",
"name": "Some library",
"version": "1.0.0"
}
],
"dependencies": [
{
"ref": "acme-application",
"type": "uses",
"dependsOn": ["crypto-library"]
},
{
"ref": "crypto-library",
"type": "implements",
"dependsOn": ["aes128gcm"]
"provides": ["aes128gcm"],
"dependsOn": ["some-library"]
}
]
}
14 changes: 11 additions & 3 deletions ...rces/1.6/valid-cryptography-1.6.textproto → ...cryptography-implementation-1.6.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
# proto-file: schema/bom-1.6.proto
# proto-message:

spec_version: "1.6"
version: 1
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
Expand Down Expand Up @@ -40,21 +43,26 @@ components: [
bom_ref: "crypto-library"
name: "Crypto library"
version: "1.0.0"
},
{
type: CLASSIFICATION_LIBRARY
bom_ref: "some-library"
name: "Some library"
version: "1.0.0"
}
],
dependencies: [
{
ref: "acme-application"
type: DEPENDENCY_TYPE_USES
dependencies {
ref: "crypto-library"
}
},
{
ref: "crypto-library"
type: DEPENDENCY_TYPE_IMPLEMENTS
provides: [ "aes128gcm" ]
dependencies {
ref: "aes128gcm"
ref: "some-library"
}
}
]
11 changes: 8 additions & 3 deletions .../resources/1.6/valid-cryptography-1.6.xml → ...valid-cryptography-implementation-1.6.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,13 +34,18 @@
<name>Crypto Library</name>
<version>1.0.0</version>
</component>
<component type="library" bom-ref="some-library">
<name>Some Library</name>
<version>1.0.0</version>
</component>
</components>
<dependencies>
<dependency ref="acme-application" type="uses">
<dependency ref="acme-application">
<dependency ref="crypto-library"/>
</dependency>
<dependency ref="crypto-library" type="implements">
<dependency ref="aes128gcm"/>
<dependency ref="crypto-library">
<provides ref="aes128gcm"/>
<dependency ref="some-library"/>
</dependency>
</dependencies>
</bom>