mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 06:56:40 +01:00
feat: update syft to generate cyclone-dx 1.6 by default (#2978)
- Resolves #2974 - add detailed instructions re: updating schemas (a necessary task when a new CycloneDX spec version becomes available). - The DefaultVersion constant has been updated to "1.6" -- it's not clear to me how this is used at this time (it may be redundant given other code), but effectively unless a specific spec version is configured, `syft` will emit the "most recent" spec version available for cyclonedx. Users who wish to pin back to a "older" specVersion (e.g. to preserve compatibilty with utilities that have not yet bumped to latest) can either set this in a syft config file or pass a name@spec_version pair to the output flag (e.g. `-o cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`) - Regenerate relevant .golden files (there seems to be a way to do this via flags, but I couldn't quite figure out the right set to pass correctly, esp. since (as a relative go novice) I found it difficult to run just a single test file. I ended up "brute-forcing it" by changing the *updateSnapshot val to "true" and running it in Goland. A brief comment giving an example of regenerating fixtures usage would be helpful. Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>
This commit is contained in:
Rajan Agaskar
@@ -7,3 +7,12 @@ For this reason we've included a copy of all schemas needed to validate `syft` o
|
||||
to reference local copies of dependent schemas.
|
||||
|
||||
You can get the latest schemas from the [CycloneDX specifications repo](https://github.com/CycloneDX/specification/tree/master/schema).
|
||||
|
||||
When the spec version is bumped an approach to determining prior modifications is to compare the
|
||||
prior spec version (e.g. if updating to 1.7, compare the files in this directory against the 1.6
|
||||
equivalents).
|
||||
|
||||
One can also update the schemas and observe the errors in order to make the necessary updates.
|
||||
At the time of writing, the cyclonedx.xsd needed modifications to link to the local spdx.xsd,
|
||||
and also to changes the minOccurs for a license tag to 0. (The json schema does not require
|
||||
modification for the generated file to lint properly, but can simply be copy/pasted).
|
||||
|
||||
+2104
-230
File diff suppressed because one or more lines are too long
+2918
-92
File diff suppressed because it is too large
Load Diff
+126
-1
@@ -2,7 +2,7 @@
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
elementFormDefault="qualified"
|
||||
targetNamespace="http://cyclonedx.org/schema/spdx"
|
||||
version="1.0-3.23">
|
||||
version="1.0-3.24.0">
|
||||
|
||||
<xs:simpleType name="licenseId">
|
||||
<xs:restriction base="xs:string">
|
||||
@@ -12,6 +12,11 @@
|
||||
<xs:documentation>BSD Zero Clause License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="3D-Slicer-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>3D Slicer License v1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="AAL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Attribution Assurance License</xs:documentation>
|
||||
@@ -117,6 +122,11 @@
|
||||
<xs:documentation>Aladdin Free Public License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="AMD-newlib">
|
||||
<xs:annotation>
|
||||
<xs:documentation>AMD newlib License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="AMDPLPA">
|
||||
<xs:annotation>
|
||||
<xs:documentation>AMD's plpa_map.c License</xs:documentation>
|
||||
@@ -147,6 +157,11 @@
|
||||
<xs:documentation>ANTLR Software Rights Notice with license fallback</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="any-OSI">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Any OSI License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Apache-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Apache License 1.0</xs:documentation>
|
||||
@@ -322,6 +337,11 @@
|
||||
<xs:documentation>BSD 2-Clause - Ian Darwin variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-2-Clause-first-lines">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD 2-Clause - first lines requirement</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="BSD-2-Clause-FreeBSD">
|
||||
<xs:annotation>
|
||||
<xs:documentation>BSD 2-Clause FreeBSD License</xs:documentation>
|
||||
@@ -522,6 +542,11 @@
|
||||
<xs:documentation>Caldera License (without preamble)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Catharon">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Catharon License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CATOSL-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Computer Associates Trusted Open Source License 1.1</xs:documentation>
|
||||
@@ -1002,6 +1027,11 @@
|
||||
<xs:documentation>curl License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="cve-tou">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Common Vulnerability Enumeration ToU License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="D-FSL-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Deutsche Freie Software Lizenz</xs:documentation>
|
||||
@@ -1482,6 +1512,11 @@
|
||||
<xs:documentation>gtkbook License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Gutmann">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Gutmann License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HaskellReport">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Haskell Language Report License</xs:documentation>
|
||||
@@ -1532,11 +1567,21 @@
|
||||
<xs:documentation>HPND with US Government export control warning</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-export-US-acknowledgement">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND with US Government export control warning and acknowledgment</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-export-US-modify">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND with US Government export control warning and modification rqmt</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-export2-US">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND with US Government export control and 2 disclaimers</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-Fenneberg-Livingston">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant</xs:documentation>
