search

CycloneDX / cyclonedx-gradle-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects
https://cyclonedx.org/
Apache License 2.0
162 stars 77 forks source link

upgrade cyclonedx-core-java to 9.x.x #444

Closed skhokhlov closed 4 months ago

skhokhlov commented 5 months ago

Well, from my understanding, the tests are failing because of a bug in cyclonedx-java-core. 

CycloneDX: Validating BOM
Unknown keyword meta:enum - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword or if it should generate annotations AnnotationKeyword
Unknown keyword deprecated - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword or if it should generate annotations AnnotationKeyword

https://github.com/CycloneDX/cyclonedx-core-java/blob/master/src/main/resources/bom-1.6.schema.json#L611

That project doesn't have any tests for schema validation

skhokhlov commented 5 months ago

Related issue https://github.com/CycloneDX/cyclonedx-core-java/issues/409

jkowalleck commented 5 months ago

@glefloch could you review this PR and maybe merge/release it?

skhokhlov commented 5 months ago

does not change any default values, or does it? if it did, this would be a breaking change ...

just default schema version, will be 1.6

VinodAnandan commented 5 months ago

@skhokhlov can we keep 1.5 as default, maybe we can change the default version in the 1.9.x 2.x release?

skhokhlov commented 5 months ago

@skhokhlov can we keep 1.5 as default, maybe we can change the default version in the ~1.9.x~ 2.x release?

Any reason for this? Previously default schema version was update with minor release 1.8.0

jkowalleck commented 5 months ago

@skhokhlov can we keep 1.5 as default, maybe we can change the default version in the ~1.9.x~ 2.x release?

Any reason for this? Previously default schema version was update with minor release 1.8.0

Previous changes were non-ideal. They introduced breaking changes when users did not expect them. We want to enable users to use CycloneDX 1.6, but don't want to force existing inexperienced users to it. The idea is: By not changing the default, we would enable existing users to upgrade easily, without breaking any processes.

PS: i am fully with you when it comes to updating the readme (here and here, etc) in a way that users are pointed to use 1.6 - but the default should sill be unchanged fo now.

skhokhlov commented 5 months ago

pushed the change with 1.5 by default

skhokhlov commented 4 months ago

Any change to make it merged? 🙃