search

CycloneDX / cyclonedx-python-lib

Python implementation of OWASP CycloneDX
https://cyclonedx.org/
Apache License 2.0
70 stars 40 forks source link

[WIP] feat: Add support for Component Identity Evidence #657

Open wahl-sec opened 3 months ago

wahl-sec commented 3 months ago

This pull request aims to implement the componentIdentityEvidence type from 1.5 and 1.6 as part of fulfilling #578

wahl-sec commented 3 months ago

This PR is a work in progress and does not currently pass the tests and does not propertly handle the 1.5 schema that only allows the componentIdentityEvidence to be an object and not an array of object as in 1.6. If anyone can help out with this please do as I have limited time (and knowledge of how the tests are setup 😄 )

wahl-sec commented 2 months ago

Identified some issues with some invalid tests, updated those and now it works for schema 1.6 with arrays. However, the only remaining issue is the object support for componentIdentityEvidence in schema 1.5 and 1.6.

jkowalleck commented 2 months ago

@wahl-sec is this work-in-progress, or ready for review?

does this change include any breaking changes? If not, then the target branch is main instead of 8.0.0-dev, and then the title would befeat: ...instead offeat!: ...`.

wahl-sec commented 2 months ago

@jkowalleck No breaking changes, only added the optional identity field to the evidence section in components. But as I noted above this PR currently only implements the array option and not the object type that was supported in 1.5. Not sure how it would be implemented to support both in this case. Updated the title and branch, thanks!