|
||||
@@ -1547,6 +1592,11 @@
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - INRIA-IMAG variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-Intel">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Intel variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-Kevlin-Henney">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Kevlin Henney variant</xs:documentation>
|
||||
@@ -1557,6 +1607,11 @@
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Markus Kuhn variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-merchantability-variant">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - merchantability variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-MIT-disclaimer">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
|
||||
@@ -1587,11 +1642,21 @@
|
||||
<xs:documentation>HPND sell variant with MIT disclaimer</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-sell-variant-MIT-disclaimer-rev">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HPND sell variant with MIT disclaimer - reverse</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-UC">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - University of California variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-UC-export-US">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - University of California, US export warning</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HTMLTIDY">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HTML Tidy License</xs:documentation>
|
||||
@@ -2027,6 +2092,11 @@
|
||||
<xs:documentation>MIT Festival Variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-Khronos-old">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIT Khronos - old variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-Modern-Variant">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIT License Modern Variant</xs:documentation>
|
||||
@@ -2162,11 +2232,21 @@
|
||||
<xs:documentation>Net Boolean Public License v1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NCBI-PD">
|
||||
<xs:annotation>
|
||||
<xs:documentation>NCBI Public Domain Notice</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NCGL-UK-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Non-Commercial Government Licence</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NCL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>NCL Source Code License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="NCSA">
|
||||
<xs:annotation>
|
||||
<xs:documentation>University of Illinois/NCSA Open Source License</xs:documentation>
|
||||
@@ -2282,6 +2362,11 @@
|
||||
<xs:documentation>Open Use of Data Agreement v1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OAR">
|
||||
<xs:annotation>
|
||||
<xs:documentation>OAR License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OCCT-PL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Open CASCADE Technology Public License</xs:documentation>
|
||||
@@ -2562,6 +2647,11 @@
|
||||
<xs:documentation>Pixar License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="pkgconf">
|
||||
<xs:annotation>
|
||||
<xs:documentation>pkgconf License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Plexus">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Plexus Classworlds License</xs:documentation>
|
||||
@@ -2587,6 +2677,11 @@
|
||||
<xs:documentation>PostgreSQL License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="PPL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Peer Production License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="PSF-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Python Software Foundation License 2.0</xs:documentation>
|
||||
@@ -2862,6 +2957,11 @@
|
||||
<xs:documentation>Sun PPP License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Sun-PPP-2000">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Sun PPP License (2000)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SunPro">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SunPro License</xs:documentation>
|
||||
@@ -2907,6 +3007,11 @@
|
||||
<xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="threeparttable">
|
||||
<xs:annotation>
|
||||
<xs:documentation>threeparttable License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="TMate">
|
||||
<xs:annotation>
|
||||
<xs:documentation>TMate Open Source License</xs:documentation>
|
||||
@@ -3132,6 +3237,11 @@
|
||||
<xs:documentation>XSkat License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="xzoom">
|
||||
<xs:annotation>
|
||||
<xs:documentation>xzoom License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="YPL-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Yahoo! Public License v1.0</xs:documentation>
|
||||
@@ -3203,6 +3313,11 @@
|
||||
<xs:documentation>Asterisk exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Asterisk-linking-protocols-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Asterisk linking protocols exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Autoconf-exception-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Autoconf exception 2.0</xs:documentation>
|
||||
@@ -3438,6 +3553,11 @@
|
||||
<xs:documentation>OpenVPN OpenSSL Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="PCRE2-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>PCRE2 exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="PS-or-PDF-font-exception-20170817">
|
||||
<xs:annotation>
|
||||
<xs:documentation>PS/PDF font exception (2017-08-17)</xs:documentation>
|
||||
@@ -3463,6 +3583,11 @@
|
||||
<xs:documentation>Qwt exception 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="RRDtool-FLOSS-exception-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SANE-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SANE Exception</xs:documentation>
|
||||
|
||||
Reference in New Issue
Block a user