[CycloneDX] Add artifactID and groupID to the cycloneDX properties (support lower level struct as properties) #758
Conversation
Signed-off-by: Peter Balogh <[email protected]>
Signed-off-by: Peter Balogh <[email protected]>
| } else { | ||
| props = append(props, cyclonedx.Property{ | ||
| Name: name, | ||
| Value: fmt.Sprintf("%s", value), |
There was a problem hiding this comment.
This would require the output value to support a Stringer interface. in case the name is not - and the value kind is struct, we might end up in a weird spot here.
There was a problem hiding this comment.
I added a check for the type of value.
| return "" | ||
| case reflect.Ptr: | ||
| return getCycloneDXPropertyValue(reflect.Indirect(field)) | ||
| case reflect.Struct: |
There was a problem hiding this comment.
We should move this up to line 65 instead. Having the field.CanInterface() check is important to avoid potential panics during reflection.
There was a problem hiding this comment.
I added canInterface check for field.
| Name string `mapstructure:"name" json:"name"` | ||
| GroupID string `mapstructure:"groupId" json:"groupId"` | ||
| ArtifactID string `mapstructure:"artifactId" json:"artifactId"` | ||
| GroupID string `mapstructure:"groupId" json:"groupId" cyclonedx:"groupID"` |
There was a problem hiding this comment.
I believe we should explicitly handle groupId/artifactId the way it is specified in the CDX spec - i.e. using the structured group and name field of a component. https://cyclonedx.org/docs/1.4/json/#components_items_name rather than a property.
We can also take a look at the reference CycloneDX maven implementation for reference on how it handles these fields - https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/684b4d59012396e8548faa4d8460bc49c2af79f9/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java#L436-L439
cc: @stevespringett who will know more.
There was a problem hiding this comment.
I think the lower level support of structs can be feasible for the future.
At the moment the group is missing and putting it into the CDX properties don't cause any issues.
For example, there is a type and language in the properties that can be easily extracted from the PURL.
But it would be great to put groupID to the group filed
There was a problem hiding this comment.
@samj1912 I added group filed with groupID in the case of java. I think the grouID and artifactID still can be a part of the properties. WDYT?
There was a problem hiding this comment.
The group field in CycloneDX is intended to be a drop-in for Maven groupId and NPM scope names. The CycloneDX implementations for Maven, Gradle, Webpack, and NodeJS all use the group field.
There was a problem hiding this comment.
There was a problem hiding this comment.
@stevespringett Thanks for your explanation. So filling the group filed with groupID is OK.
Signed-off-by: Peter Balogh <[email protected]>
Signed-off-by: Peter Balogh <[email protected]>
There was a problem hiding this comment.
Excellent work 🏅 --this will help immensely with the upcoming anchore/grype#481 work! 🙌
Signed-off-by: Alex Goodman <[email protected]>
…upport lower level struct as properties) (anchore#758) * [CycloneDX] Add artifactID and groupID to the cycloneDX properties Signed-off-by: Peter Balogh <[email protected]> * update comment Signed-off-by: Peter Balogh <[email protected]> * additional checks for value Signed-off-by: Peter Balogh <[email protected]> * fill group filed with groupID in the case of Java Signed-off-by: Peter Balogh <[email protected]> * fix linter warning Signed-off-by: Alex Goodman <[email protected]> Co-authored-by: Alex Goodman <[email protected]>
…upport lower level struct as properties) (anchore#758) * [CycloneDX] Add artifactID and groupID to the cycloneDX properties Signed-off-by: Peter Balogh <[email protected]> * update comment Signed-off-by: Peter Balogh <[email protected]> * additional checks for value Signed-off-by: Peter Balogh <[email protected]> * fill group filed with groupID in the case of Java Signed-off-by: Peter Balogh <[email protected]> * fix linter warning Signed-off-by: Alex Goodman <[email protected]> Co-authored-by: Alex Goodman <[email protected]>
Signed-off-by: Peter Balogh [email protected]
related: #685 , #710
In the case of java add artifactID and groupID pomProperties to the cycloneDX properties.
groupIDas agroupto the CDX component in the case of Java